Privacy Policy

This Privacy Policy explains how iCard Limited (“iCard”, “we”, “us”) collects, uses, shares, and protects information when you use the iCard website, dashboard, digital business card, iTap physical NFC card, Smart Printed Business Card, iQR Code product, or any related service (the “Service”). It applies to visitors, cardholders (“Account Owners”), and anyone who views a published card or scans an iTap/QR code.

1. Information we collect

Information you provide directly:

• Account details: name, email address, password (stored in hashed form, never as plain text), and phone number;
• Card content: job title, company, photo, logo, social links, WiFi credentials, opening hours, payment (till/paybill) details, and any other information you choose to add to your card;
• Delivery details for a physical iTap card or Smart Printed Business Card: name, phone number, and delivery address;
• Payment information: iCard does not collect or store your full card or mobile-money number — payments are handled by our payment provider (currently Pesapal), which shares only a transaction status and reference with us.

Information collected automatically:

• Card analytics: when your published card is viewed, its QR code scanned, or a contact tile (call, WhatsApp, email, WiFi, payment, etc.) tapped — recorded against your card only, to power your own analytics dashboard;
• Device signal: whether a scan came from an iTap tag, a printed QR, or your card's own digital link, and a coarse device identifier — used only to attribute scans, never to individually track a visitor across other sites;
• Standard technical data such as browser user-agent and referring page, associated with the above events.

Information from a card you view: if you tap or scan someone else's iCard and choose to save their contact or send your own details back through the meet page, the information you enter is shared with that card's owner and is their responsibility, not iCard's, once shared. This applies to any contact information an Account Owner collects through the Service more generally (for example, scanned business cards or leads submitted through their card) — see our Terms of Service, Section 4.

2. Guest checkout and account creation on your behalf

If you buy a physical product without first creating an account, you provide an email address and phone number at checkout. Once payment is confirmed, we automatically create an account using that email address and email you a link to set your own password. This is done because you authorized it by submitting your details at checkout — see our Terms of Service, Section 2.

3. How we use your information

• To create and operate your account and digital card, and to fulfill physical card orders;
• To process payments through our payment provider;
• To send transactional email — account setup, password reset, order and delivery updates;
• To show you your own card's analytics (views, scans, taps);
• To detect and prevent fraud, abuse, and automated (bot) signups;
• To provide customer support when you contact us; and
• To comply with legal obligations.

We do not sell your personal information to third parties, and we do not use your card content or analytics data to serve you advertising.

4. Who we share information with

We share information only where necessary to operate the Service:

• Infrastructure providers — Google Firebase (authentication, database, file storage, hosting);
• Payment providers — Pesapal, and mobile-money rails it connects to, to process a payment you initiate;
• Email delivery — Amazon Simple Email Service (SES), to send account and transactional email;
• Third-party AI providers — only when you actively use an AI writing feature, and only the text you submit for that request (see section 5);
• Anyone who scans your published card or iTap tag — sees the card content you have chosen to make public;
• An Enterprise administrator, if your card was created under an organization account, who can view and edit cards within that organization; and
• Law enforcement or regulators, where required by law or to protect the rights, safety, or property of iCard or others.

Each of these providers processes data only as needed to perform their function for iCard and is bound by its own confidentiality and security obligations.

5. AI-assisted writing features

Some parts of the Service — such as generating a suggested bio or tagline — are powered by third-party AI providers. These features are optional and run only when you choose to use them. When you do, the notes or draft text you submit for that specific request are sent to the AI provider to generate a suggestion, and the result is returned to you. Nothing else from your account or card is included in the request, and the suggested text is saved only if you choose to keep it. We do not use your card content to train AI models.

6. Data retention

We retain your account and card data for as long as your account is active. If you deactivate your account, we retain the underlying data for a reasonable period in case you wish to reactivate, and to meet legal, accounting, or fraud-prevention obligations, after which it is deleted or anonymized. Analytics events are retained on a rolling basis to power your dashboard's reporting.

If you use iCard through a connected platform such as a Shopify store, uninstalling the app stops it from rendering your card, and we honour that platform's mandatory data requests — including requests to view the data held about a shop or its customers, and requests to erase it. Data associated with the uninstalled shop is deleted on receipt of such a request.

7. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. You can update most of your account and card information directly from your dashboard at any time. For anything else, including a full account deletion request, contact us using the details in Section 12 — we will respond within a reasonable time and in line with applicable law in your jurisdiction.

8. Security

We use industry-standard safeguards to protect your information, including encrypted connections (HTTPS), hashed password storage, and role-based access controls limiting who can view account and payment data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. International data transfers

iCard is used globally, and our infrastructure and service providers operate in multiple countries. By using the Service, you understand that your information may be processed and stored in a country other than your own, under safeguards consistent with this Policy.

10. Children

The Service is not directed at, and we do not knowingly collect personal information from, anyone under the age of 18.

11. Changes to this Policy

We may update this Privacy Policy from time to time. The “Last updated” date above reflects the most recent revision. Material changes will be highlighted on this page or communicated to you directly where appropriate.

12. Contact

Questions about this Policy, or a request relating to your data, can be sent to hi@myicard.co or via WhatsApp at 0119 502 111.