Your data, and what we do with it

Orbcards (“Orbcards”, “we”, “us”) makes NFC business cards and the profile pages for them. We are based at House 12, Road 5, Banani, Dhaka 1213, Bangladesh. We operate orbcards.com, the profile pages on orbc.link, the dashboard at app.orbcards.com and the services behind them (together, the “Service”).

For the data of our customers, we decide why and how the data is used, so we are responsible for it. For the leads that visitors send to a card holder, the card holder decides what to do with them. We store and process those leads for the card holder (see section 6).

This policy applies to three groups of people:

• Card holders: people who make an account, a profile, or order a card, including members and admins of a team.
• Visitors: people who tap a card, scan its QR code or open a profile link. Visitors do not need an account.
• Website visitors: people who read orbcards.com or contact us.

We do not collect your Google password. We do not keep Google access tokens and we do not read your Google contacts, calendar, Drive or Gmail.

When someone opens a profile, we record a small activity event so the card holder can see that the card works:

• What happened: a view, a tap, a contact save, a link click or a contact exchange, and the button or link title.
• How they arrived: NFC tap, QR scan or link, and which card was used.
• Approximate place: the city that our network provider derives from the IP address (for example “Dhaka”). We do not store the IP address with the event and we never collect precise location.
• Device label: a short label from the browser's user agent, for example “iPhone”.

Contact exchange. If a visitor fills in the exchange form on a profile, the details they type (for example name, phone, email, company, title and a note) go to that card holder's leads inbox. The visitor chooses to send them. The card holder receives an email that a new lead arrived.

Reports. If a visitor reports a profile, we store the parts they reported, their note and a one-way hash of their IP address. The hash stops one person from sending the same report many times. We cannot turn it back into the IP address.

Live viewers. While a profile is open, the page sends a random tab id every few seconds so the card holder can see “N viewing now”. This stays in memory for about 20 seconds and is not saved to the database.

We do not sell personal data. We do not show advertising and we do not use advertising or tracking cookies. We do not use your data or your visitors' data to train AI models.

The card holder controls the leads that visitors send. Only the card holder (and, for a team profile, the team admin) can open them. Our staff see how many leads an account has, not what they say.

The card holder can export leads to a file. After that, the card holder is responsible for how they use the exported data. If you sent your details to a card holder and want them removed, ask that card holder first. If they do not answer, write to [email protected] and we will help.

A published profile is public. Anybody with the link, the card or the QR code can see it, and search engines can list it. You decide what goes on it. Do not add data that you do not want people to see. Drafts are not public until you publish them.

When a visitor saves your contact, the phone keeps a copy (a vCard). We cannot delete that copy if you later change or delete your profile.

If you join a team, the team admin can see your team profile, its taps and views, and the leads it collects. The admin can lock brand fields on your profile and can remove you from the team. If you leave the team, your team profile and its leads stay with the team. Your personal profiles stay with you.

We share data only with these service providers, and only what each needs to do its job:

• Email delivery (Resend): your email address and the content of sign-in codes, invites and lead notices.
• Google: only if you choose Continue with Google. Google tells us your email address and name. Google's own privacy policy covers what Google does.
• Payment providers (bKash, Nagad and card processors): the amount and the reference for your payment. We do not see or store your full card number or PIN.
• Courier companies: the name, phone and address for delivery.
• Hosting and network: the servers and network services that run the Service and store its database and files.

We can also disclose data if the law or a valid order from a court or authority in Bangladesh requires it, to protect people from harm, or as part of a sale or merger of Orbcards (we would tell you first).

We use only the cookies that the Service needs to work. We do not use analytics, advertising or social media cookies.

There are no passwords to steal: you sign in with a one-time code or with Google. We store only a salted hash of each code and a hash of each session token. Codes expire after 10 minutes and allow 5 tries. All connections use HTTPS.

The server checks ownership on every change, so one account cannot read or change another account's data. Staff access is limited, needs its own sign-in and is written to an audit log. Card codes are secret and profiles can only be found by code, so nobody can list profiles by walking card serials.

No system is perfectly safe. If a breach affects your data, we will tell you without undue delay.

You can:

• See and change your profile and settings in the dashboard at any time.
• Get a copy of your leads (export in the dashboard) or ask us for a copy of all your data.
• Delete your account. Ask support from Settings → Delete account, or write to us. Your profile stops opening, your cards go blank and your leads are deleted after 30 days.
• Object or withdraw consent for anything based on our legitimate interest or your consent.
• Complain to the relevant authority in Bangladesh if you think we misuse your data. Please talk to us first so we can fix it.

Write to [email protected]. We answer within 30 days. We may ask you to confirm your identity from the email address on the account.

The Service is for professionals. You must be 18 or older to make an account or order a card. We do not knowingly collect data from children. If you think a child made an account, tell us and we will delete it.

We store data on servers that we rent. Some providers (for example email delivery and Google) can process data outside Bangladesh. When that happens, we use providers that protect it to a standard that is at least as high as this policy.

If we change this policy, we change the date at the top. If a change is important, we tell card holders by email or in the dashboard before it starts.