vCard data policy

The current version of this policy, with its full change history and earlier versions, is always at vcard.webtrickssoftware.com/data-policy. If the two ever differ, that version applies.

This Data Policy explains how Webtricks Software Pvt. Ltd. handles data in vCard — who owns it, where it is kept, who can access it, and how it is deleted. It works together with our Privacy Policy.

1. You own your content — no commercial use

The information you put on your cards, your QR codes and the leads you receive belong to you. We use them only to provide the Service to you. We do not use your data for any commercial purpose: we do not sell it to any third party, we do not rent, trade, license or otherwise commercialise it, we do not share it with advertisers, data brokers or marketing companies, and we never use it for advertising or marketing.

2. Kinds of data and who can see them

Data	Who can see it
Content of an Active card	Anyone you share the card link or QR code with
Inactive cards, QR settings, statistics	You, and authorised Webtricks administrators
Account details (name, email, phone, company)	You, and authorised Webtricks administrators
Leads sent to your card	You, and authorised Webtricks administrators
Password and email verification codes	No one — stored only as one-way hashes; codes expire within minutes
Single sign-on details (provider, name, email, account ID)	You, and authorised Webtricks administrators — used only to sign you in
Your last 3 logins (time, approximate location, IP address, device)	You, on your dashboard, and authorised Webtricks administrators, for security
Activity log of administrator actions	Authorised Webtricks administrators — customer actions are not logged

3. Administrator access

Webtricks staff access accounts only through role-based permissions — each administrator sees only the sections their role allows. Administrators can view, edit, suspend or delete accounts and cards to provide support, to keep the Service safe, to enforce our terms or to meet legal obligations. Administrative actions are recorded in an activity log. Staff are bound by confidentiality and may not copy, share or use customer data for any other purpose.

4. Where data is stored

Data is stored in a MySQL database and file storage on our hosting provider’s servers. All traffic between your browser or app and our servers is encrypted with HTTPS. Uploaded images are stored with random file names, and scripts cannot run from the upload folder.

5. How we protect data

• Passwords are hashed with a strong one-way algorithm; login tokens are stored only as hashes.
• Every email address is verified with a 6-digit one-time code (or by the sign-in provider, such as Google, when it confirms your email) before it can be used to sign in.
• Changing your sign-in email needs a code sent to the new address, and your old address is told about the change.
• Deleting your own account needs a code sent to your account email.
• Logins and sign-ups are protected by Cloudflare Turnstile and by rate limits against password guessing.
• The website and the mobile apps reach the database only through our authenticated API, never directly.
• Configuration files and internal folders are blocked from public access.
• Changing your password signs out your other devices; suspending an account ends all its sessions.

6. Mobile apps and login methods

Each login method — email and password, mobile number and password, a one-time SMS code, and sign-in with Google, Microsoft, Apple, Facebook, LinkedIn or GitHub — can be switched on or off separately for the website and the mobile apps. SMS codes are delivered through our SMS provider, which receives only your mobile number and the code. The Android and iOS apps use the same account and the same API as the website. They store only a login token on your device, which you can remove by logging out. The apps follow this policy and the Privacy Policy.

7. Retention and deletion

• You can delete your account yourself from My profile → Delete my account, after confirming a 6-digit code we email to you. Administrators can also delete an account on request.
• Deleting an account permanently removes the account, all its cards, QR codes, leads, uploaded images and active sessions from the live database at once. Card links and dynamic QR codes stop working immediately.
• Only the 3 most recent logins of each account are kept; every new login overwrites the oldest. Deleting an account deletes its login history too.
• We do not keep an activity log of customer actions. The administrator activity log records only what Webtricks administrators do.
• Routine server backups may hold copies for a limited time until they are overwritten.
• Expired login sessions and old security counters are cleared automatically.

8. Data portability

You can download everything stored in your account as a JSON file from My profile → Download my data, and export your leads as a CSV file from the Leads page.

9. Requests from authorities

We disclose data to a government body only when Indian law requires it and only what is legally required. We review each request and, where allowed, inform the affected user.

10. Breach response

If a security incident affects personal data, we will contain it, investigate, and notify affected users and authorities as required by applicable law, including the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023.

11. Reservation of rights and changes to this policy

Webtricks Software Pvt. Ltd. reserves all rights in respect of the Service, your use of it and this Data Policy, including the right to update it and the Privacy Policy. Whenever either policy changes, we will inform you — by a notice in your account and/or by email — update the “Last updated” date and record the change in the change history on the policy page, where earlier versions stay available to read.

12. Contact

Questions about this policy or your data: [email protected] · www.webtrickssoftware.com