Privacy Policy

Effective 2026-08-25 · Last updated 2026-08-25

Draft — pending review. This is a starter privacy policy, not legal advice. Confirm it accurately describes your actual data processing before relying on it.

CardStack Ltd ("we", "us") operates CardStack. This policy explains what personal data we collect, why, and the rights you have over it under UK GDPR / the Data Protection Act 2018.

1. What we collect

Data	Why
Account: name, email, password (hashed)	To create and secure your account
Card content: photo, job title, company, socials	To build and display your digital business card
Contacts you add: name, company, email, phone, notes	So you can manage your own network and follow-ups — this is your data, about people you've met
Usage data: card views, saves, login activity	To show you analytics and keep the Service secure
Billing data (via Dodo Payments)	To process subscription payments — we don't store your card details ourselves

2. How we use it

To provide and improve the Service you've signed up for
To send account-related emails (sign-in links, password resets, follow-up reminders you've scheduled, weekly digests you've opted into)
To respond to support requests
To meet our legal and accounting obligations

3. Emails we send

Account and reminder emails are sent because you asked for them (signing in, resetting a password, a follow-up reminder you set, a digest you enabled in Settings) — you can turn optional reminders and digests off any time in Settings. If you use CardStack's follow-up sequences to message your own contacts, those messages include a one-click unsubscribe specific to that recipient, separate from your own account settings.

4. Sharing your data

We don't sell your data. We share it only with the service providers that make CardStack work — hosting, email delivery, and Dodo Payments for payments — under contracts that require them to protect it, and only to the extent needed to provide the Service.

5. Where your data is stored

Your data is stored on servers we control. If any processor stores data outside the UK/EEA, we ensure an appropriate legal safeguard (such as Standard Contractual Clauses) is in place.

6. How long we keep it

We keep your data while your account is active. If you request account deletion, we schedule permanent removal after a short grace period (shown in Settings), except where we must retain limited records for legal or accounting reasons (e.g. billing history).

7. Your rights

Under UK GDPR you have the right to:

Access the personal data we hold about you
Correct inaccurate data (most of this you can edit yourself in the app)
Request deletion ("right to be forgotten") — available directly in Settings
Export your data (contacts can be exported as CSV directly from My Stack)
Object to or restrict certain processing
Withdraw consent for optional communications at any time

To exercise any of these rights, email hello@cardstack.online.

8. Cookies

We use only the cookies necessary to keep you signed in and to remember basic preferences. We don't use third-party advertising or tracking cookies.

9. Changes to this policy

We'll update the "Last updated" date above whenever this policy changes materially.

10. Contact

CardStack Ltd, TODO: registered company address
hello@cardstack.online