Privacy policy
Last updated:
Courtesy translation. In case of discrepancy, the Spanish version prevails.
In short: we use your data to give you the account and the modules you ask for, to charge for what you subscribe to and to comply with the law. We do not sell data or use it for advertising. It is stored on servers in the European Union. You can ask us at any time to see it, correct it, take it with you or delete it.
1. Data controller
2. What data we process
- Account data: name, email and password (the identity service stores it encrypted; we never see it). If you sign in with Google, the name and email Google provides to us. If your accountancy firm or the platform administrator signs you up, you sign in with the email and password they give you (your own email or one they create for you); you can change the password yourself under «My account».
- Your card data: whatever you decide to publish (name, job title, company, phone, email, address, social media, photos, videos, services, promotions). A card is public by nature: anyone with its link or its QR code can see it.
- Module data: what you enter when using them (customers, quotes, invoices, expenses, products and sales, your team's time records, notes, virtual assistant conversations).
- Payment data: handled by Stripe. We only receive the subscription status and the billing details, never the full number of your bank card.
- Technical data: access and error logs, IP address, browser type and a count of visits per card, for the security and operation of the service.
- Visits to cards (by the people viewing them, not the owner): we count visits, buttons pressed (call, WhatsApp, save contact, share…) and QR scans, with the browser language and the approximate country. Without cookies and without storing the IP address or a browser fingerprint: to estimate unique visitors each day we keep a code that changes every day and that does not reveal who someone is or allow following them from one day to the next. The card owner only sees totals.
3. Purposes and legal basis
| Purpose | Legal basis (GDPR, art. 6) |
|---|---|
| Creating and maintaining your account, publishing your card and providing the modules you use | Performance of the contract (6.1.b) |
| Charging for paid plans and issuing invoices | Contract (6.1.b) and legal tax obligation (6.1.c) |
| Fraud prevention and account security | Legitimate interest in protecting accounts and the service (6.1.f) |
| Service notices (changes, invoices, incidents) | Performance of the contract (6.1.b) |
We do not make automated decisions with legal effects on you and we do not build profiles for commercial purposes.
4. When we process data on your behalf
When you use the modules with third-party data (your customers, your employees, people who write to you from your card or talk to your virtual assistant), you are the controller of that data, and aDIGITAL.cards acts as a processor (art. 28 GDPR): it processes it only to provide the service to you, following your instructions, confidentially and with security measures, without using it for its own purposes, and deletes it or returns it to you when the service ends. This processing agreement is part of the Terms of use. If your accountancy firm signs you up, the firm is the controller of the data it shares with you.
5. Who else processes it (processors)
| Provider | What for | Where |
|---|---|---|
| Amazon Web Services EMEA SARL | Servers, database, files and identity | EU (Ireland and Germany) |
| Stripe Payments Europe Ltd. | Charging for paid plans | EU / US* |
| Google Ireland Ltd. | Sign-in with Google (only if you choose it) and fonts | EU / US* |
| Meta Platforms Ireland Ltd. (WhatsApp) | If you turn it on, the assistant on WhatsApp | EU / US* |
| Anthropic, PBC | Artificial intelligence features (virtual assistant, reading cards and documents) | US* |
* Transfers outside the European Economic Area rely on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses. What is sent to the artificial intelligence is used only to answer your request, not to train models.
We may also disclose data to the tax authorities, to courts or to other authorities when a law requires it.
6. How long we keep it
- Account, card and module data: for as long as you have the account. If you delete it, it is removed within 30 days at most; backups are overwritten in their normal cycle.
- Invoices and payment data: the period required by tax and commercial law (up to 6 years).
- Technical and security logs: up to 12 months.
- Time records: the period that employment law requires of the user company (4 years), while it keeps the service or until it asks us to export them.
7. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to from your account email. We reply within one month at most. If you think we have not handled your request properly, you can complain to the Spanish Data Protection Agency.
8. Security
Data travels encrypted (HTTPS) and is stored encrypted at rest. The account is protected with a password and a session in an HttpOnly cookie; if your accountancy firm or the administrator changes the email or password of an account, its open sessions are closed immediately. Internal access to data is limited to what is strictly necessary to maintain the service.
9. Minors
aDIGITAL.cards is a service for professionals and businesses. It is not aimed at people under 18 and we do not accept their registration.
10. Cookies and changes
The cookies we use are explained in the Cookie policy. If we change this policy in a relevant way, we will let you know by email or in your account before the change applies.