Privacy policy

Last updated:

Courtesy translation. In case of discrepancy, the Spanish version prevails.

1. Data controller

• Owner:
• Tax ID (NIF):
• Address:
• Registry details:
• Contact email:

2. What data we process

• Account data: name, email and password (the identity service stores it encrypted; we never see it). If you sign in with Google, the name and email Google provides to us. If your accountancy firm or the platform administrator signs you up, you sign in with the email and password they give you (your own email or one they create for you); you can change the password yourself under «My account». If the holder of an account invites you to their team, you sign in with your own email and your own password; the holder, and anyone they authorise to manage users, can see your name, your email and the permissions you have.
• Your card data: whatever you decide to publish (name, job title, company, phone, email, address, social media, photos, videos, services, promotions). A card is public by nature: anyone with its link or its QR code can see it.
• Module data: what you enter when using them (customers, quotes, invoices, expenses, products and sales, your team's time records, notes, virtual assistant conversations).
• Documents: the files you upload (PDFs, images, spreadsheets…) and their details: name, folder, tags, expiry date if you set one, a fingerprint of the content to check that it has not changed, and who uploaded it and when.
• Links to share a document: for each download we keep the date and the shortened IP address (without its last part), the last 50, so the owner knows whether it has been used and to stop abuse.
• Payment data: handled by Stripe. We only receive the subscription status and the billing details, never the full number of your bank card.
• Technical data: access and error logs, IP address, browser type and a count of visits per card, for the security and operation of the service.
• Team change log: if the account has a team, every time a person is added, their modules or permissions are changed, or they are removed from the team, we record who did it, to whom, what changed and when.
• Visits to cards (by the people viewing them, not the owner): we count visits, buttons pressed (call, WhatsApp, save contact, share…) and QR scans, with the browser language and the approximate country. Without cookies and without storing the IP address or a browser fingerprint: to estimate unique visitors each day we keep a code that changes every day and that does not reveal who someone is or allow following them from one day to the next. The card owner only sees totals.

3. Purposes and legal basis

We do not make automated decisions with legal effects on you and we do not build profiles for commercial purposes.

4. When we process data on your behalf

When you use the modules with third-party data (your customers, your employees, people who write to you from your card or talk to your virtual assistant), you are the controller of that data, and aDIGITAL.cards acts as a processor (art. 28 GDPR): it processes it only to provide the service to you, following your instructions, confidentially and with security measures, without using it for its own purposes, and deletes it or returns it to you when the service ends. This processing agreement is part of the Terms of use. If your accountancy firm signs you up, the firm is the controller of the data it shares with you.

4 bis. Accounts with a team (users and permissions)

The holder of an account can invite other people to their team and decide, module by module and option by option, what they can see and do: Manager (everything in their modules, plus managing users, but never giving more permissions than they have), Employee (view, use, create, edit and send; cannot delete, export, configure or manage users) or Custom (the permissions the holder ticks one by one).

The data in the modules still belongs to the holder: they are the controller of that data and decide who can access it, and the people in their team process it on the holder's behalf and following their instructions (Art. 29 GDPR). aDIGITAL.cards remains the processor (point 4). Each person can only see and change what their permission allows, and we check this on our servers, not just by hiding it on screen.

If the holder removes a person from the team, that person immediately loses access to the holder's data and their open sessions are closed. What they created in the modules stays in the holder's account. We keep their name, their email and their permission history in the holder's team log for the period in point 6; their own sign-in account is still theirs, and they can ask us to delete it.

5. Who else processes it (processors)

* Transfers outside the European Economic Area rely on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses. What is sent to the artificial intelligence is used only to answer your request, not to train models.

We may also disclose data to the tax authorities, to courts or to other authorities when a law requires it.

6. How long we keep it

• Account, card and module data: for as long as you have the account. If you delete it, it is removed within 30 days at most; backups are overwritten in their normal cycle.
• Documents you upload: while you have the account. If you delete it, they are kept for 30 days: we let you know when you close it and 7 days later, and during that time you can download them all as a ZIP from your account. After the 30 days they are deleted and can no longer be recovered.
• Invoices and payment data: the period required by tax and commercial law (up to 6 years).
• Technical and security logs: up to 12 months.
• Team change log, and the record of people the holder has removed from the team: for as long as the holder's account exists. When it is deleted, they are deleted with it within 30 days at most, unless they must be kept because of a claim or a request from an authority.
• Time records: the period that employment law requires of the user company (4 years), while it keeps the service or until it asks us to export them.
• Shared links and their download log: until they expire or are revoked, and 7 more days.

7. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to from your account email. We reply within one month at most. If you think we have not handled your request properly, you can complain to the Spanish Data Protection Agency.

8. Security

Data travels encrypted (HTTPS) and is stored encrypted at rest. The account is protected with a password and a session in an HttpOnly cookie; if your accountancy firm or the administrator changes the email or password of an account, its open sessions are closed immediately. The same happens when the holder removes a person from their team or takes away modules or permissions. Internal access to data is limited to what is strictly necessary to maintain the service.

9. Minors

aDIGITAL.cards is a service for professionals and businesses. It is not aimed at people under 18 and we do not accept their registration.

10. Cookies and changes

The cookies we use are explained in the Cookie policy. If we change this policy in a relevant way, we will let you know by email or in your account before the change applies.