Privacy Policy

1. Who we are

Card by KEPPTIC is a digital business card service operated by KEPPTIC LLC, a New York limited liability company. “We”, “us” and “our” mean KEPPTIC LLC.

Address for legal notices and service of process: c/o Accumera LLC, 911 Central Ave., #101, Albany, NY 12206. Privacy contact: hello@kepptic.io.

2. What this policy covers

The marketing site (card.kepptic.io), the console where you manage cards (app.card.kepptic.io), our API (api.card.kepptic.io), published card pages and QR decks, and NFC cards we print and ship.

3. Our role

Workspace cards. When a company or team creates a workspace and puts its people’s cards in it, that company decides what goes on those cards. The company is the controller (business, in CPRA terms); we process on its instructions. Our Data Processing Agreement governs that relationship.

Personal cards. When you sign up on your own and make a card for yourself, we are the controller.

In both cases we are the controller for our own account, billing, security and abuse records.

4. What we collect

Account. Your email address, your name if you give one, and the identifier your identity provider returns if you sign in with Google or Microsoft. Sign-in links are stored hashed and expire after ten minutes. We do not store passwords; there are none.

Sessions. While you are signed in we keep a session record: the session’s own identifier, when it was created and when it expires, the IP address the session was created from, and the browser’s user-agent string. We use them to keep you signed in, to show you your active sessions, and to investigate suspicious sign-ins. This is separate from card visitors, whose IP address and user-agent we never store at all.

Card content. Everything you put on a card: first and last name, display name, job title, organisation name, email address, phone number, links, and any products or services you list, plus brand images you upload. A published card is readable by anyone who has its link. Cards are unlisted, not secret. See “Published cards” below.

Decks and keys. The card and deck links we mint for you, when they were created, and when they were revoked.

Directory sync (optional, workspace feature). If a workspace connects its Microsoft Entra directory, we read the following fields for the users in the groups it selects: object id, display name, given name, surname, job title, department, email, user principal name, mobile phone, business phones, company name, office location, and whether the account is enabled. We also record what each sync run changed, including field values before and after. We never receive or store directory passwords; access is by administrator-consented application permission, read-only.

Billing and hardware orders. Plan, seat counts, billing period, and the customer and subscription identifiers our payment processor issues. Card numbers never reach our systems: payment details are entered on our payment processor’s own hosted checkout. For an NFC card order we keep the shipping address that checkout collected, the name and title to be printed, what was ordered, and a tracking link once it ships.

Usage measurement. When someone opens a published card we record the event type (view, QR open, save, link click), the card, the workspace if there is one, the country, whether the device looks like a phone or a desktop, the network operator number, and a short one-way hash that lets us count returning visitors within a single day. The hash is salted with a value that lives only in memory and changes every day, so the same visitor is not linkable from one day to the next, and the hash cannot be turned back into an address. We do not store the IP address or the browser user-agent string of a card visitor. Automated crawlers are never counted. These events are summarised into daily per-card totals (views, unique visitors, saves, clicks) which the card owner can see and export.

Security and abuse records. Rate-limiting counters, which are keyed to the email address or the IP address being limited and expire on their own; an append-only record of administrative actions (who did what, to what, when); and flags raised by our abuse checks.

We do not run third-party analytics, advertising or tracking scripts on this site or on any published card.

5. Cookies

We set one cookie, and only once you sign in: a session cookie that keeps you signed in. It is first-party, it is not readable by scripts, it is sent only over HTTPS, and it is scoped to our own domain. We set no advertising, analytics or tracking cookies anywhere, including on published cards, so there is no consent banner and nothing to opt out of. Signing out clears it.

6. Published cards

A card page is served only to someone holding its link. We mark every card page as no-index and send no referrer, we block known search and AI crawlers from card pages, and we tell browsers not to store a copy. That keeps cards out of search results. It does not make a card private: anyone who has the link, the QR code or the physical NFC card can open it and download the contact file. Revoking a card or rotating its link stops the old link, the old QR code and the old NFC card from working, everywhere, at once. It cannot retrieve a copy someone already saved.

7. Why we use it, and on what basis

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are used in California law. We do not use your data to train machine-learning models.

8. Who we share it with

We use these service providers. Each is bound by a written agreement to process personal data only on our instructions.

When a workspace enables directory sync we call Microsoft Graph inside that workspace’s own Microsoft tenant, under permissions its administrator granted. Microsoft is that customer’s provider, not ours.

We may also disclose personal data to professional advisers, to an acquirer in a merger or sale of the business, or where the law requires it. We will not hand over data in response to an informal request.

9. Where your data is stored

Our database and the systems that serve cards run in the United States. If you are in the European Economic Area, the United Kingdom or Switzerland, using the service means your data is transferred to the United States. We rely on the European Commission’s Standard Contractual Clauses, with the UK International Data Transfer Addendum where relevant, for those transfers, and we have the same clauses in place with our providers.

10. How long we keep it

• Account records for as long as the account exists, and afterwards where we need them for security, tax or legal reasons.
• Cards and links until deleted. Revoking a card stops its links immediately; the record stays so the owner keeps their history, and we delete it on request.
• Administrative records are append-only and are kept for 24 months.
• Event-level usage data is kept by our measurement platform for a limited window (90 days). Only the daily aggregate totals are kept beyond that.
• Billing and order records for as long as tax and accounting law requires.

11. Deleting your account

Deleting your account from the console does all of this at once: every link to a personal card you own is revoked, those cards stop resolving, every session is signed out, and the account is closed so it can no longer sign in. We keep the underlying account record and the administrative log, because we need them to keep the audit trail honest and to stop a closed account being re-opened by someone else.

Cards that belong to a workspace are not touched: they belong to that company, and it removes them through its own console.

If you want full erasure rather than closure, email hello@kepptic.io and we will erase what we are not required to keep, and tell you what we kept and why.

12. Your rights

Wherever you are, you can ask us to give you a copy of your data, correct it, delete it, or export it, and you can object to processing we base on legitimate interests. In the EEA and the UK you can also restrict processing and complain to your data protection authority. Email hello@kepptic.io; we answer EEA and UK requests within 30 days and may need to confirm who you are first.

If you live in a US state with a comprehensive privacy law — including California, Colorado, Connecticut, Virginia, Texas, Oregon, Utah, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, Kentucky, Rhode Island, Indiana and Tennessee — you can ask us what we hold about you, ask for a copy, ask us to correct it or delete it, and you will never be treated differently for asking. We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use it for targeted advertising or profiling, so there is nothing for you to opt out of. You may use an authorised agent; we will ask them to show they act for you.

We answer within 45 days and will tell you if we need another 45 days. If we refuse a request, we will say why, and you can appeal by replying to our answer. We will decide an appeal within 45 days and tell you in writing; if we refuse the appeal, we will tell you how to complain to your state attorney general.

If your card lives in a company workspace, send the request to that company. Tell us and we will pass it on and help them answer it.

13. Children

The service is not for anyone under 16, and we do not knowingly collect their data. If you believe a child has an account, email us and we will remove it.

14. Security

Sign-in is passwordless. Session cookies are HTTP-only, sent over HTTPS only, and scoped to our own domain. Traffic is encrypted in transit; our database and object storage are encrypted at rest by the providers that run them. Sign-in attempts are rate-limited per address and per network. Every card page is no-index and blocked to crawlers. Every record carries the workspace or owner it belongs to, and every request for someone else’s data is checked against live membership before anything is returned. Administrative actions are written to an append-only log enforced by the database itself. Links published on a card are checked against a reputation service where enabled.

We are not SOC 2 certified. That is on our roadmap and this page will say so plainly the day it is true. SAML single sign-on and SCIM are not available yet.

No service is perfectly secure. If you find a vulnerability, email hello@kepptic.io; we will not pursue you for reporting it in good faith.

15. Changes

We will post any change here and move the date at the top. If a change materially affects you we will tell you by email or in the console before it takes effect.

16. Contact

KEPPTIC LLC — hello@kepptic.io. Address for legal notices and service of process: c/o Accumera LLC, 911 Central Ave., #101, Albany, NY 12206.

Related: Terms of Service · Data Processing Agreement · Trust & security