Privacy policy

Who is responsible

Hello Marketing, Vadodara, Gujarat, India, is the data controller for information about account holders and visitors to this website. For the information that card owners collect through their own cards, such as leads, the card owner is the controller and we are their processor (see our Data Processing Addendum).

What we collect

• Account information: your email address, name and password. Passwords are stored only as a secure hash by our authentication provider.
• Card content: what you put on your cards, such as name, job title, company, bio, contact details, links, images, logos, translations, audiences and availability. Cards you publish are public to anyone with the link.
• Leads: details that visitors submit through the lead form on a card (name, email, phone, message). These go to the card owner.
• Usage events: when a card is viewed, a link is tapped, a contact is saved or a card is shared, we record the event against the card with a coarse device type, referrer and country. We do not build profiles of individual visitors or follow them across sites.
• Messages and requests you send us through the contact form, including privacy and grievance requests.
• Billing information when paid plans are on: handled by our payment partner. We do not store full card numbers.
• Technical data needed to run the service, such as IP address in server logs, which we use for security and abuse prevention.

Why we use it, and our legal basis

• To provide the service you asked for (contract): create and show your cards, send you account emails, give you analytics and lead export.
• To keep the service safe (legitimate interests): prevent abuse, spam and fraud, fix errors, and enforce our terms.
• To improve the product (legitimate interests): understand overall usage in aggregate.
• To meet legal duties: tax, accounting and responding to lawful requests.
• With your consent, where we ask for it: for example optional email updates.

What we do not do

We do not sell personal information. We do not use advertising trackers or cross-site tracking on cards or on our site. We do not email the people who view your cards or the leads they submit; the choice to contact a lead is the card owner's. We do not use your card content to train AI models.

Who processes data for us

We use these providers to run the service, each acting on our instructions under their own security and privacy commitments:

• Supabase: authentication, database and file storage. Our database is hosted in Mumbai, India (AWS ap-south-1).
• Vercel: website hosting and delivery through a global network, including servers in the United States.
• Payment, email and support providers that we add will be listed in our Data Processing Addendum before they handle your data.

Because of these providers, your information may be processed in countries other than where you live, including India and the United States. Where the law requires safeguards for such transfers, we rely on appropriate contractual protections.

Public cards and search engines

A published card is public by design. Anyone with the link, and search engines unless you turn indexing off, can see it. Only put on a card what you are comfortable sharing publicly. Cards also appear in our public directory only if you opt in.

How long we keep data

We keep your account and cards while your account is open. When you delete a card, its content, links and associated leads and events are deleted. When you delete your account we delete your personal data, except where the law requires us to keep records (for example tax records, kept for the period the law requires) or to resolve a dispute. Backups are overwritten on their normal cycle.

Security

We protect data with encryption in transit, access controls on every table in our database, and limits on who on our team can see what. No system is perfectly secure; if a breach affects your personal data we will tell you and the relevant authority as the law requires. More on our Security page.

Your rights

Depending on where you live, you have rights over your personal information, including to access it, correct it, delete it, export it, object to or restrict some uses, withdraw consent, and complain to a regulator. This includes rights under India's Digital Personal Data Protection Act, 2023, the EU and UK GDPR, and laws such as the California CCPA.

You can edit or delete your cards and export your leads yourself in the dashboard. For anything else, contact us with the topic “Legal, privacy or grievance” and we will respond within 30 days, or sooner where the law requires. We will not discriminate against you for using your rights.

Children

The service is not for anyone under 18, and we do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.

Cookies

We use only the few cookies needed to keep you signed in, remember your language and protect your account. See the Cookie Policy.

Complaints

If you are not happy with how we handled your information, contact our Grievance Officer, Ajay Mulchandani, as described on the Grievance page. You also have the right to complain to your data protection authority.

Changes

If we change this policy in a way that matters, we will update the date above and, where appropriate, tell account holders by email or in the dashboard.