Privacy Policy

Last updated: 7 November 2026

1. Introduction

This Privacy Policy explains how Cardition Ltd collects, uses, stores, protects, retains and, where relevant, shares personal data when you use Cardit. Cardit includes the mobile app, the webapp, the Cardit Web Clipper browser extension, card creation tools, saved cards, scanned cards, saved web cards, folders, collections, chat, sharing tools and related support services.

Cardit lets people and businesses create, save, organise, access and share digital cards. Cards may include contact details, images, text, websites, addresses, social links, ratings, comments, messages, loyalty or reward information, menus, posts, QR codes, NFC sharing, Sonic (audio) sharing or a BCN (Business Card Number).

2. Who we are

Cardit is operated by Cardition Ltd. In this policy, "we", "us" and "our" mean Cardition Ltd. We are the "controller" of the personal data described here, except where this policy says that you are (see section 5, scanned cards).

Cardition Ltd is registered in England and Wales under company number 09711058. Our registered office is 128 City Road, London, England, EC1V 2NX.

For privacy questions or to exercise your rights, contact us at support@cardition.com. We have not appointed a Data Protection Officer; privacy requests are handled by our compliance lead through this address.

3. Scope of this policy

This policy applies when you:

  • create an account or sign in to Cardit;
  • use the Cardit mobile app, webapp or Web Clipper;
  • create, edit, save, scan, organise, access, manage or share cards and related content;
  • use folders, collections, follow collections, group collections, scanned cards or saved web cards;
  • send or receive messages, comments, ratings, posts, notifications, menu orders, loyalty points or rewards through Cardit;
  • contact us for support, account help, privacy requests or service communications.

4. Personal data we collect

Depending on how you use Cardit, we collect the following.

Account and sign-in information: your name, email address, account identifier, sign-in method (email and password, Google or Apple sign-in), email verification status, and profile details you choose to add (for example phone numbers, company, job title, address, website and profile or company picture). Passwords are handled by Google Firebase Authentication and are not readable by us.

Card and profile content: everything you create, upload, save or share in Cardit, including names, job titles, business details, contact details, addresses, images, videos, websites, social links, notes, private call reports and importance ratings (visible only to you), ratings, comments, reviews, menus, posts, loyalty and reward data, folders and collections, and the privacy settings you choose for each card.

Photos, camera and microphone: the app asks for camera access to take photos or scan cards and codes, photo library access to choose images, and microphone access only while you use Audio Scan (Sonic sharing) to detect a Cardit signal. We do not record conversations. NFC is used only to write a card link to a tag you choose.

Location: with your permission, and only while the app is open, Cardit uses your device location when you ask for nearby cards, nearby places or travel discovery, or to fill a place card with where you are. Your exact coordinates are sent to our server to answer that request and are not stored by us. Where we ask an outside service for nearby places or photos, the coordinates are rounded to about 11 metres first. You can refuse or withdraw location permission in your device settings and still use the rest of Cardit.

Optional contact matching: when you choose Find People and give explicit consent, Cardit uploads phone numbers and email addresses from your device Contacts to our server solely to match them with existing Cardit accounts. The matching result is shown to you; these identifiers are not used for advertising or shared with other users or third parties for their own purposes. You may decline and continue using Cardit. Cardit also reads a contact from your address book only when you choose to save a card there.

Messages and communications: chat messages (one-to-one and group collection chats), comments, support requests, reports you make about content or users, and records of users you block. Chat messages are stored in Google Firebase Realtime Database.

Device, technical and usage information: device type and operating system, app version, push notification token, IP address and request logs on our servers, crash and diagnostic reports (Firebase Crashlytics), and records of activity such as which cards you view or share, used for the card owner's view statistics, abuse prevention and improving Cardit. If you tell us how you heard about Cardit when signing up, we keep that answer. We record your choice about marketing emails and the time you accepted our terms and privacy policy.

Payments: if you buy a paid feature (for example a custom BCN), payment is handled by Stripe. We receive confirmation and a reference for the purchase, not your full card number.

Third-party or imported content: information you choose to save from the web, scan from cards, import, or receive from another user. You are responsible for making sure you have the right to upload, store or share information about other people. Cards you save from the web are copied from public pages; we do not claim ownership of that content and it stays subject to its owners' rights.

5. Scanned business cards and other people's data

When you scan someone else's printed business card, you decide to record that person's details, so for that information you are the controller and Cardition Ltd acts as your service provider, storing it for you. You should only scan cards you were given or are entitled to keep, use them for the purpose they were given for, and delete them when you no longer need them. If you use Cardit for your business, you are responsible for telling the people you scan how you use their details where the law requires.

What we store for a scan: the text we read from the card (name, company, job title, email, phone, website, address, notes) and, if you keep it, the card photo. A scanned person's card is private to your account: it is attached only to you, is not searchable by other Cardit users, and is not merged with anyone else's copy of the same person. The text read on your device is sent to our server and to our AI provider, Groq, only to separate the name, company, job title and contact fields; the card image is not sent to the AI provider. We do not use scanned details to contact the person or to send invitations on your behalf unless you ask us to.

You can delete a scanned card at any time from the app. Deleting your account deletes all your scanned cards. If a scanned person asks us to remove their details, email support@cardition.com with enough information for us to find the card; we will remove it or ask the user who scanned it to do so.

6. How we use personal data and our legal bases

We use personal data only for the purposes below. The legal basis under UK GDPR and EU GDPR is shown for each.

  • Providing Cardit (accounts, cards, folders, sharing, chat, notifications, scanning, nearby discovery, loyalty and rewards, paid features) – performance of our contract with you.
  • Security, fraud and abuse prevention, moderation of reported content, crash reporting, fixing faults, card view statistics and improving Cardit – our legitimate interests in running a safe and reliable service. You may object (see section 15).
  • AI features (reading scanned cards, search help, summaries, rewriting notes, translation) – performance of our contract when you use the feature, because the text is processed only when you ask for it.
  • Contact matching and device location – your consent, given through the app's permission prompts. You can withdraw it at any time in your device settings.
  • Marketing emails – your consent. You can unsubscribe at any time.
  • Complying with law (for example responding to lawful requests, keeping records of reports and warnings, tax and accounting for purchases) – legal obligation.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects, and we do not use your personal data to train AI models.

7. Sharing of personal data

We do not sell personal data. We do not share personal data with third parties for their own advertising purposes, and Cardit does not track you across other companies' apps and websites.

Sharing initiated by you. When you share a card, contact details, a folder or a link, or message another user, the recipient may be able to view, store, copy or further share it, and a share link can be opened by anyone who has it until you turn it off. Group collections show their members' names and cards to the other members. Please share carefully.

Service providers (processors). They process data only on our instructions to run Cardit:

  • Google (Firebase): sign-in and password handling, chat storage (Realtime Database), push notifications (Cloud Messaging) and crash reports (Crashlytics).
  • DigitalOcean: hosting of our servers, database and uploaded files.
  • Groq: AI processing of text you submit to an AI feature (scanned card text, search questions, reviews or notes you ask it to summarise or rewrite, text to translate).
  • Stripe: payments for paid features.
  • Our email delivery provider: account, verification, password reset and service emails, and marketing emails if you opted in.
  • Apple and Google: app distribution, Apple and Google sign-in if you use them, and push delivery.

Public data services. To give you maps, places, travel and media information we send search terms, or rounded location coordinates, but not your name or account details, to public data services including OpenStreetMap (Nominatim and map tiles), OpenTripMap, GeoNames, Wikipedia and Wikimedia Commons, Wikidata, Open-Meteo and OpenWeather (weather and place lookup), TMDb (movies), Open Library and Google Books (books), Open Food Facts (products), TheMealDB (recipes) and internet radio directories. When you play a radio station or open a saved link, your device connects to that third party, which sees your IP address and may apply its own privacy policy. Map, place and encyclopaedic data come from OpenStreetMap contributors (© OpenStreetMap contributors, ODbL) and Wikimedia projects (Creative Commons licences) and are credited in the app.

Legal and protection purposes. We may disclose personal data where necessary to comply with the law, respond to lawful requests, protect our rights, users or others, or to detect, prevent or investigate fraud and security or technical issues.

Business changes. If Cardition Ltd is sold or merged, your data may transfer to the new owner, who must honour this policy.

8. Links, saved web content and platforms

If you use Google or Apple sign-in, open external links, or play embedded videos (for example YouTube or X), those providers process data under their own privacy policies. We do not control them.

9. Cookies and similar technologies

The webapp uses only cookies and similar storage that are needed to keep you signed in, protect your session, remember your preferences and make the service work. We do not use advertising or analytics cookies and do not run third-party analytics on the webapp. Because these are strictly necessary, we do not show a cookie consent banner. You can control cookies through your browser settings, but blocking all of them will prevent sign-in.

10. Data storage and security

Data is encrypted in transit (HTTPS/TLS). Access to our servers and databases is limited to authorised staff and protected by access controls and logging. Private card data is only returned to people who are entitled to see it under the card's privacy settings. No system can be guaranteed completely secure, so keep your own copies of anything important and tell us at once if you think your account has been misused. If a personal data breach puts your rights at risk we will notify you and the regulator as the law requires.

11. Data retention

We keep personal data only as long as needed for the purposes in this policy. In practice:

  • Account, cards, folders, messages, scanned cards, notes, view and activity records: kept while your account exists and deleted when you delete a card or your account (section 12). We do not currently delete activity records automatically before then.
  • Push notification token: kept until it is replaced or your account is deleted.
  • Server logs and crash reports: kept for a limited period for security and troubleshooting, then rotated or expired by the service provider.
  • Exact location: not stored by us (section 4).
  • Safety records: reports about content or users, and warnings issued to accounts, are kept so that we can show that reports were handled and to stop repeat abuse. They contain identifiers and the report text, not the reported card content.
  • Purchase records: kept for as long as tax and accounting law requires. Stripe keeps its own records.
  • Safety copies: when a card or account is deleted we keep a restricted, access-controlled copy for a limited period so a mistaken or malicious deletion can be reversed, then remove it. Routine backups of our systems also expire on their own cycle, so deleted data can remain in an unreadable backup for a short time and is not restored into live use without re-applying deletions.

12. Account deletion and data deletion

You can delete your account and data at any time. The fastest way is to open the Cardit app, go to Profile, then Account, and choose Delete Account and Data. If you cannot access the app, you can request deletion by email from the address linked to your account.

Read the account and data deletion instructions.

What is deleted: your profile and sign-in account; the cards, folders and collections you created; your saved and scanned cards and your private notes; your follows and followers; your contacts, links and sharing records; your comments, ratings, posts and loyalty points; your notifications, settings, marketing preferences and activity records; your uploaded pictures and files; your Firebase sign-in account; and your one-to-one chats. A shared card you saved from someone else is only removed from your account; it is deleted completely when nobody holds it any more.

What may remain: copies you already shared with other people or that they saved; content other users created about you (for example their own notes or chat messages that mention you); messages you posted in a group collection chat that other members may still see; safety records described in section 11 (including reports you made and blocks you set); purchase records we must keep by law; and the limited-time safety copies and backups in section 11. We remove or anonymise these when the reason for keeping them ends.

13. International transfers

Some of our providers (including Google, Groq, Stripe and public data services) are based in or process data in countries outside the UK and EEA, including the United States. Where we send personal data there we rely on an adequacy decision or the UK/EU data bridge where it applies, or on standard contractual clauses (with the UK Addendum where relevant) and similar safeguards. You can ask us for details of the safeguards at support@cardition.com.

14. Your rights

Under UK GDPR and EU GDPR you have the right to:

  • be told how your data is used (this policy);
  • access your personal data and get a copy of it. We provide a structured, machine-readable (JSON) export of your account, cards, folders, saved and scanned cards, relationships, notifications, activity records and private notes. Some data, such as other people's details in scanned cards you do not hold, chat messages and information about other people, may be excluded or limited to protect others;
  • correct inaccurate or incomplete data (most of it you can edit in the app);
  • delete your data (section 12);
  • restrict processing;
  • object to processing based on legitimate interests, and to direct marketing at any time;
  • receive your data in a portable format;
  • withdraw consent at any time, without affecting earlier use;
  • complain to a regulator. In the UK this is the Information Commissioner's Office (ico.org.uk); in the EU you may contact your local data protection authority. We would appreciate the chance to put things right first.

To exercise your rights, email support@cardition.com from your account email address. We may ask you to verify your identity. We acknowledge requests within two working days and respond within one month. California residents and others with similar local rights can use the same address; we do not sell or share personal information for cross-context advertising.

15. Children's data

Cardit is not intended for children under 13 (or the higher age required by local law), and we do not knowingly collect their personal data. If you believe a child has created an account, contact us and we will delete it.

16. Changes to this policy

We may update this Privacy Policy from time to time. We will change the date at the top and, where changes are material, tell you in the app, on the webapp or by email.

17. Contact

If you have questions about this Privacy Policy or wish to exercise your rights, contact us at support@cardition.com.

Cardition Ltd, 128 City Road, London, England, EC1V 2NX.