Privacy notice

When somebody taps a card

We record that the tap happened, whether it came from a card or a QR code, the category of device (phone, tablet, computer), the operating system and browser family, and the website domain that referred the visit, if any.

We do not store the visitor's IP address. To count approximate unique visitors we keep a one-way hash of the IP address, user agent and a daily secret; it cannot be reversed to an address and it stops working as an identifier every 24 hours.

We do not collect precise location. A country or city appears only if a network provider passes one to us, and only when that feature is enabled.

A person tapping a card never needs an Idora account, and we do not create one for them.

Profile information

A profile holds what its owner chooses to publish: name, role, company, photo, and the contact details they switch on. Every field is optional and individually controlled.

A field that is switched off is not published and is not included when somebody saves the contact.

Uploaded photos are re-encoded on arrival, which removes camera metadata, including any location the camera recorded.

Account information

For people who sign in we hold a name, an email address and a password hash, plus the times of recent sign-ins and administrative actions taken in the platform.

How long we keep it

Tap records are kept for up to 400 days and then deleted.

Profile content is kept until its owner changes or erases it. Erasing a profile removes its content and photo immediately; the card object is kept so it can be reassigned rather than discarded.

Your rights

You can access, correct, export or erase your profile information at any time from the portal, or by contacting us.

If you believe we hold something we should not, tell us and we will look at it promptly.

Sharing

We do not sell personal data. We do not use tap records for advertising.

We use service providers for hosting; they process data on our instructions only.