Privacy Policy

This policy explains what information Quick Card collects, why we collect it, and the choices you have. It covers business owners (vendors) who create an account, and customers who scan a QR code, view a business card, or save cards with a Google sign-in.

From business owners:

• Account details — name, email, password (stored hashed), or your Google account identity if you sign in with Google.
• Business details you add to your card — business name, category, phone, WhatsApp number, address and map location, social links, Google Place ID / review link.
• Payment records — plan, amount, and Razorpay transaction identifiers. We never see or store your card/UPI details; payment happens on Razorpay.

From customers:

• If you sign in with Google to save cards — your name and email from Google (nothing else).
• Anonymous usage events on public cards — QR scans, template selections, and redirects to Google. These power the vendor's analytics and are not tied to your identity.

For WhatsApp messaging (business owners and superadmin only):

• Contact phone numbers and names — either your registered account phone number, numbers you add manually, or numbers you upload via a CSV import for the purpose of sending WhatsApp messages through the Service.
• Message template content you create — category, text, header/footer, buttons, and any sample values you provide, which is submitted to Meta for approval.
• Delivery status for messages you send — sent, delivered, read, or failed, and Meta's message identifiers — received back from Meta's WhatsApp Business Platform.

• To operate the Service — serve your public business card, generate review drafts, and hand customers off to Google's review page.
• To show vendors analytics (scans, redirects, saved cards).
• To process payments and maintain purchase records.
• To communicate service messages — receipts, trial reminders, important changes.
• We do not sell personal data, and we do not use your data for third-party advertising.

Your digital business card is a public page: anyone with the link or QR can see the business details you chose to put on it. Do not add information to your card that you do not want public. Customer identities are never shown on public pages.

Review drafts are generated from your business details (name, category, rating chosen by the customer). Draft text is generated on demand and is not stored against the customer. The customer decides what, if anything, gets posted — posting happens on Google, under the customer's own Google account and Google's policies.

Quick Card lets business owners and our team send WhatsApp messages (order updates, offers, and business communications) using Meta's official WhatsApp Business Platform (the Cloud API). This section explains how WhatsApp-related data is handled, in addition to the general practices described above.

• What we send to Meta. To deliver a message, we send the recipient's phone number, the approved message template name, and any variable values you provide (e.g. a name or order number) to Meta's WhatsApp Business Platform. Meta processes this data as our data processor, under Meta's own Business Data Processing Terms and Privacy Policy.
• Message templates. Templates you create are submitted to Meta for review before they can be used. Meta stores and reviews the template content (category, text, media samples, buttons) as part of its approval process.
• Delivery & status data. Meta sends us delivery-status webhooks (sent, delivered, read, or failed) for each message, which we store against the relevant campaign so business owners can see whether a message reached its recipient. We do not receive the content of any reply a recipient sends back.
• Contact lists. Phone numbers used for WhatsApp messaging (whether from registered accounts or manually/CSV-imported) are stored only for the purpose of sending business communications through the Service, and are never sold or shared with anyone other than Meta, as needed to deliver the message.
• Your control. Business owners can delete a contact from their list at any time from the dashboard, which stops further messages to that number. If you are a recipient and want a number removed, contact the business that messaged you, or reach us directly using the contact details below.
• Retention. Contact numbers and campaign/delivery records are kept while the underlying account is active, and deleted on account deletion except where we must retain records by law.

• Google — sign-in (OAuth), Maps/geocoding for your card's location, and the review page customers are redirected to.
• Meta / WhatsApp — delivering WhatsApp messages and reviewing message templates, as described above.
• Razorpay — payment processing for paid plans and business cards.
• Infrastructure providers that host the Service (servers, databases). They process data on our instructions only.

We use browser local storage to keep you signed in (an authentication token) and essential cookies for the Service to function. We do not use third-party advertising or cross-site tracking cookies.

• Account and business data are kept while your account is active.
• You can edit your business details anytime from the dashboard.
• You can ask us to delete your account and associated personal data; we will remove it except records we must keep by law (e.g. tax/payment records).
• Anonymous analytics (scan counts) are not personal data and may be retained.

To exercise any of these rights, contact us from your dashboard after signing in.

Passwords are stored hashed, transport is encrypted (HTTPS), and access to production data is restricted. No system is perfectly secure — if we learn of a breach affecting your data, we will notify you as required by law.

We may update this policy as the Service evolves. Material changes will be posted here with a new “last updated” date.