Privacy Policy

1. Information we collect

From members

• Account details: email address, password (stored only as a secure hash by our authentication provider), name, business name, plan and role.
• Card content: what you put on your cards, such as your name, photo, job title, phone, email, address, links, logos, files and testimonials.
• Billing details: plan, amounts, dates and payment status. Card numbers are handled by the payment processor; we do not store full card numbers.
• Consent records: which version of our Terms and Privacy Policy you agreed to, and when.
• Support and messages: what you send us when you email us or ask for help.
• Agency data: if an agency manages your account, the agency gives us your name, email and business details to set it up.

From card visitors (on behalf of card owners)

• Whatever you choose to submit on a card: name, phone number, email, notes or message, company and other form answers, survey answers, booking requests (the day and time you asked for), the event you met the owner at, and a selfie if you take one in DigiSnap and agree to share it.
• If you use "share back", the contact file or link you choose to send the card owner.

Collected automatically

• Card analytics: when a card is viewed or a tile is tapped we record the card, the tile, the type of action, the time, the type of device (phone, tablet or computer, worked out from the browser's user agent), the country (supplied by our hosting network) and the referring website. We do not use cookies or advertising IDs for this and we do not build profiles of visitors across cards or sites.
• Security data: your IP address is used briefly to limit abuse (for example too many form submissions) and to protect the Service. It is not stored with analytics.
• Browser storage: a small amount of information is kept in your browser so you stay signed in and your preferences are remembered. See our Cookie Policy.

2. How we use members' information

• To create and run your account, publish your cards and show you your leads and analytics.
• To sign you in and send sign-in, confirmation and password-reset emails.
• To take payment, send receipts and manage renewals.
• To answer support requests and send important service notices.
• To keep the Service secure, prevent fraud and abuse, and enforce our Terms.
• To fix problems and improve the Service, using information that is aggregated where we can.
• To send product news, but only where the law allows, and you can opt out at any time using the link in the email.
• To comply with the law and respond to lawful requests.

3. Card visitors: how your information is used

When you submit your details on a card, they go to the card owner named on that card. The card owner can see them in their MyDigiCards Leads list, export them, and use them to contact you. If the card owner's account is managed by an agency, the agency can see them too.

• We store and process your details only to provide the Service to the card owner. We do not use them for our own marketing, we do not sell them, and we do not share them with other card owners.
• The card owner is responsible for how they use your details, including any calls, texts or emails they send you. Please contact them directly to ask what they hold or to stop hearing from them.
• If you can't reach the card owner, email us at legal@mydigicards.io with the card link, and we will pass your request on or help directly.

4. When we share information

• Service providers (subprocessors) who host, store, deliver email or take payments for us, under contracts that limit their use of the data. They are listed below.
• Agencies that manage a member's account (they can see that account's cards and leads).
• The law: when we must, to comply with a law, court order or lawful request, or to protect the rights, safety and property of people or the Service.
• Business changes: if our business or this product is merged, sold or reorganised, personal information may move to the new owner under this policy.

We do not sell personal information or "share" it for cross-context behavioural advertising, as those terms are defined by California law.

5. Subprocessors

These companies process personal information for us:

We will update this list before we add a new subprocessor that handles card visitor data. Card owners who want notice of changes can ask at legal@mydigicards.io.

6. How long we keep information

• Account and card data: for as long as your account is open. After an account is closed, we keep it for 30 days so you can ask for an export or change your mind, then delete it.
• Leads (card visitor data): until the card owner deletes them, deletes the card, or their account is deleted.
• Card analytics: for as long as the card exists, so owners can see their history. Deleted with the card or account.
• Billing records: as long as tax and accounting law requires (usually up to 7 years).
• Consent records: with your account, and afterwards only as long as we need to show that consent was given.
• Backups: deleted data can remain in encrypted backups until they are overwritten, normally within 30 days.
• Security data (such as IP addresses used for rate limiting) is kept only for minutes to hours.

7. Your choices and rights

• Access and export: members can see their cards and leads in the app and download leads as a CSV file at any time. For a full copy of your account data, email us.
• Correction: edit your cards in the builder, or email us to correct account details.
• Deletion: email us at legal@mydigicards.io from your account email to delete your account. We confirm within 10 days and complete the request within 30 days. Self-service delete and export in Settings are coming.
• Marketing emails: use the unsubscribe link in any marketing email. Account and security emails cannot be turned off while you have an account.
• Card visitors: contact the card owner first (see section 3). We will help if you can't reach them.

We will not treat you differently for using your privacy rights. We may need to confirm your identity before acting on a request.

8. California and other US state privacy rights

If you live in California, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA") gives you these rights. Residents of other states with similar laws (such as Virginia, Colorado, Connecticut, Utah, Texas and Oregon) have similar rights, and we honour them the same way.

Your rights

• Right to know what personal information we collected about you, where it came from, why, and who we disclosed it to, and to get a copy.
• Right to delete personal information we collected from you, with some legal exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing. We do not sell or share personal information, so there is nothing to opt out of. We do not knowingly sell or share the personal information of anyone under 16.
• Right to limit use of sensitive personal information. The only sensitive information we hold about members is account login details, used only to sign you in, so this right does not apply.
• Right not to be discriminated against for using these rights.

Categories in the last 12 months

Sources: you, the agency that manages your account, card visitors (for the card owner), and your device. Purposes: the purposes in sections 2 and 3. Retention: see section 6.

How to make a request

Email legal@mydigicards.io with "Privacy request" and what you would like us to do. We will confirm receipt within 10 business days and respond within 45 days (we may extend once by 45 days and tell you why). We verify requests by matching the email address on the account or, for card visitors, details you gave on the card. You may use an authorised agent, who must show us your signed permission. If we deny a request you can appeal by replying to our answer.

For information that card visitors gave to a card owner, we act as the card owner's service provider: we will pass your request to them and help them answer it.

"Shine the Light": we do not disclose personal information to third parties for their own direct marketing.

9. Children and members under 18

Draft for counsel review: this section describes how the Service treats members under 18 today. It is not final and is being reviewed by our lawyers.

• Age: we rely on the date of birth members give us when they sign up.
• Under 13: people under 13 may not create an account. Sign-up asks for a date of birth and refuses anyone under 13; nothing is stored for them. Card owners must not use their cards to collect information from children under 13. If you believe a child under 13 has given us information, email legal@mydigicards.io and we will delete it.
• 13 to 17: a member aged 13 to 17 needs a parent or legal guardian's consent. We email the parent or guardian a private approval link (it is never shown to the member). Until they approve, the member's cards cannot go online. The parent or guardian's email cannot be the member's own. If the member names a different parent or guardian later, the earlier approval ends and the cards go offline until the new parent or guardian approves.
• Safety settings until 18: a minor's card is not listed in our directory or offered to search engines; phone numbers and personal email addresses are hidden from the public card (only a contact email the parent or guardian approves, or a verified school email, can show); visitors are never asked for a phone number or a photo on a minor's card; and in-person photo capture (DigiSnap) is off. These settings lift automatically once the member turns 18.
• Recruiting listing (16 and older): a parent or guardian may allow a minor's card to be listed in our recruiting search by sport, position, graduation year and state. The member chooses whether to list a card. Members are responsible for following the recruiting rules that apply to them and their school.
• Withdrawing consent: a parent or guardian can change their choices or withdraw consent at any time with the same link; the member's cards go offline straight away.

What we keep: for a member under 18 we keep the birth year and month (not the full date of birth), the consent status, and a consent record: a one-way fingerprint (hash) of the parent or guardian's email address, the date and time of their decision, a one-way fingerprint of their internet address and the version of the consent text they saw (currently 2026-11-01-draft). MyDigiCards uses the parent or guardian's email address only to send the consent email and keeps only the fingerprint and a masked form (for example j•••@e•••.com). A parent or guardian may ask to review or delete their teen's information at legal@mydigicards.io.

10. Security

We protect information with encrypted connections (HTTPS), database rules that keep each account's data separate, hashed passwords, limited staff access and abuse limits on public forms. No system is completely secure, so please use a strong, unique password. If we learn of a breach that affects your personal information, we will tell you as the law requires.

11. Where information is stored

MyDigiCards is run from the United States and our database is in the United States. If you use the Service from another country, your information is transferred to and processed in the United States.

12. Changes to this policy

We will post any changes here with a new "Last updated" date. If a change is material we will email account owners before it takes effect.

13. Contact us

Premier Marketing Group International Inc., Vantage Technologies division, 9145 N Narcoossee Road, Suite 106-193, Orlando, Florida 32827, USA
Email: legal@mydigicards.io