Privacy Policy
What we collect, why, how we protect it and who we share it with, in plain words.
1. Overview
The Card Project ("we", "us") is run by [PLACEHOLDER: company / legal name], registration no. [PLACEHOLDER: SSM registration number], of [PLACEHOLDER: registered business address], Malaysia. We decide how the personal data described here is used, which makes us the data user under the Personal Data Protection Act 2010 ("PDPA").
We make NFC business cards with a printed QR code. Each card opens an online page with the owner's contact details, and owners manage that page from a dashboard. This policy covers our website, prihal.com, and everything you do on it.
It covers online activity only. Pages often link to other sites, such as WhatsApp, LinkedIn, Instagram or an owner's own website. Once you follow one of those links, that site's own privacy policy applies, not this one.
2. Consent
By creating an account, activating a card or publishing your page, you agree that we may use your personal data as this policy describes. You need an email address and a password to have an account. Everything else on your page is optional.
You can withdraw your consent at any time by asking us to delete your account (see "How to reach us"). We do not sell personal data, and we do not use it for advertising.
3. Information we collect
Your account
- Your name and email address.
- Your password. Our sign-in provider, Supabase Auth, stores it in hashed form. We never see or store it in plain text.
- The card ID printed on your card, when you activate it, and the card's status and design.
- Your membership plan and its expiry date.
Your page
Only what you choose to publish: name, photo, job title, company, bio, phone, WhatsApp, email, website, social links (LinkedIn, Instagram, Facebook, TikTok), address, birthday and notes, plus the look you pick for the page.
Your page is public. Anyone with its link (/u/your-link) can see it, and anyone who taps your card or scans its QR code is sent there. The "Save contact" button gives them a contact file with the same details, minus any links you have hidden. Copies saved to other people's phones are outside our control, so publish only what you are happy to hand out.
Your card
The NFC chip and the printed QR code hold only a link that contains the card ID. They store no personal data.
Visits to your page
- We count page views, card taps, QR scans, contact saves and clicks on your buttons (such as WhatsApp or Call), so you can see them in your dashboard.
- With each one we store only a rough device type (mobile, tablet or desktop) and the name of the site the visitor came from (for example, linkedin.com). We do not store visitors' names, IP addresses or full browser details.
- A visitor's IP address is held briefly in memory to stop the same device flooding the service, then discarded. It is never written to our database.
- Our hosting provider's web analytics (Vercel Web Analytics) count visits to our websites without cookies.
Bot protection
The sign-in, registration and password reset forms use hCaptcha to tell people from bots. hCaptcha processes information about your device and browser for this check, under its own privacy policy.
Ordering on Telegram
Cards are ordered through our Telegram account, Telegram (@TheCardProject). Messages there are also covered by Telegram's own policies. We use the delivery address you give us only to ship your card.
Cookies
We only use the cookies needed to keep you signed in. We use no advertising or tracking cookies.
How long we keep it
We keep your account and page while your account exists. If you ask us to delete your account, we remove your account, page and visit statistics within [PLACEHOLDER: number] days, and your card stops opening your page. Records the law requires us to keep, such as invoices, are kept for as long as the law says.
4. How we protect your data
- Every page and request uses an encrypted connection (HTTPS).
- Passwords are handled by Supabase Auth and stored only in hashed form.
- Our database is locked down with row-level security, so it can only be reached through our own server, never directly from a browser.
- You can only see and change your own account and page.
- Admin tools are open only to named members of our team.
- If your card is lost, you can lock it from your dashboard. A locked card shows nobody your page until you unlock it.
No system is completely secure, so use a strong password that you don't use anywhere else. If a data breach is likely to cause you significant harm, we will tell you and the Personal Data Protection Commissioner, as the PDPA requires.
6. Changes to the service
We keep improving The Card Project, and features may be added, changed or removed. If a change affects what personal data we collect or how we use it, we will update this policy first and change the date below. For significant changes, we will also tell you by email or in your dashboard before they take effect.
7. How to reach us
Under the PDPA you can ask us to:
- show you the personal data we hold about you;
- correct anything that is wrong or out of date;
- stop using your data and delete your account.
You can edit most of your page yourself in the dashboard. For anything else, contact our Data Protection Officer, [PLACEHOLDER: Data Protection Officer name]:
- Email: [PLACEHOLDER: contact email]
- Telegram: Telegram (@TheCardProject)
- Post: [PLACEHOLDER: company / legal name], [PLACEHOLDER: registered business address]
We may need to confirm it's you, and we reply within 21 days. If you are not happy with our answer, you can complain to the Personal Data Protection Commissioner of Malaysia (Jabatan Perlindungan Data Peribadi).
This policy is also available in Bahasa Malaysia at [PLACEHOLDER: link to Bahasa Malaysia version].
8. Last updated
This policy was last updated on [PLACEHOLDER: effective date].