Privacy policy

Abracarda displays a public page from an NFC card or a QR code. Four groups of people leave data there: the account holder who manages the page, the visitor who views it, the customer who sends a private message to the business, and the author of a review published on the page.

We resell no data, we display no advertising, and we use no advertising tracker and no third-party analytics cookie.

The data controller is ITHABIT (Entreprise individuelle), 17 rue Lefebvre, 68100 Mulhouse. Full contact details appear in the legal notice.

For data a visitor leaves with a business (a private message, a rating), that business is responsible for its use. Abracarda then acts only as a processor: we host the message and pass it on, and do nothing else with it. Reviews published on a page are the exception: see the section devoted to them.

On account creation: email address, name, and a password stored as an encrypted hash: never in plain text, and nobody here can read it.

Then, whatever the holder chooses to publish: page name, description, photo, logo, and depending on the modules enabled, phone, WhatsApp, email, address, social networks, Google review link. This information is public by nature: that is the very purpose of the product.

Each scan, view or click creates one statistics row for the page holder. It contains the event type, the button concerned, the country and the device type (mobile, tablet, desktop).

Neither the IP address nor the full user agent is stored. The IP address is used for the duration of the request only, solely to limit abusive submissions and verify the anti-robot check, then discarded without being written.

These statistics do not allow anyone to be identified, and no browsing profile is built from one visit to the next.

The private feedback form records the rating, the message and (if the person chooses to give them) their name, email and phone. These three fields are optional, and are kept only if the page holder has enabled the request for them.

This message is not published. It is visible only to the holder of the page concerned, in their dashboard, and may be forwarded to them by email if they have set that up. It exists to reply to the person, not to feed a mailing list.

When a professional has chosen to collect reviews on their page, the review form records the rating, the text if any, the display name chosen by the author (first name or nickname), the month of the experience they state, and the date. No email or phone number is requested.

This information is public: it appears on the professional's page as soon as it is sent. For this publication, Abracarda is the data controller. The legal basis is the author's consent: they publish voluntarily, after being told under the send button what will be made public. The publication and removal rules are set out on the Reviews published on Abracarda pages page.

The author of a review can have it removed at any time by writing to the address given in the “Your rights” section.

When you ask to be called back from our website, we record your name, your business if you give it, your phone or your email, your message and the language of the page. When a member of our team meets you, they may note the same business details, as well as how our exchanges are progressing.

This data is used only to contact you again about Abracarda. It is neither sold nor transferred, and is visible only to the team member handling your request, their manager and the operator. The legal basis is your request when you write to us, and our legitimate interest in presenting our service to professionals when we meet you.

It is deleted three years after our last exchange if you have not become a client. You can ask at any time not to be contacted any more: your record is then erased.

For a card order, we record the number of cards, the page they will open, the delivery address (name, address, country), the tracking number, the payment status and the invoice reference. The legal basis is the performance of the contract.

An order is kept for ten years, the retention period for accounting records (article L123-22 of the French Commercial Code), including after the account is deleted: it is then no longer linked to any account.

The application and the database are hosted in the European Union, in Frankfurt.

• Fly.io: application hosting, Frankfurt region
• Neon: PostgreSQL database, Frankfurt region
• Cloudflare: storage of published images, and Turnstile for the anti-robot check on public forms
• Resend: sending the service's emails (password reset, notification of a new message)
• Stripe: payment of the subscription and of cards ordered online, and invoicing. Receives the account holder's email, name and billing address, and the delivery address of a card ordered online. Card details are entered at Stripe: they never pass through our servers and we have no access to them. No visitor to a public page is concerned.

Fonts are served from our own servers: no request is made to a third party when a public page loads.

A public page sets no tracking cookie. Two strictly functional cookies exist: the one that keeps a signed-in holder's session, and the one that remembers the language chosen in the switcher. Neither is used to measure an audience or to profile anyone.

Turnstile, the anti-robot check, only activates when a form is opened (private message, review or call-back request), never on simply viewing a page.

The data of an account and its pages is kept for as long as the account exists. On deletion, the associated pages, statistics and messages are deleted with it.

A private message can be deleted at any time by the page holder, from their dashboard. A public review is kept for as long as the page exists, unless it is removed at its author's request or by a moderation decision.

Under European Regulation 2016/679 (GDPR) and the French “Informatique et Libertés” Act, you have rights of access, rectification, erasure, restriction, objection and portability over your data.

To exercise them, write to contact@abracarda.com. We reply within 30 days.

If your request concerns a message you left with a business, please say so: that message belongs to the business, and we will put them in touch with you.

If our answer does not satisfy you, you may lodge a complaint with the CNIL, the French supervisory authority: cnil.fr.