What we hold, and why.

This notice explains what personal data Cardr uses, why, the legal basis for each use, how long it is kept, who else handles it, and the rights you have under UK data protection law.

Who is responsible for your data

Cardr is run by Cardr Technologies Ltd, a private limited company registered in England and Wales (company number 17518308), trading as Cardr, which is the controller of the personal data described here, except where this notice says otherwise.

Registered office and postal address: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Email: support@cardr.co

Write to that address about anything in this notice, including to use any of your rights.

If you have a Cardr

You give us most of this yourself when you make and use a card. Everything on your card except your private email address is published on your pass and your page, because that is what a card is for.

The App Store purchase record holds Apple's transaction identifiers, which plan you bought, whether it was a real or test purchase, when it was bought, when it runs to, any cancellation or refund date, and a random identifier the app creates for the purchase. Apple keeps your Apple ID and payment details; we never see them.

Google Wallet

While Cardr offers Google Wallet, if a cardholder opens the Wallet step, Card tab or pass page of their Cardr on an Android phone, or taps Add to Google Wallet anywhere, we send Google, through the Google Wallet API, the name, role, company, contact details, location, short bio and links on their card, their company registration line, the engraving number on engraved designs, their photo or company logo, its design image and colour, and its QR code, so that Google can hold their pass. Their private sign-in email address is not sent. A cardholder who does neither has nothing sent to Google Wallet.

Google receives these details as a controller in its own right, not as our processor. Google's terms for the Google Wallet API let Google use what we send to provide and improve its products and services, under Google's privacy policy. Once you save the pass, it is in your Google Wallet under Google's own terms and privacy policy, which also cover the settings Google Wallet gives you for your passes.

Google tells us when the pass is saved to a phone or removed from one, and the dashboard counts those saves and removals.

Removing the pass from your phone does not remove it from Google: Google keeps the details as we last sent them, and while your card exists we keep them up to date when you edit it. Google offers no way for us to delete a pass, so when a card is deleted we expire its Google pass and empty it of the details on it: its name, contact details, links, photo or logo, design image and QR code all go, and it shows only that the card was removed. Google may keep its own records of what it held, under its privacy policy.

We never sell personal data, never run advertising, and never use your data to train a machine-learning model.

If you shared your details with someone's Cardr

When you send your details from someone's card, that cardholder decides what to do with them and is the controller of their own contact list. We store and handle it for them, as their processor. We are also a controller ourselves for the narrow job of running and protecting the service.

We also read every visitor's IP address briefly, in memory, to apply rate limits. It is not written to disk, and it is discarded when the limit window passes.

To have your details removed from someone's list, ask them, or write to us and we will remove them.

If you are on a Cardr team

When you join a company's team on Cardr, the team's owner and admins can see your name, job title, profile photo, your card’s email address, the work details the team set for you, whether your card is on a phone's Wallet, and which company details you have chosen to replace with your own. They use this to run the team. Other members see your name, job title, photo, your card’s page and when you joined. No one on the team can see your contacts, your notes, who you met or your follow-ups, and nothing in Teams gives them a way to. Unless an admin switches it off, the owner and admins also see your counts since you joined (how often your card was opened, how many people you met and how many you followed up, how many you marked as replied, as an opportunity or as won, the total value you recorded, in each currency, and how quickly you follow up), and on an event where an admin turns on the follow-up board, every member sees the met and followed-up counts for each person; never who the people were. We share these with your team’s owner and admins on the basis of legitimate interests (yours and your company’s, in running the team), and they can switch the counts off. You see the same list before you accept an invitation.

When an admin names a team event (its dates, or one of the team's Cardr Metal packs), the people you meet there are labelled with the event's name in your own contacts. Your own note of where you met is never changed. The team sees how many people each event brought; the owner and admins also see what came of them, as counts and value totals, never who the people were. An admin can also set defaults for every card on the team: who you meet, the questions visitors are asked, the button and services on your page, whether client quotes may show, a note on how follow-ups should sound, and when reminders come. Where the team locks one, your page, drafts and reminders use the team's choice while you are on the team; what you set yourself is kept, and is used again when the lock or your membership ends.

To start a team's trial on time, and to extend it, Cardr counts how many times members' cards have been opened. Only the count is used, and it is not shown to the team as a figure for any one person.

If you sign up with a work address, Cardr may tell someone who already has a card on the same company domain how many colleagues are on Cardr. It gives a number only: never names or addresses, and never to anyone whose own address on that domain is unconfirmed. No one is added to a team without accepting.

When you leave or are removed, the company's details come off your card and pass. The team keeps a record that you were a member, for its own audit log, until the team is deleted.

AI-drafted follow-ups

A cardholder can ask Cardr to draft a follow-up message to someone they met. Pro includes drafts for 200 people a month, and a free card includes one. When a cardholder asks, we send Google's Gemini API what the draft needs:

• about the cardholder: their name, job title, company, bio and the writing style they set;
• about the contact: their name, email address, company, where they met, when and how they were added to Cardr, the message the contact sent, and the cardholder's notes and tags.

The draft comes back to the cardholder to edit and send themselves. Cardr never sends it for them.

Scheduling a follow-up for later

On Pro, a cardholder can schedule a follow-up for a time they choose. Cardr keeps the message they wrote, who it is for and how they mean to send it, and at that time emails the cardholder, and alerts their iPhone if the Cardr app is set up for alerts, with the message ready to send from their own email, WhatsApp or Messages. The iPhone alert shows the first line of the message, so that line passes through Apple’s Apple Push Notification service on its way to the phone. Cardr never sends anything to the person it is for. Nothing is sent to Google to schedule one.

Filing a note about someone you met

A cardholder can write, or say with their phone keyboard's microphone, a sentence about someone they met. The speech is turned into text by the phone; Cardr only ever receives the text, never audio. To file it into fields (name, company, where you met, what they need, what the cardholder said they would do, and when), we send that sentence, and nothing else, to Google's Gemini API. If Gemini is unavailable, simple rules on our own server do the same job. The cardholder checks the result before anything is saved. Cardr is instructed never to lift health, religion, politics, sexuality, ethnicity or similar details into a field, and the sentence is not used for anything but filing it.

Asking about your contacts

A cardholder can ask a question about their own contacts, such as “who needs a website this autumn?”. A free card answers three questions, and Pro has no monthly cap. Searching happens first, on our own server, and finds at most 20 of the cardholder’s contacts that match. We then send Google’s Gemini API the question and those matching records only: each person’s name, company, where they met, tags, follow-up date and the cardholder’s notes. Email addresses and phone numbers are not sent, and neither is the rest of the contact list. Every sentence of the answer has to quote the notes it came from, and our server checks each quote before the answer is shown. Searching without asking never leaves our server.

Google handles all three of these as our processor under the Gemini API terms. Because Cardr is based in the UK, Google applies its paid-service data terms to our use. In Google’s words (terms last modified 28 April 2026), it “doesn’t use your prompts … or responses to improve our products”, and it “logs prompts and responses for a limited period of time, solely for detecting and preventing violations of the Prohibited Use Policy” and for any required legal or regulatory disclosures. A cardholder who would rather no contact details left our servers can simply not use drafting or asking, and write notes in the Notes box instead of Remember. Everything else works without them.

The free follow-up message generator

Anyone can use the follow-up message generator without an account. To write its three drafts, we send what you type there (who you met, where, and what you talked about) to Google’s Gemini API, and show you what comes back. Google handles it as our processor, under the same Gemini API terms. Cardr does not store the text: it is not saved to our database, written to our logs or recorded in our analytics, and the form sends it in the body of the request, so it never appears in a web address. When the page gives our templates instead of AI drafts, it fills them in from your text on our own server.

To share the drafts fairly, we count how many sets each network has had that day, keyed on the network part of your IP address (the first three of its four numbers, or the first half of an IPv6 address, which is also counted, more loosely, by its first three groups). The count is held in memory only and holds none of your text. We also record that the tool was used, and whether it gave AI drafts or templates, with nothing about who used it.

Questions about Cardr Metal

You can ask a question about Cardr Metal, such as how long delivery takes. To answer it, we send Google’s Gemini API the question text, with anything that looks like an email address (written out as “at” and “dot” too), a phone number or an order reference taken out first, together with our own numbered list of facts. Nothing else about you or your order is sent. Gemini only picks which of our sentences answer the question: the answer you see is those sentences, word for word, about the packs, prices, delivery and the answers on our product page. When Gemini is unavailable, you see the answers from our product page that best match your question, chosen on our own server. Google handles the question as our processor, under the same Gemini API terms.

We keep each question, with the same details taken out, how it was answered, and the order reference when you ask from an order page, so we can see what people want to know and answer it better on our pages. If you choose to send a question to us, it goes to our support inbox with the email address you give, so we can reply, and we keep that address with the question until the ticket is closed, then delete it. Questions are deleted after 12 months. To share the answers fairly, we count questions per network each day, in memory only, the same way as the generator above.

The country you visit from

Cloudflare, which carries all traffic to our site, tells our server which country each visit comes from, worked out from your connection's IP address. We use the country to show prices in your currency, to tell you whether Cardr Metal delivers to you, and, outside the UK, to sell you Pro or Cardr Teams through Onelink (see who else handles your data). We never learn a place more precise than the country. We keep the country, as a two-letter code such as FR, only in these places:

We also count views of the Cardr Metal page by country, as one total for each country each day. The total is all we keep: no address, no identifier and nothing about you. If your browser sends the Global Privacy Control signal, your views are not counted.

When you ask, we send one email with a link to confirm it was you. Until you press it we send nothing more, and if you do not within 30 days, we delete your address. When Cardr Metal ships to your country, we send the one email to a confirmed address and then delete it at once, keeping only the country and the dates as a count. That record is deleted 30 days after the email, or 24 months after you asked, whichever comes first. To come off the list before then, reply to any email from us or write to support@cardr.co, and we will delete it.

If you ask us to email you a Cardr Metal design

On the Cardr Metal page you can ask us to email you the card you have designed, so you can come back to it later. You do not need a Cardr to do it.

We keep it for 90 days after you save it, and then delete it. If you unsubscribe, we delete your address and the design at once. The link in the email works only for that design, and nothing is stored in your browser.

If you review your Cardr Metal cards

Once your cards are posted, we ask you once how they are, with five stars in an email. A star opens a form; nothing is kept until you send it. Everyone is asked the same way, whatever they think of the cards, and nothing is offered for a review.

A review is kept until you ask us to delete it, or its order is deleted. Ask us, and we delete all of it. If we remove a review for abuse, someone else’s personal details or spam, we delete its title and words at once and keep only its stars, the reason and when, as our record of why it was taken down.

Google Customer Reviews

If we have switched on Google Customer Reviews, the page of a Cardr Metal order you have just paid for shows a link, “Rate your purchase with Google”. Nothing of Google runs on your order page itself. The link opens a separate page of ours that works for 48 hours after payment and holds only Google’s survey box. Loading it fetches Google’s script from apis.google.com, which, like any page from Google, gives Google your IP address and details of your browser and device. The box is framed from Google’s own site, and its address carries our Google merchant account number and your order’s reference. We also give the box your email address, the country the order is going to and its estimated delivery date. Google sends you the survey only if you agree in that box, and what you tell Google is between you and Google, under Google’s privacy policy. The page is never shown in the Cardr app, and it carries nothing that opens your order.

Cookies, browser storage and visit counting

Cookies

Cardr sets one cookie on your device: __Host-cardr_edit, which keeps you signed in. A session ends 30 days after you last use it, and never lasts more than a year. It used to be called cardr_edit; a browser still holding the old one has it replaced on its next visit. It is strictly necessary for the service, so it needs no consent.

Seven more cookies are never set for customers. Five are only for Cardr's owner, on Cardr's administration: __Host-cardr_admin keeps them signed in, for up to 14 days; cardr_admin_login lasts 15 minutes, while they sign in with an emailed code; cardr_admin_device lasts a year, so the browser they last signed in on can still be emailed a sign-in when someone else has asked too often; cardr_admin_hop lasts 30 seconds, so an administration link opened from their email reloads once and they stay signed in; and cardr_gsc_state lasts 10 minutes while the owner connects Google Search Console. The fulfilment portal, used only by the people who make and post Cardr Metal cards, sets two, only on its own pages: __Host-cardr_staff keeps them signed in, for up to 12 hours, and cardr_fulfil_hop lasts 30 seconds, so a portal link opened from their email reloads once and they stay signed in. All seven are strictly necessary for those people.

On the Cardr Metal pages that show Apple Pay or Google Pay, Stripe’s payment script sets __stripe_mid (one year) and __stripe_sid (30 minutes) to prevent card fraud. Stripe uses them as a controller in its own right, under Stripe’s privacy policy. They are needed to take a card payment safely, so they need no consent.

There is no advertising cookie and no tracking cookie. We do not use Google Analytics, Meta Pixel or anything like them.

Storage in your browser

Your browser keeps a few small settings for us. They never leave your device.

Counting visits

We use Cloudflare Web Analytics to count visits to our pages: which pages are read, which websites sent people here, the country and kind of device, and how quickly pages load. It sets no cookie and stores nothing on your device, and Cloudflare does not follow you across other websites. We see totals, never a record of you. Cloudflare provides it as our processor.

UK law lets a website count visits like this without asking first, to improve the site, as long as you can say no. Say no here, for this browser:

Stop counting my visits

If your browser sends the Global Privacy Control signal, we treat that as a no as well.

When you make a card, we keep the name of the website that sent you, or the campaign label in the link you followed, such as utm:linkedin/social. It travels in the page address, and for the rest of your visit in cardr_src above, which your browser forgets when you close the tab. We also keep the first page of ours you opened, such as /blog/…, so we know which of our pages are useful. We keep the channel it belongs to (for example “search” or “an AI assistant”), never the full address of the page that sent you. Turning visit counting off stops it too.

The iPhone app

Cardr's iPhone app keeps your card, the people you have kept and your notes about them on your iPhone, in the app's own storage. It sends them nowhere unless you ask it to: publishing your card puts your card online, and nothing else.

Drafts written on your iPhone

On an iPhone that can run Apple's on-device model, the app writes follow-up drafts on the device itself. Your note, the person's details and the draft are not sent to us, to Apple or to anyone else.

On an iPhone that cannot run that model, a Pro holder can choose, once, whether Cardr should write the draft instead. The app asks before the first such draft, and the choice can be changed at any time in the app's Help. Choosing “Write with Cardr” sends that contact's latest details and note to us first, so the draft is written from the current note, and then sends what our own drafting sends, described in AI-drafted follow-ups above, to Google’s Gemini API. Choosing “Use the template” keeps everything on the device: the app writes from a template that does not read your note, and it says so on the screen. Either way, nothing is drafted unless you ask for a draft.

Widgets and Spotlight

If you add a Cardr widget, the app writes a small file that the widget reads: your own card's code, and for the people waiting, a first name, a company and the date you met. It holds no notes, no email addresses and no phone numbers about them. It stays on your iPhone. If you let Spotlight find your people, that index is held by iOS on the device, and removing somebody removes them from it.

Counting how the app is used

The app can send us eight counts about how it is used, and nothing else. There are no names, no notes, no drafts and no contact details in them, and numbers are sent in ranges rather than exactly, so no count can describe one person. They are: finishing setup, adding the pass to Wallet, keeping somebody, sending a draft, using up the free ten, ending an event, and a paid-plan screen being shown or dismissed. They carry the app's own installation reference, which we store as a one-way hash, and the date they arrived rather than the time.

You can turn this off in the app, on the You tab, and turning it off clears anything waiting to be sent. We use it to see which parts of the app work, not to build a picture of you.

How long we keep things

Deleting your account removes your card and everything attached to it straight away: contacts, leads, scans, settings, your photo and your pass's device registrations. The billing records we must keep for tax are the one exception. Your pass stays in Wallet on your phone but stops updating, and your cardr.co page stops working. A Google Wallet pass is expired and emptied instead, as Google Wallet above describes. Rendered artwork of your pass in the server's image cache is cleared the next time that cache is swept. Our off-site backups follow within the times in the table above. Deletion is permanent.

If you bought Pro in the iPhone app, the subscription is between you and Apple: deleting your Cardr account does not stop Apple billing you, so cancel it in Settings on your iPhone as well.

Who else handles your data

Each works for us under a contract that limits what it may do with the data.

Two companies handle data as controllers in their own right, under their own privacy policies: Google, whose Gmail holds the messages you send to our support address, and which runs Google Customer Reviews (above) if you agree to its survey, and if you sign in with Google; Apple, if you sign in with Apple or buy Pro in the App Store; and Stripe, for the fraud checks its payment script makes on the Cardr Metal pages. For an App Store purchase, Apple holds your payment details and your Apple ID; Cardr receives only the purchase record described above.

Google is also a controller in its own right for Google Wallet passes: the details on a cardholder’s pass, which Google holds in the United States. Google’s terms for the Google Wallet API, not a processing contract with us, govern what it does with them.

Transfers outside the UK

Several of the companies above are in the United States. Where a company is certified under the UK Extension to the EU-US Data Privacy Framework, the transfer relies on the UK's adequacy regulations for it. Otherwise it relies on the UK International Data Transfer Addendum to the European Commission's Standard Contractual Clauses. Ask us for the safeguard behind any specific transfer.

Google Wallet passes go to Google LLC in the United States, which is certified under the UK Extension to the EU-US Data Privacy Framework, so that transfer relies on the UK’s adequacy regulations for the United States.

Your rights

Under UK data protection law you have the right to:

• Access the personal data we hold about you, and get a copy of it.
• Rectify anything inaccurate.
• Erase your data, where we have no overriding reason to keep it.
• Restrict or object to anything we do on the basis of legitimate interests. If you object, we stop unless we can show compelling grounds that override your interests.
• Portability: receive the data you gave us in a structured, machine-readable format.
• Withdraw consent at any time, where we relied on it.

Write to support@cardr.co and we will reply within one month. There is no charge. We may ask you to confirm it is you first, usually by writing from the email address on your card.

For a Google Wallet pass you can also go to Google: remove the pass in Google Wallet, and use the rights Google’s privacy policy describes for what Google holds.

To complain to us about how we handle your data, use the form on our help page or write to support@cardr.co. We acknowledge every complaint within 30 days, usually much sooner, tell you what we are doing about it, and tell you the outcome.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, or by calling 0303 123 1113. We would rather you came to us first so we can put it right.

If you live in the European Economic Area, the EU GDPR also applies, because we offer Cardr in the EU. You have the rights above under it too, and you may complain to the data protection authority in the country where you live or work, as well as to the ICO.

Security

Every page is served over HTTPS. Cardr has no passwords to leak: you sign in with a link sent to your email, which works for 7 days and is stored only as a one-way hash. Sessions are signed, sensitive routes are rate limited, and the token from Sign in with Apple is encrypted at rest.

If you find a security problem, email support@cardr.co and we will work with you on it. We will not take action against anyone who reports a genuine issue in good faith.

Children

Cardr is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe we have, tell us and we will delete it.

Changes to this notice

If we change how we use personal data in a way that matters to you, we will email active cardholders before the change takes effect, and update the date below.

Last updated: 15 October 2026. Previous version: 14 October 2026.