Data controller and contact details

The data controller is Khurram Bashir, a sole trader, VAT number 13922860963, based in 20013 Magenta, province of Milan, Italy. No data protection officer (DPO) has been appointed. This notice is being updated: international transfer details and operational retention procedures still need to be completed. For support and requests about your data, email info@yourcardshub.com.

Intended users and minors

YourCards is primarily intended for users in Italy and Europe and is restricted to people aged 18 and over. The service is not currently intended for minors. Any future availability to minors will be addressed in a subsequent update to the service and this notice.

Account data

To register, we process your name, email address and password, which is stored using hashing. We also handle account identifiers, creation and update dates, email verification and password setup dates. If you use an available social sign-in option, we receive the name, email and provider identifier needed to authenticate you and link your account. Required registration data is necessary to create and use your archive.

Cards, photos and usage

We store cards you enter or import: merchant or type, number, barcode or QR format, alias, notes and any front/back photos you choose to upload. We record how often and when a card was last used in the app to help sort it; this is not a purchase history from merchants. Photos, aliases and notes are optional: avoid adding sensitive information or unnecessary data about other people.

Purposes and legal bases

Account and card data provide the features you request: authentication, storage, synchronization, display, import, export and sharing. Providing the service is based on performing our agreement with you. We also process technical data, including IP addresses for request limits, for security and abuse prevention; the interest pursued is protecting the service and accounts. To complete: the controller must establish the legal basis for using the email addresses of recipients who are not registered.

Sharing and invitation recipients

When sharing a card, you provide the recipient’s email address, including when they have no account. We store that address, a reference to the sender, a copy of the selected card data and invitation validity and acceptance details. The invitation email contains the sender’s name and card names. Anyone holding the link can preview the recipient’s email and card names; importing requires signing in with the recipient’s email. Card number, format, alias and notes are copied, but photos are not. Accepted copies remain in the recipient’s archive even if the sender deletes their own cards.

Email and social sign-in

Service emails include address verification, password recovery, security notifications and sharing invitations. We use Brevo for email delivery and Google Login and Apple Login for social sign-in. You can manage social connections from your profile. The application has no newsletter, purchase or subscription features.

On-device data and offline use

Your browser or app stores the session, profile data, preferences and a copy of cards locally for offline use. Signing out removes the session and profile, but does not automatically delete the card cache. You can remove local data using browser or operating system controls. Preferences and the cache have no automatic expiry. Moving from an invitation to sign-in also uses temporary browser tab storage. Device backups, when enabled by the operating system, may include local app data.

Camera, biometrics and widgets

The camera or a selected photo can be used to read a card code locally. If you choose to save a front/back photo, it is uploaded to the server. Optional biometric unlocking is handled by the operating system: YourCards receives the authentication result without collecting fingerprints or face templates. Widgets store card identifiers, names or aliases and logos on the device, without card numbers, notes or sign-in credentials; names may be visible on the Home screen.

Cookies and local storage

YourCards uses essential technologies for sign-in, preferences and offline use. Google Analytics is not active and its measurement tools are not loaded. The application has no advertising cookies. For details about these technologies and how to remove local data, see the cookie policy.

Providers, access and transfers

The service is hosted on DigitalOcean in the FRA1 region. We use Brevo for email. Social sign-in providers process data needed for their respective features. Authorized administrators can access data through service management tools. We do not use your data for marketing, sell it or share it with parties other than technical providers and recipients chosen by users. To complete: processing by other providers, provider roles and agreements, any transfers outside the European Economic Area and the relevant safeguards. We cannot yet state that all data remains within the European Union.

Account, card and invitation retention

The archive retains data needed to keep accounts and cards available; inactive accounts are not automatically deleted. Invitations are valid for 7 days, but expiry does not automatically delete invitation data or the associated card snapshot. Deleting the original card does not remove these copies either. The retention policy set by the controller provides for deletion of accounts and their cards after one year of inactivity, invitation data after one year from expiry and support emails after one year from closing the request. Application logs and application backups follow the shorter rotation schedules described below; additional manual copies are retained for 3 months from creation. Automatic cleanup of accounts and invitations has not yet been implemented: the operational procedure for applying these deadlines still needs to be completed.

Logs and backups

The available configuration specifies 14 days for daily application logs, unless the server uses different settings. The application database and file backup rotation provides copies for the previous two days, four completed weeks and two previous calendar months, always retaining the newest backup. If backups stop, that last copy may remain longer: this is not an absolute 60-day limit. Additional backups are created manually and stored on the same DigitalOcean server in the FRA1 region for 3 months from creation. To clarify: the deletion procedure for these manual copies, actual application backup settings and retention of other logs.

Security

The application includes password hashing, email verification, card access checks, request limits and upload validation. Photos and application backups are assigned private server storage. The production configuration specifies HTTPS connections. These measures do not constitute end-to-end encryption of the archive.

Managing your data and your rights

You can edit your profile, export cards as CSV and delete individual cards and photos. To request account deletion, email info@yourcardshub.com. The controller personally handles requests received by email; there is currently no self-service account deletion control in the app. You may also request access, correction, deletion, restriction, objection and portability where applicable, and withdraw consent without affecting earlier processing. You may complain to the competent supervisory authority, including the Italian Garante per la protezione dei dati personali. These rights are described in Regulation (EU) 2016/679.

Updates

Last updated: 1 October 2026. This version describes the features identified in the project; information marked as missing or awaiting confirmation must be completed by the controller.