Privacy Policy

Effective from November 5, 2026

This is a translation. The binding version is the Polish original.

In short

Cards, Companies and Scanned Cards are on your phone and – if you turn on iCloud sync or Google backup yourself – also in your Apple or Google account. We have no access to them and make no copies.
Your phone reads the text from the photos of business cards you scan – the photos and the details read from them never reach us.
There is no account, no ads, no analytics and no tracking. We don’t sell data.
We receive a Card’s data only when you add it to Apple Wallet or Google Wallet – we create the pass and store nothing.
For office Access Passes, our server stores the Company’s Pack, the Offices’ details and the Access Pass numbers – without names. The details of the person you issue an Access Pass to are encrypted in the link and in the Access Pass itself. Payments are handled by Apple or Google – we don’t see your card details.
A contact from an NFC sticker is contained in the link itself and never reaches our server.
The vizicard.app website does not use cookies.

This summary is here to make reading easier – the full text below is binding.

1. Controller

The controller of your personal data is N3O SYSTEM spółka z ograniczoną odpowiedzialnością, with its registered office at Podolszynka Plebańska 19A, 37-418 Krzeszów, Poland, entered in the register of entrepreneurs of the National Court Register (KRS) under no. 0001094015, kept by Sąd Rejonowy w Rzeszowie, XII Wydział Gospodarczy KRS, NIP (tax ID) 8652585870, REGON 528062819, share capital 5 000,00 zł (“we”).

For matters concerning personal data, write to systems@n3osystem.io or to our registered office. We have not appointed a data protection officer, as we are not required to.

This policy applies to the Vizicard app and the vizicard.app website, including the vizicard.app/k contact page and the vizicard.app/w Access Pass page. Capitalized terms have the meaning given to them in the Terms of Use.

2. Your data stays with you

The Cards, Companies, Scanned Cards and settings you create in the App are stored in your phone’s memory. We don’t send them to our server, we have no access to them and we make no copies. Likewise, the Access Pass register – to whom, for which Office and until when you issued them – is only in the App. There is no account. You delete them by deleting them in the App or by deleting the App.

If you turn on iCloud sync (iPhone) or Google backup (Android) yourself, a copy of this data also goes to your Apple or Google account (section 6). Separately, your iPhone may include the App’s data in a device backup in iCloud if you have turned that on. On Android, the App’s data goes into Google backup only if you turn it on in the App. These copies are kept by Apple or Google under their own terms – we have no access to them.

When you share a Card (or the contact from a Scanned Card) – with a QR code, via AirDrop, as a contact file (.vcf), as an image, on an NFC sticker or by holding an Android phone to another phone – the data goes directly to the recipient or onto the sticker. We don’t see what you send or to whom. A contact QR code holds the contact details in the code itself: a phone that scans it reads them without connecting to our server.

The App sends data to us only when you add a pass to Apple Wallet or Google Wallet, use Offices and Access Passes, or buy a Pack (sections 3 and 8).

3. What data we process, why and for how long

Apple Wallet and Google Wallet passes

Data: the data of the Card you add to Wallet: name, job title, company, phone, email, website, LinkedIn, address, tax and registration numbers (NIP, REGON, KRS), note, content of the QR code and design (colors, font, layout); for Apple Wallet also the photo or logo and the background photo. In addition, the Card’s random identifier (the pass number, which lets a re-added pass replace the previous one) and the App’s language.
Purpose: creating and signing the pass at your request and sending it back to the App.
Legal basis: performance of a contract (Article 6(1)(b) GDPR); we process Employees’ data on company Cards on behalf of the User who entered it (Article 28 GDPR, section 8 of the Terms of Use).
Retention: only in the server’s memory, for the time it takes to handle the request (usually a few seconds). We don’t store the Card’s data in a database, in files or in logs. A Google Wallet pass is then stored by Google, and an Apple Wallet pass by Apple on your phone (section 11).

Companies, Offices and Packs (for the Office Administrator)

Data: random identifiers of the Company and of the purchase (they link the Store purchase to the Company – without the Company’s name), the Pack: the number of people, the product, the Store and the date until which it is paid; the Apple transaction identifier or the Google Play purchase token; the Office’s name and address, the Company’s name and color (they appear on the Access Passes), a random identifier of the Office and the Company it belongs to; the dates on which the Company and the Office were created, changed and deleted. We don’t store the admin keys of the Company and the Office – the server derives them.
Purpose: running the Company and its Offices, creating and extending Access Passes and counting the people in the Pack, verifying the purchase of a Pack with Apple or Google, and tracking the renewals, changes, cancellations and refunds the Store notifies us of.
Legal basis: performance of a contract (Article 6(1)(b) GDPR); data needed to handle complaints and defend against claims – our legitimate interest (Article 6(1)(f) GDPR).
Retention: the Office’s data – until the Office is deleted, and the data of the Company and the Pack – until the Company is deleted in the App; after deletion, for a further 30 days (during that time, Wallet may still fetch the invalid Access Passes), then we delete it automatically.

Access Passes (Recipients’ data)

Data: the Recipient’s name and, if provided, their company and job title; in the database: the Access Pass’s number, the Office, a random person identifier (the identifier of the Employee’s Card or a new one for a guest – it says nothing about the person and is used only to count people in the Pack), the way it opens the door (QR code or NFC), the expiry date, whether and when it was revoked, the language and whether it was added to Google Wallet; when the Recipient adds it to Apple Wallet – the device identifier assigned by Wallet and the push notification token.
Purpose: issuing and delivering the Access Pass (the vizicard.app/w page, the Apple Wallet or Google Wallet pass), extending, changing and revoking it, the list of Access Passes for the reader at the door, and counting the people in the Company’s Pack.
Legal basis: we process it on behalf of the Office Administrator who issued the Access Pass and is the controller of this data (Article 28 GDPR, section 8 of the Terms of Use); they determine the legal basis – e.g. their legitimate interest in controlling access to the Office.
Retention: we don’t store the name, company or job title in the database: they are encrypted (AES-256-GCM) in the link, which works for 14 days, and in the Access Pass itself, and we read them only in the server’s memory when the Recipient opens the link or Wallet fetches a new version of the Access Pass. The Access Pass’s number and status – until the Office is deleted and for 30 days after that; the device registration – until the Access Pass is removed from Apple Wallet (no later than 30 days after the Office is deleted). The Access Pass is then stored by Google in Google Wallet, and by Apple on the Recipient’s phone in Apple Wallet (section 11).

Server logs (the vizicard.app website, pass and Access Pass requests)

Data: IP address, date and time, the address of the page or resource (without the part after “#” and without the Card’s content; for Access Passes – with the encrypted ticket from the link, which we don’t read in the logs), browser or device type and operating system, server response code.
Purpose: displaying the website and handling requests, security and protection against abuse, detecting errors. From the IP address we also determine the country you connect from, so that we can show you the vizicard.app website in your language right away – we don’t store the country.
Legal basis: our legitimate interest (Article 6(1)(f) GDPR).
Retention: the logs are kept by our hosting provider (Vercel), which deletes them automatically, after 30 days at the latest.

Contact, complaints and reports

Data: email address, name and any other details you include in your message.
Purpose: replying to your message and handling complaints, reports and requests concerning personal data.
Legal basis: legal obligation (Article 6(1)(c) GDPR) – for complaints and requests under the GDPR; in other matters – our legitimate interest, i.e. communicating with you (Article 6(1)(f) GDPR).
Retention: until the matter is resolved, and then until the limitation periods for claims expire.

4. The contact page for NFC stickers and phone-to-phone sharing (vizicard.app/k)

When you write your contact to an NFC sticker or card, the App writes to it a link to the vizicard.app/k page, with the contact details in the link itself, in the part after the “#” sign. The data is therefore stored on the sticker, not by us, and anyone who taps it with a phone can read it.

On Android, you can also hold your phone to another phone. While the “Hold to a phone” window is open in the App, your phone responds over NFC like a sticker and passes the same link directly to the phone that taps it – nothing is stored on a sticker or by us. When you close that window or leave the App, your phone stops sharing your contact.

Browsers never send the part of a link after “#” to the server. All we receive is the ordinary request for the page (the address vizicard.app/k without the contact details, the IP address, the browser type – as described in section 3). The contact is read and displayed only by the browser on the phone of the person who opened the link, and the “Save contact” button creates the contact file on that phone. The page does not use cookies or analytics tools and does not pass on the address the visit came from (referrer).

You can delete the data from a sticker by overwriting it or erasing its content (e.g. in the App or another NFC app).

5. Scanned Cards

In the App, you can scan another person’s paper business card – with the system document scanner or from a photo in your library – and save it in the App.

Read on your phone. The text is recognized by your phone: on iPhone by Apple’s built-in technology (Vision), on Android by Google ML Kit, provided through Google Play services. The photo and the text read from it are not sent to us or to Apple in the process; on Android – according to Google – they don’t reach Google’s servers either.
Technical information for Google (Android). When you use the scanner on Android, Google Play services may send Google technical information about how these features work – according to Google, this includes the phone model and operating system, the App’s name and version, processing times, image format and resolution, error codes and a device or installation identifier – and may download updates. Google uses this information to diagnose, maintain and improve these features and to detect abuse, as a separate controller, under the Google Privacy Policy. We don’t receive this information.
What the App stores. Once you have checked the details and saved the scan, the App keeps on your phone: the contact fields (name, job title, company, phone, email, website, LinkedIn, address, tax ID and other company numbers, note), a reduced photo of the card, all the text read from it and the date of the scan. With iCloud sync or Google backup on, these also go to your account (section 6).
Adding to contacts. “Add to contacts” opens the system’s new contact form with the details filled in; the system saves the contact on your phone when you confirm it. The App does not ask for access to your contacts and does not read them. The saved contact is then subject to your phone’s settings (e.g. syncing contacts with your account).
Data of the person on the card. A Scanned Card contains a third party’s personal data. It never reaches us, so we are neither its controller nor do we process it on your behalf. You decide about it: when you scan cards in the course of a purely personal or household activity, the GDPR does not apply (Article 2(2)(c) GDPR); when you do it as part of a business or profession, you are the controller of that data (section 9 of the Terms of Use). If someone has scanned your business card in Vizicard, please address questions about your data to that person – we don’t have it.
Deleting. You can delete a Scanned Card in the App at any time. With sync on, it also disappears from your other devices and from the file in iCloud, and later Google backups won’t include it. A contact added to your phone stays there – you can delete it in the Contacts app.

6. iCloud sync and Google backup

Both features are off by default – you turn them on yourself in the App’s Settings (the “Backup and sync” section). The data then goes to your own account, not to us: on iPhone the App saves it in your iCloud, and on Android the system includes it in your Google account’s backup. Apple and Google store it under your agreement with them and their own terms. It is your decision – we process nothing in the process, we have no access to this data, and Apple and Google are not acting on our behalf here.

iCloud sync (iPhone)

What: a single file with all your Cards, Companies and Scanned Cards (including their photos) and a list of deleted items – their identifiers and the time of deletion, so that the deletion reaches your other devices. Deletion entries older than 180 days are removed from the file.
Where: in the App’s hidden folder in your iCloud Drive. The App merges it with the data on your other iPhones and iPads where sync is on. The file uses your iCloud storage. It requires being signed in to iCloud and iCloud Drive turned on.
Turning off and deleting: turning sync off stops it but leaves the file in iCloud. To delete it, turn sync off on all your devices, then in your iPhone’s Settings tap your name, choose iCloud, go to managing your iCloud storage, choose Vizicard and delete its data from iCloud. The Cards saved in the App on your phone stay there.

Google backup (Android)

What: the App’s data – Cards, Companies, Scanned Cards (including their photos) and settings.
Where and when: in the Android backup in your Google account. The phone’s system makes the backup, usually once a day while the phone is charging and on Wi‑Fi, provided backup is turned on in Android settings. When you set up a new phone with the same Google account, the data comes back together with the App.
Turning off and deleting: once you turn backup off in the App, later Android backups no longer include the App’s data. You manage the backups stored in your Google account in your Android and Google account settings, under Google’s terms.

With both features off, the App saves nothing in iCloud, and the App’s data does not go into Google backup. A backup of your whole iPhone in iCloud works independently of the App (section 2).

7. Employees on company Cards

If your Card was created by your employer in their App, it is stored on their phone (and possibly in their iCloud or Google account, if they turned on sync or backup), and your employer is the controller of that data. We process it only when your employer adds your Card to Wallet – on their behalf and only for the time it takes to create the pass. Please address questions and requests concerning this data to your employer.

8. Office Access Passes (vizicard.app/w)

If someone has issued you an Access Pass to their Office, the controller of your data is that company or person (the Office Administrator). We process it on their behalf, only so that the Access Pass works (section 3). Please address questions and requests concerning your data to them – we will help them respond.

Link. Your name (and your company and job title, if provided) is encrypted in the link, in the part after the “#” sign, and only our server can read it. The vizicard.app/w page sends this part to our server in order to show which Office the Access Pass is for and until when it is valid. The link works for 14 days.
Apple Wallet. When you add the Access Pass, Wallet saves it on your phone and registers the device with our update service (the device identifier assigned by Wallet and the push notification token), so that the Access Pass is extended automatically and its revocation reaches you. In doing so, Wallet sends back the encrypted data from the Access Pass, from which we create its new version.
Google Wallet. When you add the Access Pass, we create it through the Google Wallet API – your name, the Office, the number and the validity are sent to Google and stored in your Google account, under Google’s terms.
At the door. The QR code or NFC – depending on what the Office Administrator chose – passes to the reader only the Access Pass’s number, the Office and the expiry date, with a signature – without your name. What the reader or the door system records is decided by the Office Administrator.
Deletion. You can remove the Access Pass in Apple Wallet or Google Wallet – Apple Wallet then unregisters the device. The Access Pass number stays with us until the Office is deleted and for a further 30 days.

The vizicard.app/w page does not use cookies or analytics tools and does not pass on the address the visit came from (referrer).

9. App permissions

Camera and photos – only when you add a photo, logo or background yourself or scan a business card. The App uses only the photo you take or choose (it crops or resizes it on the phone) and does not browse your library. On Android, the card scanner is a Google Play services screen that uses their own camera access.
NFC – only when you ask for it: to write your contact to a sticker or card (iPhone) or to pass it to the phone you hold yours to while the “Hold to a phone” window is open (Android).
Sharing (AirDrop, messages, email) works through your phone’s system – we don’t see who you send a Card to.
Contacts – the App does not ask for access to your contacts and does not read them. “Add to contacts” opens the system’s new contact form, where you save the contact yourself.
iCloud (iPhone) and Google backup (Android) – only when you turn them on in the App’s Settings (section 6).
Apple Wallet and Google Wallet – see section 3.
In-app purchases – only when you buy a Pack for a Company or restore purchases; payment is handled by the Store, and the App passes the proof of purchase on to us with the Company’s random identifier (section 3).
The App does not use your location or microphone, does not read your contacts, does not use the advertising identifier and does not track you across other apps or websites.

10. Cookies and analytics

The vizicard.app website does not use cookies or similar tracking technologies, does not load scripts or fonts from other companies and contains no analytics or advertising tools.

The App also contains no analytics, advertising or crash-reporting tools; Pack purchases are handled by the Store. On Android, Google Play services send Google technical information about how the business card scanner works (section 5) – this is Google’s mechanism, not ours, and we receive no data from it.

11. Who we share data with

We don’t sell data or share it with advertisers. We share it only with:

Providers that process data on our instructions

Vercel Inc. (USA) – hosting of the vizicard.app website and the servers of the Pass Service and the Access Pass Service (which run in a data center in Frankfurt am Main);
Cloudflare, Inc. (USA) – the database of the Access Pass Service (Cloudflare D1, stored in the European Union): Companies and their Packs, Offices, Access Pass numbers and Apple device registrations – without names.

Companies that process data as separate controllers, under their own terms

Apple – the App Store (including payments for Packs and information about their renewal, change or refund), Apple Wallet and the notification service through which we tell Apple Wallet about a change to an Access Pass (only the device token);
Google – Google Play (including payments for Packs: we verify the purchase with the Google Play Developer API and learn about renewals through Google Cloud Pub/Sub), Google Wallet (the content of a Google Wallet pass or Access Pass when you add it) and Google Play services (technical information about how the business card scanner works on Android – section 5).

iCloud sync and Google backup do not mean that data is passed to us or by us: you save the data in your own Apple or Google account, under your own agreement with these companies (section 6). Apple and Google are not our processors here – our only such providers are Vercel and Cloudflare.

Other people – as the Service works

people you share a Card or an Access Pass link with;
the Office Administrator – the number, validity and status of the Access Passes of their Company and Office; and the reader installer – the setup file, if the Office Administrator gives it to them;
public authorities – where required by law.

12. Transfers outside the EEA

Vercel and Cloudflare are based in the USA. The database of the Access Pass Service is stored in the European Union (EU jurisdiction in Cloudflare D1). The Pass Service and the Access Pass Service run in a data center in Frankfurt am Main, but requests and the vizicard.app website pass through Vercel’s global network, including outside the European Economic Area, and Vercel and Cloudflare may access data from the USA (e.g. when providing technical support). Transfers are based on the European Commission’s adequacy decision (EU-U.S. Data Privacy Framework) for companies that participate in it and, in other cases, on standard contractual clauses approved by the Commission (Article 46(2)(c) GDPR). You can obtain a copy of these safeguards by writing to us.

Where Apple and Google store data in iCloud and in Google backup, and the technical information from Google Play services, is governed by their own terms.

13. Your rights

You have the right to:

access your data and obtain a copy of it,
rectify your data,
erase your data,
restrict processing,
data portability for data processed on the basis of a contract,
object to processing based on our legitimate interest – on grounds relating to your particular situation.

As we don’t store your Cards or Scanned Cards, you exercise most of these rights yourself: on your phone you edit or delete a Card, save it as a contact file (.vcf) or delete the App, and you delete the copy in iCloud or in your Google account in the settings of those accounts (section 6). You delete an Office’s data by deleting the Office in the App, and the data of a Company and its Pack by deleting the Company. If you have received an Access Pass, contact the Office Administrator about your data (section 8). For data that Apple and Google process as separate controllers, you exercise your rights with them. For matters concerning your correspondence with us, write to us – we will reply within one month; in complex cases this period may be extended by a further two months (we will let you know). Exercising your rights is free of charge.

You also have the right to lodge a complaint with a supervisory authority: in Poland, the President of the Personal Data Protection Office (UODO; ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl); if you live or work in another European Union country, you may also contact the data protection authority of that country (Article 77 GDPR).

14. How to delete your data

Cards, Companies and Scanned Cards – delete them in the App or delete the App. There is no account to delete.
The copy in iCloud – turn sync off on all your devices and delete Vizicard’s data in the iCloud settings on your iPhone (section 6).
Google backup – turn it off in the App; you manage the backups in your Google account in your Android and Google account settings.
Passes and Access Passes in Wallet – remove them in the Wallet app (Apple) or Google Wallet (Google).
Companies, Offices and Access Passes on the server – delete the Office or the whole Company in the App: the Access Passes stop working at once, and we delete the data 30 days later. Cancel the Pack subscription in the Store.
NFC stickers and cards – overwrite them or erase their content.
Contacts added to your phone – delete them in the Contacts app.
Your correspondence with us – write to systems@n3osystem.io, and we will delete it unless we are required to keep it.
Copies held by others – contacts and passes saved by recipients stay with them.

15. Do you have to provide data?

Providing data is voluntary. On a Card, you enter only the details you want to show – only a name or a company name is required. You don’t have to use Wallet passes, card scanning, iCloud sync, Google backup, Offices, Access Passes or Packs. To issue an Access Pass, the Office’s name and the Recipient’s name are required.

16. Automated decisions

We don’t profile you or make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

17. Security

connections between the App or the website and the servers are encrypted (HTTPS);
the Pass Service does not store Cards’ data, so there is no database it could leak from;
the database of the Access Pass Service contains no names, and Recipients’ data in links and Access Passes is encrypted (AES-256-GCM); Access Passes in Apple Wallet cannot be shared;
passes are digitally signed, so that Wallet can check that nobody has altered them, and Access Passes are additionally signed with the Office key, which the reader checks;
a contact on an NFC sticker or in a QR code is not encrypted – anyone who scans it can read it, so put there only the details you want to show;
the Cards on your phone are protected by the screen lock and the system’s security features, and their copies in iCloud and in your Google account by Apple’s and Google’s security measures and your account’s (use a strong password and two-factor authentication).

If a personal data breach occurs that is likely to result in a high risk to you, we will announce it in the App and on the Website.

18. Children

The Service is not intended for children under 16, and we do not knowingly process their data. If you believe a child has provided us with their data, write to us and we will delete it.

19. Changes to this policy

When we change the way we process data, we will update this policy and the date at the top of the page. We will announce significant changes in the App and on the Website.