Privacy Policy

1. Data Controller

Cardify is a trade name of Prism Labs BV, Mieregemstraat 167, 1785 Merchtem, Belgium, company number (KBO) 1040.692.808. Prism Labs BV is the data controller for the personal data it processes in connection with Cardify.

Questions and privacy requests can be sent to support@gocardify.io.

2. Who does this policy apply to?

This policy applies to visitors of the Cardify website, registered users, users of free or paid features, and anyone who contacts Cardify.

Cardify is only available in the countries listed in the Terms and Conditions. The geographic access control is explained separately below.

3. What personal data do we process?

3.1. Account data

We may process your email address, internal account ID, automatically generated username, account status and settings in order to create and manage your account. In accordance with the Terms and Conditions, usernames can be changed at most once every thirty days.

3.2. Collection and usage data

We process data you add to Cardify yourself, such as cards in your collection, wishlist items, selected variants, and other data needed for collection management. Depending on your account type, data relating to CSV import and export, collection analytics, and sharing your collection may also be processed.

3.3. Subscription and transaction data

For Premium or other paid services, we may process subscription status, chosen subscription type (monthly or annual), payment status, transaction identifiers, invoice data, and relevant administrative information.

All payment and billing operations take place directly on Stripe's own domain and servers. When a user subscribes, makes a payment, or manages their payment method, they are redirected from Cardify to Stripe. Cardify itself never processes full card numbers, CVC codes, or complete payment card data. From Stripe, Cardify only receives the technical feedback needed to process the status of the payment or subscription, such as success or failure, along with the associated standard transaction and subscription information.

3.4. Communication

When you contact us, we may process your email address, account data, the content of your message, any attachments, and follow-up data.

3.5. Technical and security data

For the operation and security of the application, we may process session data, security tokens, technical request information, timestamps, error messages, and other necessary technical data. More information about cookies and local browser storage is available in the Cookie Policy.

3.6. Bugsink

Cardify uses Bugsink, self-hosted on our own server, for error tracking. Under the current configuration, error logs do not contain any user data or other data that could be used to directly identify a user.

Regular error logs are kept for 7 days. Individual error logs that require further investigation or troubleshooting may be kept longer, but only for as long as reasonably necessary to investigate and resolve the technical issue concerned. These logs are then deleted as well.

3.7. Umami

Cardify uses a self-hosted installation of Umami for anonymous usage statistics, performance measurements, and processing times. Umami is not used to track individual users or build user profiles.

The current Umami configuration does not use cookies, does not perform cross-site tracking, and does not retain IP address information that would allow Cardify to identify a user or their anonymous session. Umami's statistical data can therefore be retained as anonymous usage information and is not linked to, or separately deleted for, a specific user when that user's account is deleted.

3.8. Google reCAPTCHA

On the registration page, Cardify uses Google reCAPTCHA to help detect automated registrations, spam, and abuse. reCAPTCHA analyses technical signals and user interactions and provides Cardify with a verification result and, depending on the reCAPTCHA version used, a risk score used to assess whether a registration is likely performed by a human or an automated system. Processing by Google takes place in accordance with Google's own privacy policy and terms.

4. Why do we process personal data?

4.1. Providing the service

Account, collection, subscription, and usage data are processed to provide your account and Cardify's features. The legal basis is the performance of the contract, or taking steps at your request prior to entering into it.

4.2. Payment and administration

Transaction and invoice data are processed to manage payments and subscriptions and to comply with accounting and tax obligations. The legal basis is the contract and/or a legal obligation.

4.3. Security and error tracking

Technical data may be processed to keep Cardify safe and stable, prevent abuse, investigate incidents, and fix errors. Insofar as this is not directly necessary for the contract, this processing is based on our legitimate interest in securing the application, our users, and our systems.

4.4. Analysis and improvement

Anonymous usage statistics, performance measurements, and processing times via Umami are used to technically analyse and improve Cardify. This data is not used for advertising profiling and, under the current configuration, cannot be traced back to an individual user.

4.5. Consent

Where processing requires consent, we ask for it in advance. You can withdraw your consent for the future at any time.

4.6. Legal obligations and disputes

We may process data to comply with legal obligations, to respond to competent authorities, or to bring, exercise, or defend legal claims.

5. Geographic access control via MaxMind GeoLite2

Cardify is only available in a predetermined list of supported countries. When accessing Cardify, and when starting a subscription or payment transaction, the source IP address is used to locally check whether the user is located in one of the supported countries. A local MaxMind GeoLite2 database is used for this purpose.

This check takes place entirely locally within Cardify. Your IP address is not sent to MaxMind for this check and is not retained by Cardify after the check has been performed. Only users accessing from a supported country can proceed with the subscription or payment action concerned.

This check is used solely to determine whether the service is accessible from a supported country, and not to build marketing profiles.

6. Who do we share data with?

6.1. Stripe

Stripe processes all payment and billing operations directly on Stripe's own domain and servers. Cardify itself does not load any Stripe payment scripts or payment components in its application. Users only reach Stripe when they choose "Subscribe/Abonneren" or "Manage Billing/Betaalmethode bijwerken" from within Cardify.

From Stripe, Cardify only receives the callback or webhook information needed to process the outcome and status of a payment or subscription. Stripe determines for itself how long data processed within its own environment is retained, and may itself act as an independent data controller for certain processing activities. Stripe's own privacy policy also applies to this.

6.2. Amazon Web Services

Cardify uses AWS S3 and CloudFront to host and distribute card images. Under the current setup, primary storage is located in the AWS eu-central-1 (Frankfurt) region.

CloudFront is a global content delivery network. When images are requested, content and technical request data may be processed or temporarily cached via edge infrastructure located outside the European Economic Area.

6.3. Self-hosted services

Umami and Bugsink are self-hosted on infrastructure managed by or for Cardify, and are not used as external advertising platforms.

6.4. MaxMind

The GeoLite2 database is used locally. Under the current setup, the checked IP address is not sent to MaxMind.

6.5. Google reCAPTCHA

Google reCAPTCHA is used on the registration page for security and bot/spam detection. Google processes technical information and signals needed for this risk analysis. Cardify receives the verification result and, depending on the reCAPTCHA version used, a risk score. Google's own privacy policy applies to processing by Google.

6.6. Advisors and authorities

Data may be shared with accountants, legal advisors, insurers, or competent government authorities where necessary for legal obligations, business operations, or the protection of our rights.

Outside the parties named in this article, Cardify does not share personal data with other external parties, except where legally required or necessary to carry out an explicit request from the user.

7. Processors

Where a supplier processes personal data exclusively on behalf of Prism Labs BV, we make the arrangements required under Article 28 GDPR where applicable, including with respect to instructions, confidentiality, security, sub-processors, and deletion or return of data.

Not every external party is necessarily a processor. Some parties may themselves act as an independent data controller for certain processing activities.

8. International transfers

Because we work with service providers operating worldwide, personal data may in some cases be processed outside the European Economic Area.

Where the GDPR applies, we use a valid transfer mechanism where required, for example an adequacy decision, the EU-US Data Privacy Framework for a certified recipient, or the standard contractual clauses approved by the European Commission, supplemented where necessary with appropriate additional safeguards.

The exact transfers involved may change when suppliers adjust their infrastructure or sub-processors. Cardify monitors relevant changes as part of its supplier management.

9. Retention periods

We do not retain personal data for longer than necessary for the purpose for which it was collected, unless a longer retention period is legally required or justified.

Account and collection data is retained for as long as your account is active. When you delete your account via your profile, your active account, collection, and usage data is removed from the live Cardify environment, except for data that Prism Labs BV must retain longer under a legal obligation, or for the establishment, exercise, or defence of legal claims.

Invoice and accounting data is retained for the applicable statutory retention periods. Regular Bugsink error logs are kept for 7 days; individual error logs that require troubleshooting are only kept for as long as necessary for that troubleshooting. Umami statistics may be retained as anonymous statistical data because, under the current configuration, they do not contain cookies, cross-site tracking, or IP address information that would allow Cardify to identify the user or their session.

The IP address and the outcome of the GeoLite2 country check are not retained after the check. Cardify creates daily backups. Backups are retained for 7 days and are then overwritten or deleted as part of the normal backup lifecycle. As a result, data from a deleted account may still be present in a secure backup for up to that backup cycle.

10. Automated decision-making and profiling

Cardify does not use automated decision-making or profiling that produces legal effects or similarly significantly affects users within the meaning of Article 22 GDPR.

The geographic country check is a technical access control. Under the current setup, its outcome is not retained and is not used for marketing profiling.

11. Security

Prism Labs BV takes appropriate technical and organisational measures suited to the nature and risks of the processing involved. These may relate to, among other things, access management, authentication, secure connections, logging, patch and update management, restriction of access rights, backups, and incident follow-up.

Access to personal data is limited to persons and systems that reasonably need it. No online system can guarantee absolute security.

12. Data breaches

If a personal data breach occurs, we assess the risk to the rights and freedoms of the individuals concerned.

Where the GDPR requires it, we report the data breach to the competent supervisory authority. If the breach is likely to result in a high risk, we also inform the affected individuals in accordance with legal requirements.

13. Your rights

Where the GDPR applies to you, you may, depending on the circumstances, have the right to information, access, rectification, erasure, restriction of processing, data portability, and objection. Where processing is based on consent, you can withdraw that consent for the future.

You can also object to processing based on our legitimate interest for reasons related to your specific situation. We will stop that processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where the processing is necessary for legal claims.

Requests can be sent to support@gocardify.io. We may ask for reasonable information to verify your identity, and we respond to requests within the legally applicable timeframe. You can also download a copy of your data at any time from your profile page using the "Download My Data" button.

14. Right to lodge a complaint

You have the right to lodge a complaint with a competent data protection supervisory authority.

In Belgium, this is the Data Protection Authority (Gegevensbeschermingsautoriteit). If you live in another EEA member state, you may in certain cases also contact the supervisory authority of your habitual residence, workplace, or the place where the alleged infringement took place.

We encourage you to contact us first so that we can look into your question or concern, without this limiting your right to lodge a complaint directly.

15. Children and minors

Cardify is intended exclusively for users aged 16 and older, regardless of the supported country from which they use the application.

At registration, every user must explicitly confirm, via a separate checkbox that is not pre-checked, that they are at least 16 years old. Registration cannot be completed without this confirmation. This age confirmation is a condition of use for Cardify and is not used for profiling or marketing purposes.

16. Deleting an account

A user can delete their account directly via their profile. Once this happens, Cardify removes all active account, collection, and other usage data linked to the account from the live environment, except for data that must be retained longer by law.

Cardify creates daily backups that are retained for 7 days. As a result, deleted data may still be present for up to this backup cycle; it then disappears according to the normal lifecycle of the backups. Data that Stripe processes within its own environment is subject to Stripe's own retention periods and deletion processes, over which Cardify has no direct control. Anonymous Umami statistics are retained because Cardify cannot trace that data back to an account or individual session.

17. Cookies and similar technologies

Cardify uses cookies and similar technologies for the technical operation and security of the application. Your preference for light or dark display is stored in localStorage. The current Umami configuration is cookieless. Google reCAPTCHA is used on the registration page. Stripe technologies are not loaded within the Cardify domain; payment and billing operations take place on Stripe's own domain.

More information about the Laravel session and XSRF cookies, the optional "Remember me" cookie, Umami, localStorage, Google reCAPTCHA, and the external Stripe payment environment is available in Cardify's separate Cookie Policy.

18. Changes to this Privacy Policy

We may amend this Privacy Policy when Cardify, our technical setup, our suppliers, our processing activities, or applicable legislation change.

The most recent version is made available via Cardify. For material changes, we will inform users in an appropriate manner where the law requires this.

19. Contact

For questions, requests, or complaints about the processing of your personal data, you can contact:

Prism Labs BV
Cardify
Mieregemstraat 167
1785 Merchtem, Belgium
Company number (KBO): 1040.692.808
Email: support@gocardify.io