Who we are
vCardGen is published by MoCode LLC, a limited liability company organised under the laws of the State of Wyoming, United States, whose address is 30 N Gould St Ste R, Sheridan, WY 82801, United States. We decide what is done with the data described here. Write to us at contact@vcardgen.com.
This page explains how we handle personal data, including, for people in the European Union and the United Kingdom, under the GDPR and the UK GDPR.
What we keep
- Your account: your email address, when you joined and last signed in, whether you asked for news, and, if you close the account, when. Your email is needed for an account; without it you can still use the free QR tools.
- Your pages: everything you type in your card, your menu or your Google review page, and the photos and logos you add. These pages are public: anyone with the address or the QR code can open them. We ask search engines not to list them.
- Private messages: when a customer uses "Tell the owner privately" on a review page, we keep the message, and the name and the email or phone number the customer chooses to give, for the page's owner. We also mail the message to the owner, without the email or phone. We do not read these messages, and our back office does not show their text.
- QR codes kept in your account: what each one opens (a link, a contact's details, or a WiFi network's name and password), the name you give it, and how many times it was opened each day. Nothing about who scanned it. A contact or a network is shown to anyone who scans its code.
- Reports: the words someone types in "Report this card" or "Report this page". Nothing about who wrote them.
- Your sign-in: to check the 8-digit code we keep a coded form of your email and of the code, never the code itself. Once you are signed in, a random key keeps you signed in for 30 days. Only a coded form of that key is stored.
- News: if you tick "Send me news about the product", we may write to you about vCardGen, with a link to stop in every mail. Every account may also get mails about the service itself. To send them we export the list of addresses from our back office, and we will name here the service that sends them before the first one.
Statistics, without following anyone
For each day we count pages viewed, visits and how long they last, the visitor's country, the kind of device (phone, tablet, computer), the browser's language, the name of the site a visitor came from (such as google.com) and the robots that read the site. For your own pages: QR scans, link views, contact saves and taps on buttons. These are totals: nothing in them says who did what. No IP address is stored, and no cookie is used to count.
To count the people of a day, each browser asks our server once a day for an empty answer and keeps it until midnight (UTC); the first ask of the day adds one to the day's count. Nothing identifies you.
The free QR tools
What you type in the QR code generator, the vCard generator and the WiFi QR code stays in your browser. It is never sent to us, unless you press "Save to my account" under a link or a contact in the QR code generator: it then goes to your account page, and is kept once you create the code there. We only count that a code was made, downloaded, copied, shared or saved to an account.
Why, and on what basis
- To run the service you asked for (your account, your pages, your sign-in, the messages to page owners, mails about the service): the agreement between us, our Terms.
- Messages and reports sent by visitors who have no account: our legitimate interest, and theirs, in passing on what they chose to send.
- To keep the site safe and stop abuse (the bot check, the limits on requests, reports, backups) and to count visits without naming anyone: our legitimate interest.
- To send you news: your consent, which you can take back at any time.
- To answer a lawful request from an authority: the law.
Who helps us run it
- Cloudflare, Inc. (United States): hosts the site, runs the database and the photo storage, and the bot check on the sign-in form and the private message form (Cloudflare Turnstile, which reads signals from your browser to tell people from robots: see Cloudflare's Turnstile notice). Like any host, it sees your IP address with each request, and may keep it in its own logs for a short time, under its own policy. We use the IP for a moment to limit how many requests one address can make and to know the country, and we do not store it.
- Resend (Plus Five Five, Inc., United States): sends our mails (sign-in codes, messages to page owners) from its servers in the European Union (Ireland). It keeps a record of each mail it sends for a time, under its own policy.
- Cloudflare also forwards the mails you write to contact@vcardgen.com to our own mailbox.
- GitHub, Inc. (United States): keeps our nightly backup in a private repository.
- Google Search Console and IndexNow (Bing) only receive the addresses of our public pages. We send them nothing about you.
Your data may therefore be processed in the United States and in the European Union. Cloudflare, GitHub and Resend each state that they comply with the EU-U.S. Data Privacy Framework, and their data processing terms or privacy statements provide the European Commission's standard contractual clauses. Write to us for the references. We sell nothing, and we share nothing with advertisers.
How long we keep it
| What | How long |
|---|---|
| A sign-in code | Works 10 minutes; its coded trace is deleted within 48 hours |
| Being signed in | 30 days, or until you press "Sign out everywhere" |
| Your account and pages | As long as the account is open. A closed account stays offline, kept whole, until you ask us to erase it |
| Private messages | Until the page's owner deletes them, or the page is erased (older backup copies: see below). A page keeps 200 at most |
| Reports | Until we handle them, then 90 days |
| The address of a deleted page | Closed for 12 months so nobody else takes it (a card, menu or review page deleted by its owner within 7 days of making it leaves its address free). Only a coded form of the address is kept |
| A QR code kept in your account | Until you delete it, or the account is erased. Its address then stays closed for 12 months |
| Daily statistics | No end date; they name nobody |
| Nightly backups | One copy a night, in a private repository, with no end date. Anything deleted on the site (a message, a page, a photo) stays in the older nightly copies: ask us and we remove it from them too, within 30 days. When we erase an account at your request, we also remove it from the backups, within 30 days |
Cookies and what your browser keeps
We use only what the site needs to work, so there is no cookie banner. If we ever add advertising or tracking cookies, we will ask your consent first.
Cookies, set only when you sign in:
__Host-login: 10 minutes; ties a sign-in code to the browser that asked for it.__Host-s: 30 days; keeps you signed in.
Kept in your browser: theme (light or dark), lang (the language you picked), card-draft, menu-draft and review-draft (what you are building, sent to us only when you publish it), stats-span (the period you picked for your numbers).
Kept only while the tab is open: visit (when the last page was opened and how many pages; it sends numbers, never your name), auth-code (your email address, while a code waits for it), qr-save (the link or the contact typed in the QR code generator after "Save to my account", until your account page reads it).
Kept in the browser's cache until midnight (UTC): one empty answer of our server, to count the day's visitors (see Statistics). These counts name nobody. To be left out of them anyway, block this site's addresses /api/hit and /api/seen in your browser (a content blocker can): the site works the same.
Cloudflare's bot check runs in its own frame and may keep what it needs there.
Your rights
- See and take your data: Settings, Download my data (a file with your account and the text of your pages) and Download my photo. Private messages are read in your account; their text is not in the file.
- Correct: change your pages at any time. To change your email, write to us.
- Close: Settings, Close my account. Everything goes offline at once. Closing erases nothing.
- Erase: close the account, then write to us. We erase it for good, including from our backups, within 30 days.
- Limit: ask us to pause the use of your data while a request is checked.
- Object, or stop news: untick it in Settings, or use the link in the mail. To object to anything else, write to us.
- A customer who sent a private message: ask the business to delete it, and write to us to remove it from our backups too. If the business does not delete it, write to us with the page's address.
Write to contact@vcardgen.com, from your account's email if you have one. We answer as fast as we can, and within one month at most. If you live in the European Union or the United Kingdom, you may also complain to your country's data protection authority, such as the CNIL in France (cnil.fr).
If you run a review page
The messages your customers send you are yours to handle: you decide to read, answer or delete them, and you are responsible for them toward your customers under the law that applies to you. We keep and mail them for you and use them for nothing else. Delete what you no longer need. The same holds for anything about other people you put on your card or menu.
Children
vCardGen is not for children under 16. If a child has given us data, write to us and we will erase it.
Security
The site is served over HTTPS only. Sign-in codes and session keys are stored in our database in coded form, never in clear (the code itself travels in the mail Resend sends you), and our backups are kept in a private repository. No system is perfectly safe: if we learn of a breach that puts you at risk, we will tell you.
Changes
When this page changes, the date at the top changes. For an important change, we tell account holders by email before it applies.
Contact
contact@vcardgen.com. More in the Legal notice.