Privacy policy
Last updated October 22, 2026
Draft. This text is being reviewed and may change before it takes effect.
This policy explains what information Andover Labs LLC ("we", "us") collects when you use vCard Hosting at vcardhosting.com and vcrd.co (the "service"), what we do with it, how long we keep it, and the rights you have. If you have a question, see Contact us at the end.
Who we are
Andover Labs LLC runs vCard Hosting and is responsible for your personal information (the "controller", in the terms of the EU and UK GDPR).
Andover Labs LLC
1318 Redwood Way, Suite 270A
Petaluma, CA 94954
United States
Email: hi@vcrd.co
What we collect
- Your account: your email address, a one-way hash of your password (we never store the password itself), your organization, your custom URL, your plan and your settings, including whether you want product emails.
- Your cards: the contact details, photos and other fields you put on them. A published card is public: anyone with its link can see it.
- Billing: Stripe processes your payments. We receive and keep your plan, subscription status, the amounts and dates of payments, and a Stripe customer reference. We never see or store your full card number.
- Card statistics: when a card is viewed, scanned, downloaded or texted, we record the time, the card, the referring website's domain (not the full address of the page), and the kind of device and browser. We record the visitor's IP address only as a one-way hash that changes daily, so it can't be turned back into the address.
- Server logs: our servers log each request, including the IP address and browser. We use the logs only to keep the service secure and to fix problems, never for marketing. See how long we keep them below.
- Messages: what you send us through the contact or support forms, including your name and email address. Enterprise dedicated support also includes your account's email address.
- Text messages: when someone texts our number to get a card, we use their phone number to send the card back. We don't store the number itself: we keep a one-way hash of it, so we can honour STOP requests and limit abuse, with a log of what was asked for and what we sent.
We don't collect information about you from other sources, except payment status from Stripe and, for accounts created before this version of vCard Hosting, the account details carried over from the previous version. We we don't use your information for automated decisions that have legal or similarly significant effects on you.
People on cards
A card often describes someone other than the account holder, such as an employee. If you publish a card about another person, you're responsible for having their permission and a lawful reason to do so, and for keeping their details correct. If you're on a card and want it changed or removed, ask the account holder, or contact us and we'll help.
How and why we use it
We use your information only for these purposes, each with a legal basis under the GDPR:
| Purpose | Legal basis |
|---|---|
| Providing the service: hosting and showing your cards, your account, reports, support | Performing our contract with you |
| Billing and keeping financial records | Contract, and our legal obligations (tax and accounting) |
| Account emails: verification, receipts, payment problems, trial and renewal reminders, security notices | Contract |
| Product news and tips by email | Your consent, which you can withdraw at any time with the unsubscribe link or in your settings |
| Card statistics, security, preventing abuse and fraud, fixing errors | Our legitimate interests in running a secure, reliable service |
| Reviewing cards that are reported or look like abuse; our staff may view a card's content to do this | Our legitimate interests in enforcing our terms and protecting others |
| Answering legal requests and enforcing our terms | Legal obligations and legitimate interests |
Who we share it with
We don't sell your personal information, and we don't share it for advertising.
We share it only with the service providers that run parts of the service for us, under contracts that require them to protect it and use it only on our instructions:
- Hosting and storage: the servers and file storage that hold the service, its data and its backups.
- Stripe: payment processing.
- Email delivery: our email provider sends account and product emails.
- Cloudflare Turnstile: a check that a person, not a bot, is filling in the signup, password reset and contact forms, and the login form after several failed attempts. See Cloudflare's Turnstile privacy addendum.
- Error monitoring (Sentry): reports when something goes wrong, which may include the page and browser involved.
- SMS provider: delivers text-to-receive messages.
Ask us for the names of our current providers and we'll tell you.
We may also disclose information:
- when the law requires it;
- to protect the rights, safety or property of our users or others;
- as part of a merger or sale of our business. This policy then still applies to your information, and we'll tell you before it becomes subject to a different one.
International transfers
We're based in the United States, and our service providers may process information in the United States and other countries. When we transfer personal information from the EU, the UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK addendum), or on another lawful transfer mechanism such as the EU–US Data Privacy Framework where a provider is certified under it.
How long we keep it
| Information | How long |
|---|---|
| Your account and cards | Until you delete them. A deleted card can be restored for 30 days. When you delete your account, it goes offline at once and is permanently erased after 30 days |
| Card photos | Until you remove them or delete the card; erased with your account |
| Card statistics | Individual records for 13 months; monthly totals for the life of your account. When an account is erased, its statistics are anonymised |
| Billing records | Our record of your plan and subscription is erased with your account. Stripe keeps payment and invoice records for as long as tax and accounting law requires (usually 7 years), under its own privacy policy |
| Server and application logs | Up to 90 days |
| Copies of emails we send you | 90 days |
| Text-to-receive log (hashed phone numbers) | 13 months. A STOP request is kept until the number texts START |
| Backups | Up to 30 days; information you delete disappears from backups within that time |
| Contact and support messages | 2 years after our last reply |
Cookies
We use only cookies that the service needs to work. We don't use advertising or tracking cookies, so we don't ask for cookie consent.
| Cookie | What it's for | How long |
|---|---|---|
sid |
Keeps you logged in | Ends after 2 hours without activity, or 12 hours at most. With "Keep me logged in": 14 days without activity, or 30 days at most |
csrf |
Stops other websites from sending forms in your name | Until you close the browser |
aff |
Remembers the affiliate link that brought you here, so the referrer gets credit | 1 year |
flash |
Shows a one-time message after an action | 5 minutes |
welcome |
Remembers that you closed the welcome message on the home page | 1 year |
asid |
Staff only: keeps a staff member's own login while they help a customer | Until the browser closes |
| Cloudflare Turnstile | Tells people from bots on the forms listed above | Set by Cloudflare; see its Turnstile privacy addendum |
How we protect it
All traffic is encrypted with HTTPS. Passwords are stored only as strong one-way hashes. Access to customer data is limited to staff who need it, staff actions are logged, and backups are encrypted. No system is perfectly secure, but if a breach affects your information, we'll tell you and the authorities as the law requires.
Your rights
Wherever you live, you can:
- see and correct your account and cards in your account settings;
- download all your data from Settings → Export;
- delete your account from Settings → Delete account;
- stop product emails with the unsubscribe link or in your settings.
If you're in the EU, the UK or Switzerland, you also have the right to access your personal information, to have it corrected or erased, to restrict or object to how we use it (including for our legitimate interests), to data portability, and to withdraw consent at any time. You can also complain to your local data protection authority, for example the ICO in the UK, though we'd like the chance to help first.
If you're a California resident, the California Consumer Privacy Act gives you the right:
- to know what personal information we collect, use and disclose;
- to have it deleted or corrected;
- not to be treated differently for using these rights.
We don't sell or share personal information as the CCPA defines those terms, and we don't use sensitive personal information in ways that would give you a right to limit it. What we collect lists the categories. We collect them from you and your use of the service, use them for the purposes in How and why we use it, and disclose them only to the service providers listed above. You can use an authorised agent to make a request.
To make any request, contact us. We'll confirm it's you, normally by asking you to write from your account's email address, and reply within 30 days (45 days for California requests, which we may extend once where the law allows).
Children
You must be 18 or older to use the service. We don't knowingly collect information from children. If you believe a child has given us personal information, contact us and we'll delete it.
Changes
If we change this policy we'll update the date at the top. If a change is significant, we'll also tell you by email before it takes effect.
Contact us
For privacy questions or to use your rights, email hi@vcrd.co, use the contact form, or write to:
Andover Labs LLC
1318 Redwood Way, Suite 270A
Petaluma, CA 94954
United States