Privacy Notice
Translation for convenience; the Italian version prevails. Read the Italian original.
Last updated: October 25, 2026
This notice explains, pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR), how we process your personal data when you use My Business Card.
1. Data controller
JMC PROJECTS SRLS, VAT number 01606160297, registered office Via G. Matteotti 22, 45019 Taglio di Po (RO), Italy. Email: info@mybusinesscard.app. We have not appointed a Data Protection Officer (DPO), because it is not mandatory for our activity: for any request, write to the email address above.
2. Minors
The service is not intended for anyone under 18: by signing up, you declare, under your own responsibility, that you are at least 18 (see Terms, Article 2). We do not knowingly collect data from minors. If we learn that an account belongs to a minor, we close it and delete its data, except where the law requires us to keep it. If you think this has happened, write to us.
3. What data we process
- Account: email, plan and subscription status, language, date of confirmation of being of legal age and of acceptance of the Terms.
- Business and Personal profiles: the data you enter (name, role, company, phone, email, website, location, description, social profiles, colors and theme), photo, logo and, if you upload it, your curriculum vitae (CV) in PDF. Everything is private until you choose to show it.
- Contacts and exchanges: exchange requests, your address book (level granted, personal notes, date and place of the meeting, reminders), blocks and reports.
- Community: if you choose to appear, the profile information you expose and search tags.
- Reviews: rating, comment, publication choice and essential history.
- Payments and invoicing: tax code, billing address, VAT number and SDI code or PEC where applicable, amounts and invoices. Card data is received only by Stripe: we neither see nor store it.
- Referral: the friend code and related events (who subscribed through your link, with no personal data of the invitee beyond what is necessary).
- Technical data: IP address, browser type and security logs generated by the servers. On your device we use only technical storage (see the cookie notice).
Anyone who scans your QR code without being signed up does not create an account: they only see the public page, that is, the fields you chose for the "First meeting" level, and can save the contact as a vCard.
4. Why we process it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating and managing the account and cards, showing the public page, exchanges, address book, Community, support | Performance of the contract (Art. 6.1.b) |
| Managing the subscription, payments, renewals, withdrawal, electronic invoices, accounting and tax obligations | Contract (Art. 6.1.b) and legal obligations (Art. 6.1.c) |
| Verifying the declared legal age and acceptance of the Terms | Legal obligation and legitimate interest in proving compliance (Art. 6.1.c and 6.1.f) |
| Security, prevention of abuse, spam and fraud, rate limiting, moderation of reports, defense of a legal claim | Legitimate interest (Art. 6.1.f) |
| Publishing your review comment and, if applicable, your name | Consent, separate from the rating (Art. 6.1.a), revocable |
| Sending you news and offers by email | Consent (Art. 6.1.a), optional and revocable |
| Referral discount | Contract (Art. 6.1.b) |
If you do not give us the data needed for the contract (for example, the email or billing data), we cannot activate the service. Consent to marketing and to the publication of the review is always freely given and does not condition the service. Withdrawing consent does not make processing already carried out unlawful.
5. Who sees your data: levels and control
You decide, field by field and separately for Business and Personal, at which level to show it:
- Level 1, First meeting: visible to anyone who opens your QR code or your link.
- Level 2, Acquaintance: visible to the contacts to whom you grant this level.
- Level 3, Trust: visible to the contacts to whom you grant the highest level.
A field without a level stays private. You can change a contact's level or revoke it at any time: from that moment they no longer see the updated data. In the quick exchange we never send data you have not chosen. If you appear in the Community, the contact details you expose are visible to active subscribers who search for you.
Please note: if a person has already saved your data (a contact in their address book, a vCard, a screenshot, a copy on their phone), we cannot delete it from their device or address book. Share only what you are ready to have kept.
6. Who we disclose data to
We use providers that process data on our behalf (data processors, under an agreement pursuant to Art. 28 GDPR):
- Supabase: database, email login, storage of photos, logos and CVs. Data hosted in the European Union (Ireland).
- Stripe: payments and the subscription management portal. For certain obligations (anti-money laundering, fraud), Stripe also acts as an independent controller, according to its own notice.
- Hostinger: hosting of the website and the app.
- Fatture in Cloud: issuing and sending electronic invoices.
- Tax and legal advisers, and authorities, when required by law.
To load fonts and certain libraries, the app and the website connect to third-party servers (Google Fonts, jsDelivr, cdnjs), which receive your IP address. We do not use analytics or advertising tools.
Transfers outside the European Economic Area. Some providers (for example Stripe and Supabase, through group companies based in the United States) may access data from non-EU countries. In that case we rely on adequate safeguards: an adequacy decision (EU-US Data Privacy Framework) or the standard contractual clauses of the European Commission (Articles 45 and 46 GDPR). You can ask us for a copy of these safeguards.
We do not sell your data and we do not use it for third-party advertising.
7. How long we keep it
- Account and card data: for as long as you have the account. If you delete the account, we delete the data.
- After the subscription expires: we keep it only to let you come back with the same QR codes, for a maximum of 24 months. Then we delete it or anonymize it. You can bring forward the deletion whenever you like.
- Invoices and tax data: 10 years, as required by law. They remain even if you delete the account.
- Proof of legal age and of acceptance of the Terms: for the duration of the relationship and until the related rights become time-barred.
- Reports and security logs: for the time needed to handle them and to defend ourselves, then deleted.
- Marketing consent and published review: until withdrawal or deletion of the account.
8. Your rights and how to exercise them
You have the right to access your data, rectify it, erase it, restrict its processing, receive it in a readable format (portability), object to processing based on legitimate interest and withdraw consent (Articles 15-22 GDPR).
- In the app: Account section, "Export my data" (a JSON file with everything we hold about you) and "Delete my account".
- By email: write to info@mybusinesscard.app. We reply within one month, extendable by two months in complex cases.
If you believe your data is being processed unlawfully, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it), or with the authority of your EU country.
9. No automated decisions
We do not carry out profiling and we do not make decisions based solely on automated processing that produce effects on you. The service does not use artificial intelligence features on your data.
10. Security
We use appropriate technical and organizational measures: access only to authorized data, server-side checks on visibility levels, private files downloadable only through signed links, encrypted connections. No system is 100% secure: if a breach affecting you occurs, we will notify you as required by law.
11. Changes
If we change this notice, we update the date at the top and, for important changes, we notify you by email or in the app. Also read the Terms of Service and the cookie notice.