1. Information we collect
Account information. When you register we collect your name, email address and a hashed password. We record account status, role assignments, verification state and the time of your last login.
Profile information. You choose what to add to your public profile: display name, role, company, biography, phone, public email, address, business hours, services, website, portfolio, social links, custom links, images and design settings.
Contact messages. If a visitor uses your contact form, we collect their name, email address and message so it can be delivered to your account email. Messages are sent by email and are not displayed in the application. Our email provider may process and retain the message according to its own policy.
Technical information. The application uses a session cookie for authentication and CSRF protection. Web server logs may record request metadata for security and troubleshooting according to the hosting provider’s configuration.
2. Public profiles
A published profile is intended to be public. Anyone with the link, QR code or NFC card can view it, and search engines may index it. Do not add information you want to keep private. You control which optional fields are visible, and you can unpublish the profile at any time.
Public profile pages include structured data and link previews so they can be shared cleanly. A profile owner can disable saving contact details or individual contact actions from the design and contact settings.
3. Analytics
We record profile views, link clicks and contact events such as vCard downloads, call clicks, email clicks, shares, QR downloads and NFC taps. These records help profile owners understand what is useful.
- Visitor keys are derived with a keyed hash from request metadata and the current date. Raw IP addresses and user agents are not stored in the analytics tables.
- Repeat views from the same visitor key are counted once per profile per day.
- Views by the profile owner and signed-in administrators are excluded.
- Requests identified as bots or automated crawlers are excluded.
We do not use advertising pixels or sell analytics data. Retention is controlled by the platform’s analytics retention setting.
4. How we use information
- To create accounts, authenticate users and protect the service.
- To publish and display the profile details you choose to share.
- To deliver contact form messages and operational notifications, including email verification.
- To provide analytics to the profile owner and authorised platform staff.
- To investigate reports, abuse, security incidents and card assignment issues.
- To maintain audit logs of sensitive administrative actions.
5. Sharing and processors
We share information only as needed to run the service: with hosting and database providers, email delivery providers and authorised platform administrators. We may disclose information if required by law or to protect the rights and safety of users. We do not sell personal information.
6. Security
Passwords are hashed. Administrative routes require authenticated, active staff accounts with the appropriate permission. Sensitive staff actions are recorded in an audit log with sanitized metadata. No online service can guarantee absolute security, so use a strong unique password and keep your account email current.
7. Your choices and rights
You can update your account and profile from the dashboard, unpublish your profile, remove optional fields, download your vCard and delete your account. Account deletion removes your profile and associated uploads, subject to backups and records we must retain for security or legal reasons.
Depending on your jurisdiction, you may have additional rights to access, correct, export or delete personal information. Contact us to make a request. We may need to verify your identity first.
8. Children
Contap is not intended for children under 16. If you believe an account belongs to a child, report the profile or contact support so we can review it.
9. Changes
We may update this policy as the service evolves. Material changes will be communicated through the platform or by email where appropriate. The effective date above shows the latest revision.
10. Contact
Questions or requests can be sent to platform support through the help centre. Include the email address associated with your account and enough detail for us to identify the relevant profile.