Draft for legal counsel review - not yet in force.
Last updated: July 2026
This Privacy Policy explains how Emelum OÜ (registry code 17234831, Nõmme tn 30, Kärdla linn, Hiiumaa vald, 92412, Estonia), operating the BizKard digital business card platform at bizkard.me ("BizKard", "we", "us", "our"), collects, uses, stores, and protects personal data.
This Policy has three parts, because BizKard processes personal data about different groups of people:
For questions, requests, or complaints under this Policy, contact us at privacy@bizkard.me.
The controller (or, where stated below, processor) of the personal data described in this Policy is:
Emelum OÜ Registry code: 17234831 Nõmme tn 30, Kärdla linn, Hiiumaa vald, 92412, Estonia Email: privacy@bizkard.me
Emelum OÜ is established in the European Union (Estonia). No representative under Article 27 GDPR is required. Our lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), www.aki.ee.
Account Data. When you create an account we collect your email address and the profile information you provide: name, title, company, and similar details. Authentication is handled through our hosting provider's authentication service (Supabase Auth); passwords are stored only in hashed form.
Card Data. The content you place on your cards: name, title, photo, company, logos, links, phone numbers, email addresses, and any other details you add. If your card is managed within a team workspace, your organization provides and controls this data (see Section 6).
Billing Data. Paid subscriptions and one-time purchases are processed by our payment processor, Stripe. We do not store full card numbers. We store subscription status, plan, invoices, and purchase records associated with your account. The payment processor handles your payment data under its own privacy policy and acts as an independent controller for certain fraud-prevention processing.
Usage Data. We record how you interact with the platform: features used, actions performed, timestamps, and technical data such as browser type, operating system, IP address, and device information.
Lead activity and card analytics. We store, on your behalf, the Leads captured through your cards, scans, voice notes, and imports, including Leads identified by the visitor identification service described in Part B Section 9. For your card statistics we record view and interaction events on your card pages, including each visitor's approximate location, referrer, campaign (UTM) parameters, device and browser information, and a per-visitor identifier, and make them available to you in the analytics dashboard, as a CSV export, and in a monthly analytics digest email. The digest is sent from noreply@notify.bizkard.me and contains a one-click unsubscribe; unsubscribing is honored through a suppression list.
Support Communications. When you contact us, we keep the correspondence, along with email send logs and unsubscribe and suppression records.
We do not knowingly collect special categories of personal data (Article 9 GDPR) about our users, and we ask that you do not submit such data.
When you publish a card, the information on it is available on a public web page that anyone with the link can view, save (including as a downloadable contact file), and share. You choose what to put on your card and whether to publish it, and you can unpublish at any time using the Service's controls. Once someone has saved or shared your card details, those copies are outside our and your control. Public card pages are indexable by search engines and may appear in search results; we do not apply a noindex directive, and card pages generate social-media link previews. A private or unlisted card option is planned but not yet available; until then, every published card is public and indexable.
| Purpose | Data | Lawful basis (GDPR Art. 6) |
|---|---|---|
| Providing the platform, creating and managing your account, cards, and workspaces | Account Data, Card Data, Usage Data | Contract performance, Art. 6(1)(b) |
| Publishing your card page at your instruction | Card Data | Contract performance, Art. 6(1)(b) |
| Billing, invoicing, subscription management | Billing Data | Contract performance, Art. 6(1)(b); legal obligation, Art. 6(1)(c) (accounting and tax law) |
| Platform security, abuse prevention, logging, access control | Usage Data, logs | Legitimate interests, Art. 6(1)(f) (securing the service) |
| Service communications (transactional email, subscription lifecycle, workspace invitations), sent from noreply@notify.bizkard.me | Account Data, email logs | Contract performance, Art. 6(1)(b) |
| Monthly analytics digest email to card owners with card views, with one-click unsubscribe | Account Data, card statistics | Legitimate interests, Art. 6(1)(f); you can opt out at any time via the unsubscribe link |
| Responding to inquiries and support requests | Support data | Legitimate interests, Art. 6(1)(f); pre-contractual steps, Art. 6(1)(b) |
| Marketing communications to you | Account Data | Consent, Art. 6(1)(a), withdrawable at any time via the unsubscribe link |
| Product improvement in aggregated or de-identified form | Usage Data | Legitimate interests, Art. 6(1)(f) |
| Establishing, exercising, or defending legal claims; complying with law | Any of the above as needed | Legal obligation, Art. 6(1)(c); legitimate interests, Art. 6(1)(f) |
Where we rely on legitimate interests, you can object at any time (Section 15).
If your card is managed in a team workspace, your organization (the Workspace Owner) decides what appears on your card and whether it is published, and is the controller of your card data; we process it on the organization's behalf under the DPA. Questions about why your card exists, what it shows, or requests to change or unpublish it should go first to your organization's workspace administrator. You can also contact privacy@bizkard.me and we will assist and forward your request. Under the Terms of Service, the organization must have authority (and where required, your consent) to manage your card, and must remove your card when you leave or withdraw consent.
When you view someone's BizKard card and choose to share your contact details with them (for example through the "Just met someone" form), the details you submit (such as your name, email address, phone number, company, and any note) are stored in that card owner's BizKard contact list. The card owner (or their organization) is the controller of this data: they decide why they collect it and how they use it. Emelum stores and processes it only on their behalf as processor.
The card owner may contact you using the details you shared, by their own means (their own email, phone, or messaging service). BizKard does not itself send follow-up messages to you: the Service only provides the card owner with your details and, on request, message drafts, and the card page's "Auto Follow-Up" button simply opens a pre-addressed draft in the viewer's own email client. Under our Terms of Service and Acceptable Use Policy, card owners must have a lawful basis and, where required, your consent for contacting you, and must honor your opt-outs.
BizKard users can photograph physical business cards they have received and have the contact details extracted (using AI-based text recognition provided through the Lovable AI Gateway with Google Gemini models) and saved to their contact list. If someone scanned your card, the extracted data (typically name, title, company, phone, email, and address) is stored in that user's BizKard contact list; the photographed image itself is processed transiently for extraction and is not stored. This is an Article 14 situation: we did not obtain your data from you. The user who scanned your card (or their organization) is the controller; Emelum is their processor. Our terms require users to scan only cards that were given to them directly, in a business context.
When you visit a public card page we process the following:
Downloading a contact file or sharing a card does not require an account.
Retention of view records. Card view records, including IP addresses and other IP-derived data, are retained for a maximum of 24 months and then deleted.
You have the rights described in Section 15 (access, erasure, rectification, restriction, objection, and others). Because the card owner is the controller of Lead Data:
Retention of Lead Data. Lead Data is retained until the card owner deletes it, until the owner's account or workspace is deleted, or until a valid erasure or objection request is upheld. There is no automatic expiry.
We use a limited set of service providers to run BizKard, including hosting, payments, email delivery, and AI features. The current list, with each provider's function, the data involved, and location, is maintained on our [Subprocessor List](./06-Subprocessor-List.md), which we update with at least 30 days' notice of changes for DPA customers.
We may also disclose personal data where required by law, to protect our rights or the safety of others, or in connection with a corporate transaction (merger, acquisition, reorganization), with notice where required.
We never sell personal data.
Emelum OÜ is established in Estonia, but our hosting infrastructure (Lovable Cloud, built on Supabase) is located in the United States, and several vendors on our Subprocessor List are US companies. Where personal data is transferred outside the European Economic Area, we rely on:
You may request more information about the safeguards applicable to a specific transfer at privacy@bizkard.me.
BizKard is not directed at children. You must be at least 16 years old to create an account, and users aged 16 to 17 must obtain parental consent for paid subscriptions. We do not knowingly collect personal data from anyone under 16; if we learn that we have, we will delete it.
We apply technical and organizational measures appropriate to the risk, including: logical separation of customer accounts and workspaces enforced by database row-level security policies; encryption in transit (TLS) and at rest; role-based access controls and least-privilege staff access; logging of administrative actions; and backups. A summary of measures is also set out in Annex B of the DPA. No system is perfectly secure; if a personal data breach occurs that is likely to result in a risk to you, we will notify the competent authority and, where required, affected individuals in accordance with Articles 33 and 34 GDPR.
If you are in the EEA or UK (and in many other jurisdictions), you have the right to: access your personal data; rectify inaccurate data; erase data ("right to be forgotten"); restrict processing; data portability (a machine-readable copy of data you provided); object to processing based on legitimate interests, including direct marketing (an absolute right); and withdraw consent at any time without affecting prior processing. We do not make automated decisions about you that produce legal or similarly significant effects.
Exercise these rights at privacy@bizkard.me. We respond within one month (extendable by two months for complex requests, with notice). We may need to verify your identity. Where the data sits in a customer's contact list or workspace for which the customer is controller, we will forward your request as described in Part B.
You may request deletion of your account (or workspace) and associated personal data at any time by emailing privacy@bizkard.me from the email address on the account. In-product account or workspace deletion is not currently available. We will verify the request and complete deletion or anonymization within 30 days of verification [COUNSEL: deletion is currently a manual back-office process - confirm the 30-day commitment is operationally deliverable before publishing], except for data we must retain by law or need for the establishment or defense of legal claims. You can delete individual leads and cards in-product at any time; deleting a card also deletes its view records, while leads you captured survive card deletion until you delete them.
If you are not satisfied with our response, you have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, www.aki.ee, info@aki.ee, or with the supervisory authority of your habitual residence, place of work, or the place of the alleged infringement.
We may update this Policy from time to time. Material changes will be communicated through the platform or by email before they take effect, and the "Last updated" date will be revised. Prior versions are available on request.
Emelum OÜ (operating BizKard) Nõmme tn 30, Kärdla linn, Hiiumaa vald, 92412, Estonia Registry code 17234831 privacy@bizkard.me