Privacy Policy

1. Who we are

3693 Cards is operated by SINCE3693 Limited, 2 Frederick Street, Kings Cross, London, WC1X 0ND, United Kingdom. You can contact us about privacy at [email protected].

We decide the purposes and means of processing for accounts, payments, platform security, support and our own operations. A customer who manages a profile or Team decides what to publish, who may use that workspace, and why to collect and use visitor enquiries, contacts and bookings. For those customer-directed records, we provide the service on the customer’s instructions, while remaining responsible for our own platform operations and legal duties. If you contact a profile owner, they are also a point of contact about their use of your information; you may always contact us.

2. Data we handle

• Accounts and Teams: names, email addresses, password credentials or social sign-in identifiers, sessions, account settings, Team memberships, roles and invitations.
• Profiles and media: contact details, portraits, biography, links, portfolio items, uploaded files, designs and other information a customer chooses to add. Guest drafts and published trials also use a temporary claim credential.
• Contacts, leads and bookings: information a visitor submits, conversation and assessment results, booking date and time, timezone, attendee contact details and related event identifiers. Customers may also upload business-card images to create network contacts.
• AI interactions: visitor messages, assistant replies, conversation metadata and relevant published profile information. Lead assessment can include enquiry and contact details; business-card scanning can include a card image and extracted contact fields.
• Usage and security: profile visits, interactions, referral source, a persistent visitor identifier, visit identifiers, active time, an inferred country where location lookup is configured, and a keyed hash derived from an IP address for rate control. Our infrastructure also processes IP addresses and request logs.
• Purchases and Wallet: order and shipping details, subscriptions, invoices, refunds, promotion or partner attribution, card/pass identifiers, and Wallet registration or push identifiers where you add a pass. Payment card details are handled through Stripe rather than stored as full card numbers by 3693 Cards.

We obtain this information from you, a profile owner or Team, a visitor who submits information about you, your browser or device, your chosen sign-in or Calendar provider, and payment or Wallet providers as needed for the feature you use. Free-text fields and uploads may contain information about other people; please share only what is necessary and tell those people where appropriate.

An email address and authentication details are needed to create and secure an account. Delivery and payment details are needed for a purchase. A visitor can view a public profile without supplying a name or contact details; an email address or phone number is needed only if the chosen contact or booking feature asks for it. Portraits, biographies, social links, AI chat, Calendar connection and Wallet passes are optional. Without optional information, the relevant feature may be unavailable or less useful.

3. Why we use data

We use account, profile, guest, purchase and requested Calendar connection data to provide the service or take steps requested before a purchase. For an individual customer, this is necessary for our contract or requested pre-contract steps. For Team members whose organisation is our customer, we use membership and role information to administer access and deliver that organisation’s service; our basis for our own administration is our legitimate interest in operating the service.

We process customer-managed contacts, leads, AI conversations, network-card scans and bookings to provide the features requested by the customer or visitor. The customer decides its purpose and lawful basis for collecting and using those records; when we act on its instructions, we do not substitute a separate basis for that customer purpose. We rely on our legitimate interests in support, service reliability and preventing misuse for our own limited operational processing.

We use order and payment information to fulfil purchases and manage subscriptions under contract, and retain invoices and related records where legal obligations require it. Our legitimate interests also include resolving disputes and preventing fraud. We process technical logs and rate-control information to secure the service and investigate faults on the basis of those security interests.

Profile analytics show owners how visitors use their profiles; platform analytics help us operate and improve the service. Section 7 describes the tracking that currently occurs. We do not treat a contact submission or Calendar authorisation as agreement to unrelated analytics. You may object to processing based on our legitimate interests by contacting us. If we ask for consent for a distinct optional use, you may withdraw it for future use.

4. Public profiles and sharing

A published profile and the contact details, portrait, links, portfolio and media its owner chooses to publish can be viewed by anyone with its link and may be found by search engines or copied by visitors. Profile owners should review visibility before publishing and should not upload information they do not have permission to share. A visitor’s lead or booking submission is delivered to the relevant profile owner and authorised Team members; it is not displayed as public profile content.

5. Google sign-in and Calendar

Google sign-in, if you choose it, is separate from connecting Google Calendar. For Calendar connection we request openid and email to identify the connecting account, plus calendar.calendarlist.readonly to list calendars, calendar.freebusy to check availability, and calendar.events to view and create events. The last permission allows access to events across calendars available to the account, although the booking feature uses the calendar you select.

We store the connected Google account email, selected calendar and settings, granted scopes, and encrypted access and refresh tokens. Human access to Google-derived data is restricted to specific assistance for which the user has given affirmative permission, necessary security investigations, or legal obligations. Exceptional access requires approval, is limited to the necessary information and duration, and is recorded. Routine staff profile-preparation tools do not expose connected account details, live calendar lists or booking settings. We request free/busy information for the selected calendar to offer available times. When a booking is confirmed, we create an event there with its time, title and description; a visitor’s email is included as an attendee when supplied, and a Google Meet link may be requested if the owner enabled it. We store the booking and event identifiers and relevant links. Calendar credentials and free/busy results are handled by the booking service and are not sent in prompts to our AI provider.

The profile owner can disconnect Calendar in the service. This deletes the stored connection and tokens, but does not automatically delete events already created in Google Calendar or revoke the grant in Google’s account settings. The owner can revoke the grant through Google. After revocation, Calendar use requires reconnection; the connection record may remain until disconnection or an authorised deletion request. You can ask us to delete stored Calendar information at [email protected], subject to records we must retain. We use data received from Google APIs to provide the connected Calendar and booking features, and for necessary security or legal purposes. We do not use it for advertising or send Calendar data to advertising platforms. 3693 Cards’ use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

6. AI processing

When you use the public assistant, lead assessment or business-card scanning, relevant messages, published profile context, enquiry and contact details, or card images are sent to OpenAI to generate a reply, assessment or extracted contact fields. Our API project has no regional-residency restriction and uses standard retention. Our application requests that Responses API results are not stored for later retrieval by that API, but OpenAI may keep separate abuse-monitoring logs for up to 30 days, subject to its stated legal and safety exceptions. That request is not a zero-retention setting.

Lead assessments produce a score, categories and a summary for the profile owner. They help the owner review enquiries; the service does not use the score to make a decision with legal or similarly significant effects on a visitor. The assistant may suggest a lead or booking action, which the visitor must complete through the service. Owners remain responsible for their decisions about contacts and leads.

7. Cookies, browser storage and analytics

We use session and guest-claim cookies for login and requested trial features. The website also uses browser storage for a cart, selected workspace and temporary chat or editor drafts. These support features you request; clearing browser data may sign you out or remove local drafts and cart contents.

On published profiles, analytics creates or reads a persistent identifier in your browser before asking for a separate analytics preference. It records visits, referral source, active time and interactions such as contact, link and booking-entry clicks. Server-side records include a visit identifier, referrer hostname, source, inferred country if location lookup is configured, and an IP-derived hash used for rate control. Profile owners can see reports for their permitted profiles. There is currently no in-product analytics preference control. You can clear or block browser storage and contact us to object to our use of your data; clearing storage does not erase records already held by us.

8. Recipients and international processing

We share relevant data with the profile owner and authorised Team members, and with staff who need it for support, security or administration. The service uses Render for application and database hosting, Cloudflare for routing and media storage, Stripe for payments, Resend for service email, and OpenAI for AI features. Google and Apple receive data when you choose their sign-in, Calendar or Wallet features. Google also receives address-search and map requests when the location tools are used. External sites linked from a profile handle data under their own terms.

Our application and database hosting are configured in Frankfurt, and our media storage bucket is configured for Cloudflare’s EU jurisdiction. These settings do not keep all provider processing, network traffic, support access or payment and email operations in Europe. Resend stores service-email content and delivery data in the United States, even though our sending domain is configured to send from Tokyo. Our OpenAI API project has no regional-residency restriction. We use Render, Cloudflare, Resend and OpenAI under their standard online terms, which incorporate data-processing terms for relevant personal data. Those terms describe European Commission standard contractual clauses, a UK addendum or applicable adequacy arrangements for restricted transfers, depending on the provider and transfer. The United Kingdom currently benefits from an EU adequacy decision for transfers from the European Economic Area. The route for any particular transfer depends on the provider’s role, destination and applicable terms; we do not claim that one measure covers every transfer or that all processing stays in Europe. Contact us at [email protected] for information about a particular transfer and available safeguard documents.

9. Retention and deletion

We keep accounts and Team memberships while needed to provide access and manage active profiles, purchases and requests. An authorised profile deletion removes the live profile and related records subject to the financial and other exceptions below; deleting a profile does not by itself close the customer account or erase every copy of its media. On account closure, we check outstanding subscriptions, orders, Team authority, requests and legal obligations, provide available records for export where appropriate, and assess which live account and profile data can be deleted. We coordinate customer-managed records with the relevant customer where necessary. We do not currently offer one automatic account-closure and return-or-deletion process, or a fixed inactivity purge. Guest drafts and published trials have limited access periods, but expiry of access does not mean every stored copy has been erased.

Calendar connection details and tokens are removed when the owner disconnects. Wallet passes and Apple device registrations may remain after a card or profile changes so that retirement updates can be delivered. A device can unregister a pass; invalid push registrations can also be removed. There is not yet a fixed automatic purge of all pass and registration records after deactivation. Ask us to review their deletion when they are no longer needed for pass updates, legal obligations or a documented request.

Customers keep network contacts, leads, bookings and associated conversations while needed for their legitimate business purposes, subject to earlier authorised deletion and applicable rights. Customers should review that need at least yearly; the service does not currently provide an automatic review or a fixed expiry for those records. A conversation linked to a lead or booking may remain with that record. When its final lead or booking link is removed, the conversation should also be deleted unless a justified exception applies. Current production does not ensure that automatically in every case; contact us to arrange a linked-record deletion. We do not currently automatically delete unlinked AI conversations after 30 days of inactivity. There is no current self-service booking deletion option that also offers a choice about cancelling a Google event.

Analytics visits, support messages, security logs and audit records are kept for their operational purposes; fixed deletion periods have not been set for all of these records. We retain invoices, orders, refunds, promotions and partner-attribution records separately where needed for accounting, tax, disputes, fraud prevention or other legal requirements, even if a profile is deleted.

Profile deletion removes some live records, but externally stored media may require additional action. Recoverable backups include a three-day point-in-time database recovery window and separately managed downloaded backups that can last longer. Earlier copies may remain after live deletion, and restored data is not yet automatically checked against every past erasure request. We cannot promise immediate erasure from every backup or provider; we assess requests, exceptions and follow-up actions individually.

10. Your rights and requests

Depending on the law, our role and the reason for processing, you may request access, correction, erasure, restriction or a portable copy of your data, or object to particular uses. Where we rely on consent, you may withdraw it for future processing. These rights have limits, including retention required by law or needed for legal claims. Account and profile tools support some corrections and deletions; authorised owners can export certain lead and booking records, but there is no single self-service route for every request.

You have the right to object to processing based on our legitimate interests. Send a request to [email protected]. We may need to verify your identity or Team authority and, for customer-managed data, coordinate with the relevant customer. We normally respond within one month where UK or EU data protection law applies; the law allows a notified extension for complex or numerous requests. You may complain to the UK Information Commissioner’s Office at ico.org.uk, or to another competent supervisory authority where applicable.

11. Children and changes

3693 Cards is a business-profile service and is not designed to collect children’s information. If you believe a child’s information has been submitted or published, contact us so we can review it.

We may update this policy when the service or our practices change. We will update the date above and provide additional notice where a material change requires it. For privacy questions, write to [email protected].