Privacy Policy

1. Introduction

Cardia (“we,” “us,” “our”) is operated by JNAB Tech Solution. We are committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your information when you use our digital business card platform.

This policy describes the information Cardia uses to provide the service. It is not a certification of regulatory compliance; please contact us with privacy questions or requests.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, phone number, password
• Profile Information: Professional headline, bio, job title, company, skills, social media links, profile photo
• Order Information: Delivery address, city, payment details (processed securely via Paystack)
• Custom Branding Requests: Company name, logo, brand colors, custom text
• Lead Capture Data: Contact information shared by visitors who tap your card

2.2 Information Collected Automatically

• Usage Data: Profile views, link clicks, tap analytics
• Device Information: IP address, browser type, device type, operating system
• Location Data: City-level location derived from IP address (for analytics)
• Browser storage: Authentication tokens used to keep you signed in. Cardia does not use these tokens as advertising cookies.

3. How We Use Your Information

We use your personal data for the following purposes:

• To create and manage your Cardia account and profile
• To process and fulfill your orders for NFC cards
• To provide analytics on how your digital business card is performing
• To send order confirmations, shipping updates, and account notifications
• To notify you when someone shares their contact details via your profile
• To improve our services and develop new features
• To prevent fraud and ensure platform security
• To comply with legal obligations under Ghanaian law

4. Legal Basis for Processing (Ghana DPA)

Under the Ghana Data Protection Act, we process your data based on:

• Providing the service: Account, profile, and order information is used to provide the features or purchases you request.
• Service operation and safety: Some information is used to protect accounts, prevent abuse, and maintain the platform.
• Legal requirements: We may retain or use information where required for legal, tax, or accounting obligations.
• Where applicable law requires consent for a particular use, we will request it before that use.

5. How We Share Your Information

We do not sell your personal data. We may share your information with:

• Service Providers: Paystack (payment processing), Resend (email delivery), Cloudinary (image hosting), Railway/Vercel (hosting)
• Shipping Partners: Courier companies for order delivery (name, phone, address only)
• Legal Authorities: When required by Ghanaian law or court order
• Business Transfers: In the event of a merger, acquisition, or sale of assets

6. Public Profile Information

Information you add to your Cardia profile (name, photo, bio, links, social media) is publicly accessible to anyone who taps your NFC card or visits your profile URL. Do not include sensitive personal information in your public profile.

7. Data Retention

We retain personal data for as long as it is needed to provide the service, manage accounts and orders, address support requests, and meet legal obligations. Retention periods can vary by data type.

• Account and profile information may be kept while an account is active.
• Order and payment records may be retained for accounting, dispute, or legal purposes.

Contact us to request access, correction, or deletion. We will review the request and explain any information we must retain.

8. Your Rights Under Ghana DPA

Depending on applicable law and the circumstances, you may be able to:

• Request access to or correction of personal information.
• Request deletion or object to certain processing, subject to legal obligations and other applicable exceptions.
• Withdraw consent where processing is based on consent.

To exercise any of these rights, contact us at privacy@cardia.me

9. Data Security

Production connections to Cardia use HTTPS, and passwords are handled by Django’s authentication system. Paystack processes online payment details; Cardia stores order details, payment status, and transaction references, but does not store card numbers or security codes. No internet service can guarantee absolute security.

10. Children's Privacy

Cardia is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have collected data from a child, contact us immediately.

11. International Data Transfers

Some service providers may process or store information outside Ghana. Contact us if you would like more information about the providers relevant to your account or order.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through a notice on our platform. Continued use of Cardia after changes indicates acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or how we handle your data, contact us:

Data Protection Commission (Ghana):
If you believe your data protection rights have been violated, you may file a complaint with the Ghana Data Protection Commission at www.dataprotection.org.gh