Dieses Dokument gibt es auf Englisch (verbindlich) und Niederländisch. English · Nederlands
We collect as little as possible. Cards set no cookies and we don't store visitors' IP addresses. Here's exactly what we do. This English text is the binding version.
1. Who is responsible and which law applies
The controller of your data is MP Agency, which manages and operates heresmine. Registered in Dubai, United Arab Emirates. Address: to follow after registration. Trade licence: to follow after registration. Email: info@heresmine.app.
Because we're based in the UAE, the UAE data protection law is our home law: Federal Decree-Law No. 45 of 2021 (PDPL). If you live in the EU, the GDPR applies as well; if you live in the UK, the UK GDPR. We follow all three, and you always get the rights of the law that applies to you.
We haven't appointed a representative in the EU (Article 27 GDPR) yet. Once we have, their name and address go here. Until then you can reach us directly about everything. We haven't appointed a representative in the UK (Article 27 UK GDPR) yet either.
For the contacts that come in through a card and for a card's statistics, the owner of that card is the controller. Section 4 covers that.
2. What data
From customers: name, email address, phone number, company, billing address, VAT number if you give one, the delivery address for NFC cards and what you put on your card, such as photo and logo. Payment details go straight to Stripe; we never see card numbers.
When you sign in: your email address. Supabase, our sign-in system, keeps sign-in logs with your IP address to keep signing in secure.
In the heresmine app: your email address and your sign-in session (kept on your phone), what you change on your card, such as texts and the photos you pick, the name, email address and job title of colleagues you invite as a team admin, and your phone's time zone, to count your statistics per day. The app has no analytics, no advertising and doesn't track you.
When you invite friends: your invite code, who ordered through your link, whether that order was paid and the credit you got for it. Whoever opens your link sees your first name; you only see how many friends ordered, not who.
From card visitors we store, per view: date and time, how they arrived (QR, NFC, link or Wallet), country and city, the type of device (phone, tablet or computer) with its operating system, and which button they tapped. Country and city come from the network, so they're not precise. We set no cookies, store no IP address and give visitors no ID.
From people who leave their details on a card: what they fill in (name, email, phone, company, note) and when they gave consent.
From people who use our contact form: what they fill in.
To prevent abuse, forms count how many requests come from one network address. We only keep that address pseudonymised, as a salted hash, and we delete those counters within one day.
From visitors of this website: to show prices in your own currency, your browser asks our host Vercel which country the connection comes from. Only the country code comes back. We don't store it or link it to anyone.
3. Why, and on what basis
To deliver your order and make your account and card work: performance of the contract. The same goes for the discount and the credit when you order through an invite or invite friends yourself.
To prevent abuse, secure signing in and keep the site reliable: our legitimate interest.
To show the card owner statistics without tracking visitors: the card owner's legitimate interest.
To pass the details you leave on a card to its owner: your consent. You can withdraw it at any time.
To answer your question through the contact form: our legitimate interest, or steps before a contract.
To keep our records and pay tax: a legal obligation.
Under the UAE PDPL the same grounds apply: the contract, a legal obligation, your consent, and our interest where the law allows it. We don't sell your data and don't use it for advertising or profiling.
4. Swapping contacts on a card
If you leave your details on a card, the owner of that card is the controller of those details. For a card on the Teams plan, that's the company. heresmine stores them on their behalf and emails the owner your details. For a card's statistics we also work on the owner's behalf. The arrangements for that are in our data processing agreement.
In a team on the Teams plan, the team's admins can see the contacts of every card in that team.
Want your details deleted? Ask the card owner, or email us at info@heresmine.app and we'll take care of it.
5. How long
Your account: until you delete it. You can do that yourself in Dashboard → Settings or in the app under Settings → Delete your account. Your account, cards, contacts, statistics and photos are then deleted straight away.
Orders and invoices: as long as tax law requires, at least five years. This also applies if you delete your account.
Orders that aren't paid, with the photos you uploaded for them: we delete them once the payment link expires, usually within a day, and after seven days at the latest.
Cards paused because the subscription ended: we delete them six months after the pause, together with their contacts and statistics.
Card statistics: 24 months.
Contacts left on a card: until the card owner deletes them, the account is deleted or the card is removed after a pause.
Accounts made in the app but never used (never signed in, no card): deleted after seven days.
Contact form messages: twelve months. Abuse counters: less than a day.
Stripe payment notifications: we keep only their reference, for 90 days, to recognise a duplicate delivery. It holds no personal data.
Vercel's request logs and Supabase's sign-in logs are kept for a short time, under those providers' own retention periods.
7. Where your data goes
Our database is in Frankfurt, in the EU. MP Agency is based in Dubai and works with the data from there: whoever handles support or admin for us opens it from the UAE. NFC cards for addresses in the EU are made in Europe, all others in Dubai.
If you live in the EU or the UK, this means your data ends up with a company outside the EU and the UK. The UAE has no adequacy decision from the European Commission or from the UK. The GDPR and the UK GDPR still apply to us directly, because we offer our service in the EU and the UK, and you keep every right in section 9.
If you're a customer in the EU or the UK and we process the contacts and statistics of your card on your behalf, the European Commission's standard contractual clauses (Decision 2021/914, module two) and the UK International Data Transfer Addendum form part of our data processing agreement.
Our US processors Vercel, Resend and Stripe are covered by the EU-US Data Privacy Framework, with its UK extension, or by the standard contractual clauses built into their data processing agreements.
Under the UAE PDPL, data may only leave the UAE with appropriate safeguards. We put those in place contractually with each party above; the UAE Data Office hasn't yet published a list of approved countries or model clauses of its own.
8. Security
All connections are encrypted. In the database each customer can only reach their own data. Only staff who need it for their work can access the admin, and every action there checks that again. If we discover a data breach that affects you, we report it to the supervisory authority and to you as the law requires; card owners hear from us within 48 hours of discovery.
9. Your rights
You can access your data, have it corrected or deleted, restrict or object to its processing, take it with you, and object to a decision made only by a computer (we don't make those). Where you gave consent, you can withdraw it at any time. You have these rights under the PDPL, the GDPR and the UK GDPR.
A lot of it you can do yourself: download your data as a file and delete your account in Dashboard → Settings or in the app, and export your contacts as CSV in your dashboard.
For everything else, email us at info@heresmine.app. We reply within a month and may first ask you to prove who you are. It's free.
If you disagree with how we handle your data, you can complain: in the UAE to the UAE Data Office, in the EU to the supervisory authority of your country (in the Netherlands the Autoriteit Persoonsgegevens) and in the UK to the ICO. Prefer to come to us first? You always can.
10. Children
heresmine isn't meant for children. Only people aged 18 or over can order. If you're under 16, don't leave your details on a card. If we notice we hold a child's data, we delete it.
12. Changes
If something important changes, we update this policy and tell customers by email. The version and date are at the top.