No cookies on cards
Trust and security. In plain words.
What we do with the data behind your card, and what we deliberately leave out.
- Database in Frankfurt (EU)
When someone opens your card.
Everything that happens, and everything that doesn't.
Happens
- Your card opens in their browserNo app, no account, nothing to install.
- The visit counts in your statisticsWithout cookies and without a visitor ID.
Doesn't happen
- A cookie is setSo there's no banner to click away.
- Their IP address is storedOur limits against abuse use a hashed network address with a salt that changes daily, gone within a day.
- Trackers or ad pixels loadNo analytics from other companies, no advertising pixels.
- A request goes to GoogleFonts come from our own site.
- Their details are soldWhat they leave on your card goes to you and nobody else.
Where your data lives
Database and photos: Frankfurt, EU
Supabase hosts the database and the file storage in Frankfurt. Every customer only reaches their own rows.
Website and cards: Vercel
The site and the card pages are served by Vercel. Payments run on Stripe's own page; card numbers never touch our servers.
Email notifications: Resend
Login links and notifications are sent through Resend in the US, under the EU-US Data Privacy Framework or the standard contractual clauses.
The full list is in the processing agreement
Sub-processors, retention periods and your rights are written down there, not just here.
How we protect it
Encrypted connections
Everything runs over HTTPS with strict transport security. Browsers get a strict content security policy, and our pages can't be framed by other sites.
Every customer sealed off
Row level security in the database: a customer can only read and change their own card, contacts and statistics. Automated tests check these rules on every change.
One card per link
Visitors get one card per link and can never download the card list. A paused card shows no contact details.
Limits against abuse
Sign-in, contact swapping, the contact form, ordering, the brand scan and saving in the editor all have rate limits, shared across our servers.
Sign‑in without passwords
You sign in with an email link. Our server answers the same whether an address is known or not, so nobody can find out who is a customer.
Photos re‑encoded on the server
Uploads are read and re-encoded as plain images, without metadata. Photos of unpaid orders sit in a private bucket and are cleaned up when the payment link expires.
Reading your website safely
The brand scan only fetches public addresses, with a time and size limit, and checks the address again at the moment it connects.
Admin only for staff
The admin area is only open to accounts with the admin role and a code from an authenticator app (two-step verification). Every admin action checks both again on the server.
You stay in control
Export your contacts
Download all contacts as CSV from the dashboard, any time, for any CRM.
Delete your account yourself
Dashboard, Settings, delete. Your card, contacts and statistics are gone straight away.
Pause your card, choose search engines
Pause a card with one switch; a paused card shows no contact details. Decide yourself whether search engines may list it.
A processing agreement with every subscription
You are the controller of the details visitors leave; we are the processor. The agreement is public and applies to every plan.
Where we're honest
No SOC 2 or ISO 27001 report yet
We're a small service by MP Agency. We'd rather show you what we do than a badge we don't hold. Ask us anything on this page and we answer.
Our team works from outside the EU
The database is in the EU; the people who run heresmine work with it from outside the EU. The privacy policy explains the transfer basis.
Wallet passes depend on Apple and Google
The card page and the QR code always work, even if a Wallet pass can't be issued.
What happens when you stop.
You can cancel any time in your dashboard. This is what follows.
You cancel
Under Subscription in your dashboard. Your card keeps working until the end of the period you paid for, or of your free trial.
Your card pauses
Its page shows only your name. Your link, QR code and NFC card no longer show your details.
You can come back
Resume your subscription and the same card returns on the same link, with your QR code and NFC card.
After six months, it's deleted
Six months after the pause, the card goes, with its contacts and statistics. Download your contacts as CSV before then.