Privacy Policy

Last updated: May 27, 2026

We respect your privacy. This document explains what data we collect, why, and your rights over it.

1. Who we are

EVISITA is a digital business card platform. Data controller contact: evisita@espinita.com

2. Data we collect

Account data: Name, email, hashed password. Google profile data if you sign in with Google.

Business card data: Name, title, company, phone, bio, photos, social links, and custom fields you enter.

Payment data: Processed by Stripe. We store a Stripe customer ID and subscription status only. We never store card numbers.

Analytics: Anonymous visitor counts per card. IP addresses are stored as one-way SHA-256 hashes — they cannot be reversed.

Log data: Standard server logs for security, retained 30 days.

3. How we use your data

Provide and improve the EVISITA service
Process payments and manage subscriptions
Send transactional emails (receipts, resets, invites)
Show analytics on your dashboard
Detect and prevent fraud
Comply with legal obligations

We do not use your data for advertising and we do not sell your personal data.

4. Legal basis (GDPR)

Contract performance — providing the service
Legitimate interest — security and fraud prevention
Consent — optional marketing (withdraw anytime)
Legal obligation — compliance with law

5. Data sharing

Stripe — payment processing
Cloudinary — image and video hosting
Vercel — hosting and infrastructure

All processors are bound by data processing agreements. No data is shared with advertisers.

6. Data retention

Data is retained while your account is active. When you delete your account, all personal data is removed within 30 days including cards, templates, payment history, and uploaded media.

7. Your rights

Access — request a copy of your data
Correction — update data in account settings
Deletion — delete your account from Settings or email us
Portability — request data in machine-readable format
Objection / Restriction — contact us to exercise these rights

Email evisita@espinita.com to exercise any right. We respond within 30 days.

8. Cookies

We use only strictly necessary cookies: a session authentication cookie and an onboarding status cookie. No advertising or tracking cookies. See our Cookie Policy.

9. Security

We use HTTPS/TLS, bcrypt password hashing, and access controls. No system is completely secure — please use a strong password.

10. Children

EVISITA is not directed at children under 16. Contact us if you believe we have collected data from a child.

11. Changes

We may update this policy. We'll notify you by email for material changes.

12. Contact

Questions: evisita@espinita.com
EU/UK users may lodge a complaint with their local data protection authority.