Privacy policy

Abracarda displays a public page from an NFC card or a QR code. Three groups of people leave data there: the account holder who manages the page, the visitor who views it, and the customer who sends a private message to the business.

We resell no data, we display no advertising, and we use no advertising tracker and no third-party analytics cookie.

The data controller is ITHABIT (Entreprise individuelle), 17 rue Lefebvre, 68100 Mulhouse. Full contact details appear in the legal notice.

For data a visitor leaves with a business — a private message, a rating — that business is responsible for its use. Abracarda then acts only as a processor: we host the message and pass it on, and do nothing else with it.

On account creation: email address, name, and a password stored as an encrypted hash — never in plain text, and nobody here can read it.

Then, whatever the holder chooses to publish: page name, description, photo, logo, and depending on the modules enabled, phone, WhatsApp, email, address, social networks, Google review link. This information is public by nature: that is the very purpose of the product.

Each scan, view or click creates one statistics row for the page holder. It contains the event type, the button concerned, the country and the device type (mobile, tablet, desktop).

Neither the IP address nor the full user agent is stored. The IP address is used for the duration of the request only, solely to limit abusive submissions and verify the anti-robot check, then discarded without being written.

These statistics do not allow anyone to be identified, and no browsing profile is built from one visit to the next.

The private feedback form records the rating, the message and — if the person chooses to give them — their name, email and phone. These three fields are optional, and are kept only if the page holder has enabled the request for them.

This message is not published. It is visible only to the holder of the page concerned, in their dashboard, and may be forwarded to them by email if they have set that up. It exists to reply to the person, not to feed a mailing list.

The application and the database are hosted in the European Union, in Frankfurt.

• Fly.io — application hosting, Frankfurt region
• Neon — PostgreSQL database, Frankfurt region
• Cloudflare — storage of published images, and Turnstile for the anti-robot check on public forms
• Resend — sending the service's emails: password reset, notification of a new message
• Stripe — subscription payment and invoicing. Receives the account holder's email, name and billing address. Card details are entered at Stripe: they never pass through our servers and we have no access to them. No visitor to a public page is concerned.

Fonts are served from our own servers: no request is made to a third party when a public page loads.

A public page sets no tracking cookie. Two strictly functional cookies exist: the one that keeps a signed-in holder's session, and the one that remembers the language chosen in the switcher. Neither is used to measure an audience or to profile anyone.

Turnstile, the anti-robot check, only activates when the private message form is opened — never on simply viewing a page.

The data of an account and its pages is kept for as long as the account exists. On deletion, the associated pages, statistics and messages are deleted with it.

A private message can be deleted at any time by the page holder, from their dashboard.

Under European Regulation 2016/679 (GDPR) and the French « Informatique et Libertés » Act, you have rights of access, rectification, erasure, restriction, objection and portability over your data.

To exercise them, write to contact@abracarda.com. We reply within 30 days.

If your request concerns a message you left with a business, please say so: that message belongs to the business, and we will put them in touch with you.

If our answer does not satisfy you, you may lodge a complaint with the CNIL, the French supervisory authority — cnil.fr.