This Privacy Policy explains what personal information Castle Crew collects, how we use it,
and the choices you have. It covers the Castle Crew website, the digital card platform, and
related products (the "Services").
1. Information we collect
- Account information — name, email, password (stored hashed), and, if you sign in with Google, your Google account identifier and verified email.
- Card content — everything you add to a card: job title, company, photos, links, social handles, and any custom sections.
- Analytics events — when a public card is viewed, saved to contacts, exchanged, or a phone/link is tapped, we record the event with a timestamp and coarse metadata. We do not build advertising profiles.
- Contact-exchange data — if a visitor chooses to send their details back through your card, we pass that information to you as a lead.
- Order information — for physical cards and paid plans: billing details, shipping address, and order history.
- Device and log data — IP address, browser type, and pages requested, used for security and troubleshooting.
- Local storage — we use your browser's local storage to keep you signed in and remember preferences such as a card's light/dark choice. This stays on your device.
2. How we use information
- To operate the Services — render your public card, generate its QR code and wallet pass, and deliver leads to you.
- To provide analytics about how your cards perform.
- To process orders, payments, and subscription renewals.
- To secure the Services, prevent abuse, and debug problems.
- To send service messages (for example password resets, receipts, and important changes). Marketing email, if any, is opt-in and you can unsubscribe.
3. How information is shared
We do not sell your personal information. We share it only with:
- Service providers — hosting and edge infrastructure, database and file storage, and transactional email delivery, acting on our instructions.
- Google — only if you choose "Continue with Google", to verify your identity.
- The card owner — if you submit your details through someone's card, they receive them.
- Legal and safety — where required by law or to protect rights, safety, and the integrity of the Services.
- Business transfers — as part of a merger, acquisition, or asset sale, subject to this Policy.
4. Retention
We keep account and card data for as long as your account is active. If you delete a card or
your account, we remove the public content promptly and delete or anonymise the remaining
data after a reasonable period, except where we must keep records (for example, tax and
billing records).
5. Your rights
Depending on where you live, you may have the right to access, correct, export, or delete
your personal information, and to object to or restrict certain processing. You can edit most
data from your dashboard, or contact us to make a request. We will not discriminate against
you for exercising these rights.
6. Security
Passwords are stored using salted PBKDF2 hashing. Traffic is encrypted in transit. Access to
production data is limited to staff who need it. No system is perfectly secure, so we cannot
guarantee absolute security.
7. International transfers
Our providers may process data in countries other than yours. Where required, we rely on
appropriate safeguards for those transfers.
8. Children
The Services are not directed to children under 16, and we do not knowingly collect their
personal information.
9. Changes to this Policy
We may update this Policy from time to time. If a change is material we will give notice
through the Services or by email. The "last updated" date above shows the current version.
10. Contact
Questions or requests? Email [email protected]
or use our contact page.