Digital Card Privacy Notice

Public business cards

Business card details and artwork published by authorised staff are visible to visitors. These may include names, job titles, business contact details, photographs, company information, addresses, and namecard images.

Staff accounts

The workspace stores staff email addresses, password hashes, account permissions, assigned cards, sessions, and activity records. Passwords are stored as hashes rather than readable passwords. Session records may include an IP address and browser information to support account security.

Staff details and security records support sign-in, access control, card management, and investigation of problems or misuse. They are not displayed on public cards unless an authorised staff member publishes them there.

Gmail connection

The workspace owner can connect a Gmail account to send account invitations and password-reset emails. The connection requests permission to send email and to confirm the connected account’s email identity. It does not request permission to read the Gmail inbox.

The website stores the sender email and an encrypted authorization token. Credentials remain on the server. Google processes the recipient address and message when an account email is sent. Sent messages may remain in the connected Gmail account under that account’s settings.

Google account information is used for the account-email feature and its security. The application does not use it for advertising, sale, or training AI models. Its use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements:

Google API Services User Data Policy

The owner can revoke the connection through their Google Account’s third-party app settings.

Hosting, retention, and requests

Cloudflare hosts the website and stores application records and uploaded card artwork. Google supplies Gmail email delivery. These providers process information needed to provide those services.

Workspace records remain stored until removed by the operator. Administrators can revoke staff access and deactivate public cards. Session and password-reset links expire according to their configured lifetimes; expiration does not necessarily delete every related record immediately.

For questions, corrections, or a request to remove information, contact Chin Chun Group at Sales@chinchun.my. The operator may need to verify the requester’s identity and authority before acting.