Privacy notice
TapShareCard makes private digital business cards. This notice explains what personal data we handle, why, for how long, and what you can do about it, in line with the Data Privacy Act of 2012 (Republic Act No. 10173).
1. Who is responsible
The Personal Information Controller is vHive Solutions (Philippines), which operates TapShareCard. Our Data Protection Officer: welcome@manilaopenhouse.com.
2. What we collect, and why
Cardholders and customers
- Card content you give us: name, job title, company, photo, phone, email, website, address, social links, short bio, opening hours, gallery photos. This is what appears on your card page and in your downloadable contact file, so only provide what you want people to see.
- Account and order details: your name, mobile number, email, company, delivery address, TIN where an official receipt needs it, order and payment records (including proof-of-payment images you upload), and sign-in data (a hashed password and short-lived one-time codes; we never store passwords in readable form).
- Messages you send us through the forms or the customer portal.
- Why: to make, deliver and run your card (contract), to bill and keep records (legal obligation), to reply to you and to notify you about renewals (contract and legitimate interest).
People who open a card (visitors)
See “How taps are counted” below. In short: anonymous counts, no cookies, no raw IP address stored.
People who leave their details for a cardholder (“exchange contact”)
Some Premium and Team cards offer a form where a visitor can share their own name and phone or email. It is optional and appears with a consent checkbox. We keep what you enter for the cardholder only; the cardholder can see and delete it, and so can you by asking us. We do not use it for our own marketing.
3. How taps are counted (visitor analytics)
- No cookies, no local storage, no tracking scripts on card pages and on this website's public pages. Because of that there is no cookie banner. (Signing in to the customer portal or admin area sets one session cookie that is needed to keep you signed in.)
- Your IP address is used transiently and is never stored in our database or application logs. When a card is opened, the IP address and browser string are used in memory for a moment to (a) look up the country only (no city, no region) and (b) compute a one-way daily-salted hash; they are then discarded.
- The hash is SHA-256 over a secret salt + IP + browser string. The salt is a random 32-byte value that is replaced every day at midnight Manila time, and the previous day's salt is deleted. After that the hash cannot be reversed or matched to the same person on another day. We use it only to count how many different visitors a card had that day.
- What an event records: which card and link, the kind of event (view, contact saved, link clicked, share, QR shown), the time (and Manila hour), the visitor hash, device type, operating system and browser family only (for example “iPhone, iOS, Safari”), the 2-letter country, and, for shared links only, the website domain you came from (not the full address).
- Search and link-preview robots are not counted as visitors; when a chat app fetches the link preview we record only that a preview was fetched, with no visitor hash and no country.
- Retention: raw events are deleted after 90 days. Daily totals (numbers only, no hashes) are kept so cardholders can see trends. Cardholders see totals only; our administrators can see the raw hashed events for support and security.
- Server logs: like every website, our web server keeps a standard access log, which does contain IP addresses, for security and troubleshooting. It is rotated and deleted after 14 days.
- Abuse protection: to limit spam and password guessing we keep a keyed, one-way hash of an IP address in short-lived rate-limit and sign-in-attempt records; the address itself is not stored.
- Each card page carries a one-line notice: “Taps are counted anonymously. No cookies for ads.”
4. Link previews
When someone pastes a card link into a chat app, the app may fetch a preview picture. By default this shows the cardholder's name, title and photo. A cardholder can switch their card to a minimal preview (logo only) in their portal.
5. Who we share data with
We do not sell personal data. We use service providers to run the service: our hosting provider; our SMS and email delivery services (to send one-time codes, order updates and renewal reminders); our internal customer records system; and, if you choose “Sign in with Google”, Google (which tells us only your verified name and email). Printers and couriers receive only what is needed to produce and deliver your physical card. We disclose data to authorities only when the law requires it.
6. How long we keep data
- Card content: while your card is active and for a short period afterwards so you can renew; deleted or anonymised on request or when an account is closed.
- Order, payment and billing records: kept for 10 years from the last entry, as Philippine tax record-keeping rules require.
- Visitor events: 90 days (raw); daily totals indefinitely. Web server logs: 14 days.
7. Your rights
Under the Data Privacy Act you have the right to be informed; to access the personal data we hold about you; to object; to correct it; to have it erased or blocked; to data portability; to withdraw consent; and to claim damages where the law allows. Cardholders can edit most details directly in the customer portal. For anything else, write to our DPO at welcome@manilaopenhouse.com and we will reply within a reasonable time.
If you believe your rights were violated and we could not resolve it, you may file a complaint with the National Privacy Commission of the Philippines: privacy.gov.ph.
8. Security
Card links are long random addresses that cannot be guessed; card pages are not listed in search engines or in our sitemap. Connections use HTTPS, passwords are hashed, access to administration is role-based, and uploads are checked and re-encoded. No online system is perfectly secure; if a breach affects you we will notify you and the National Privacy Commission as the law requires.
9. Children
TapShareCard is meant for adults and businesses and is not directed at children.
10. Changes
We will update this page when our practices change and show the new date at the top.