Privacy Policy

• Business users: the owners and staff of businesses that use Cardira.
• Their customers who use the Cardira customer portal.
• Visitors to a business's Cardira booking pages and intake forms.

• Account details: name, email address, password (stored only in hashed form), and the business you belong to.
• Business records: the information a business enters about its customers, such as contacts, properties, jobs, quotes, invoices, appointments, notes, files and messages.
• Payment details: card and bank details are handled by Stripe. Cardira never receives or stores full card numbers. We keep a record of each payment, such as its amount, date and status.
• Calendar data: when you connect Google Calendar, the calendar events and busy times described in the Google user data section below.
• Usage and device data: pages visited, actions taken, browser type, IP address and error logs, used to run, secure and fix the service.
• Cookies: Cardira uses cookies only to keep you signed in. We do not use advertising or tracking cookies.

We use information to provide and run Cardira: to show a business its records, send the quotes, invoices, reminders and appointment notices the business asks us to send, take payments, keep accounts secure, answer support requests and improve the service. We do not sell personal information, and we do not use it for advertising.

Cardira asks for access to Google Calendar only when a business user or a portal customer chooses to connect it, and only with that person's permission on Google's consent screen. Cardira accesses calendar events only.

• Cardira uses this access only to create, update and remove appointment events in the connected calendar, and to read busy times so booking pages offer only open slots.
• Google user data is never sold and never used for advertising.
• Google user data is never shared with anyone except the service providers listed below, and only as needed to run this feature.
• Busy times are read when a booking page needs them and are not stored. When the connection is disconnected, Cardira revokes its access with Google and deletes the Google access tokens it stored for that account.

Cardira's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We use these companies to run Cardira. Each handles data only to provide its service to us:

• Supabase: database and sign-in.
• Vercel: hosting.
• Stripe: payments.
• Resend: email delivery.
• Google: calendar sync, when connected.

Business records are kept while the business's account is active. Business owners can delete records in Cardira at any time. To delete an account and its data, email support@cardira.io. A portal customer who wants their information removed can ask the business they work with, or email us.

Data is sent over encrypted connections. Access to each business's records is limited to that business's users, and stored connection tokens for outside services are encrypted. No system is perfectly secure, so we cannot guarantee that information will never be accessed without permission.

Cardira is not intended for anyone under 18, and we do not knowingly collect information from them.

Cardira's data is stored in the United States. If you use Cardira from outside the United States, your information is transferred to and processed there.

We may update this policy. When we do, we will change the effective date above, and for significant changes we will notify business users by email or in the app.

Questions about this policy: support@cardira.io.