Privacy policy

Last updated: 04.09.2026

In short: wcard.ch never sells any data, shows no advertising, and installs no advertising trackers. The only data kept is what's needed to run your card, and you can delete everything at any time.

Who is responsible for processing

The data controller is the site publisher, identified in the legal notice. For any question about your data, write to info@wcard.ch or use the contact form.

What your card publishes

This is the most important point on this page. A published card is public: anyone with the link (wcard.ch/c/your-name or its short version) can view it, and search engines can index it.

The information you put there — name, job title, company, phone numbers, professional e-mail, website, address, bio, photo, logo, links — becomes publicly accessible. Only put what you would accept to see on a paper business card handed out to strangers. In particular, a private address or personal number has no place there.

You can unpublish your card at any time from your dashboard: it then stops being accessible and disappears from the sitemap. Search engines may however keep a cached copy for some time, over which we have no control.

Data processed and reasons why

Account

E-mail address and password, necessary to identify you and let you edit your card. The password is never stored in plain text: only a cryptographic hash is kept, from which your password cannot be deduced. We are therefore unable to give it back to you, only to let you choose a new one.

If forgotten, a reset token valid for one hour is stored as a hash, then deleted after use.

Business card

The professional information you enter, the images you upload, your card's address, and a view counter. This counter is a simple total number: no individual visit trace is kept, and indexing bots are excluded.

Protection against bots

At signup, login, password request and when the contact form is submitted, the site records the date of the attempt, its result, and a hash of your IP address — not the address itself. This hash is computed with a secret key unique to the site: it allows counting attempts from the same visitor without ever allowing their address to be recovered.

Without this safeguard, bots would create thousands of accounts and the forgot-password form could be used to flood a third party's inbox. These records are automatically deleted after 30 days.

Print order

Only if you order paper cards: name, delivery address, e-mail and phone number, as well as order details and tracking. The phone number is only used by the carrier for delivery.

This data is kept for ten years, in accordance with the legal obligation to retain accounting records (art. 958f of the Swiss Code of Obligations). It therefore cannot be deleted on request before this period, even if you delete your account.

What we don't do

• No selling, renting, or exchanging of data with third parties.
• No advertising, no advertising profiling.
• No third-party audience measurement tool: no Google Analytics or equivalent.
• No embedded social network: the links you add are plain links, without tracking buttons.
• No automated decision producing legal effects on you.

Cookies

The site sets a single session cookie, strictly necessary to keep you logged in and to protect forms against request forgery. It serves no tracking purpose and disappears when the browser closes. No consent is required for this type of cookie.

If you click a link to a partner printer, that printer may set its own cookies on its domain, according to its own policy.

Recipients and subcontractors

Data is only shared with providers necessary for the service:

• Hostinger (hosting and e-mail, servers in the European Union): hosts the site, the database and outgoing e-mails.
• Cloudprinter.com (Netherlands), only in case of a print order: receives the print file and the delivery address, which it forwards to the print shop handling production.
• Google Fonts: the site's fonts are loaded from Google's servers, which therefore receives your IP address when a page is displayed. No other data is shared with it and no cookie is set on this occasion.

Some of these providers may process data outside Switzerland. Transfers to the European Union benefit from a level of protection recognised as adequate by the Federal Council. For the United States, the transfer relies on the contractual guarantees of the relevant provider.

Retention period

• Account and card: for as long as the account exists, then deleted upon its removal.
• Anti-bot attempts: 30 days.
• Print orders: ten years (accounting obligation).
• Technical error logs: a few weeks, for troubleshooting purposes.

Your rights

In accordance with the Federal Act on Data Protection, and the GDPR if you reside in the European Union, you may request access to your data, its rectification, its erasure, the restriction of its processing, or object to processing. You may also request to receive your data in a machine-readable format.

In practice, most of this can be done without us: your personal dashboard lets you edit or delete your information, unpublish your card, and download it as a vCard. For anything else, write to info@wcard.ch; we reply within 30 days.

If our response does not satisfy you, you may contact the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, or the supervisory authority of your country of residence within the European Union.

Security

The site is served exclusively over HTTPS, passwords are hashed, database queries are prepared to prevent injections, forms are protected against request forgery, and access to sensitive forms is rate-limited.

No system being infallible, should a data breach likely to pose a high risk to you occur, you would be informed of it and the FDPIC would be notified.

Changes

This policy may evolve along with the service. The update date appears at the top of the page; in case of a substantial change, registered users are informed by e-mail.