This Privacy Policy explains how Online Anytime (Online-Anytime) ("we", "us", "our") collects, uses, stores and discloses personal information through the Business Cards digital business card platform, which includes:
We call these "the Service" below. By creating an account, creating a card, or viewing a card through the Service, you agree to the collection and use of information as described here.
We're based in Australia, and this policy is written with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) in mind. If you access the Service from outside Australia, you may have additional rights — see "International users" below.
Account information. When you sign up you (or an administrator, on your behalf) provide a username — which may be an email address or mobile number — and a password. Passwords are never stored in plain text: they're one-way hashed and can't be reversed by us.
Card information. When you create or edit a card, you choose what to put on it. This can include your first and last name, job title, company, work and/or mobile phone number, a postal or business address, email address, website, and links to LinkedIn, X (Twitter) and Instagram. You can also upload a profile photo (JPG/PNG/WEBP, up to 3MB), which we automatically crop and resize for display. Only include information you're comfortable making public — see "How your card is shared" below.
API keys. If you generate a personal API key to connect the Service to a script, the mobile app, or another integration, we store only a one-way hash of that key — never the raw value.
Information from people who view your card. Viewing or scanning a public card doesn't require the visitor to create an account or submit any personal information. Our web server keeps standard technical logs (e.g. IP address, browser type, timestamp) for security and troubleshooting, as most web servers do; we don't otherwise track or profile people who view public card pages.
Mobile app permissions. The Business Cards mobile app may ask for the following device permissions, only for the purposes stated:
The Android build currently also declares a microphone permission because of a bundled software library; the app itself does not record, access, or transmit audio, and we intend to remove this declaration in a future update. We don't access your contacts, precise location, or any other data on your device beyond what's described above.
We use the information above to create and display your digital business card; generate your vCard (.vcf) download, QR code, and Apple/Google Wallet passes; operate accounts and control who can view or edit which card; provide the API used by scripts and the mobile app; and keep the Service secure and reliable (e.g. preventing abuse, debugging issues). We do not use your information for advertising, and we do not sell your personal information to anyone.
A card's public page is reachable by anyone who has the link or scans its QR code. It isn't listed or searchable anywhere, and the link uses a long, encrypted token rather than a guessable ID — but it isn't private or access-controlled once someone has it. Only put information on a card that you're happy for anyone with the link to see. Scanning the QR code on a public card reads that card's details (name, company, phone, email, address, website) directly from the code, so a visitor's device can save it as a contact without needing to open the page.
We use a small number of service providers to run the Service. Each only receives what it needs to do its job, and none of them may use it for their own purposes:
We may also disclose information if required by law, or to protect the rights, safety or property of Online Anytime, our users, or the public.
We keep your account and card data for as long as your account is active. If an administrator deletes your account, your cards are kept but unassigned rather than deleted, so they stay reachable at their existing public links until an administrator removes them. You can delete your own card(s) at any time from the dashboard, remove your profile photo, revoke your API key, or ask us to delete your account and its data entirely — see "Contact us" below.
The web application uses one functional session cookie to keep you signed in (marked HttpOnly and SameSite=Lax, so it can't be read by scripts or sent cross-site). We don't use advertising or cross-site tracking cookies.
We take reasonable steps to protect your information, including hashed passwords and hashed API keys, parameterized database queries, CSRF protection on every form, validating uploaded files by their real content type rather than just their file extension, and access checks that stop one user from viewing, editing or deleting another user's account or cards. No method of storage or transmission is completely secure, and we can't guarantee absolute security.
You can review and update your card and account details at any time while signed in. You can ask us to access, correct or delete the personal information we hold about you, or to explain how we've handled it, by contacting us below. We'll respond within a reasonable time.
The Service is intended for business use by adults and isn't directed at children. We do not knowingly collect personal information from children.
If you use the Service from the European Economic Area, the UK, California, or another jurisdiction with its own privacy law, you may have additional rights over your personal information — such as data portability, or the right to lodge a complaint with a local regulator — beyond those described here. Contact us and we'll do our best to assist.
We may update this Privacy Policy from time to time. If we make material changes, we'll update the "Last updated" date above. Continuing to use the Service after changes are posted means you accept the updated policy.
Questions about this policy, or requests about your personal information, can be sent to: insert a contact email, e.g. support@online-anytime.com.au.