Privacy policy
Here we explain what personal data we process in eximius card, for what purpose, for how long and what you can do about it. We comply with Ecuador's Organic Law on Personal Data Protection.
Contents
1. Who processes your data
The data controller is Steven Miguel Pesantes Egas, a sole trader with tax ID (RUC) 0931233183001, based at Parque Empresarial Colón, Ecuador.
For any privacy matter or to exercise your rights: [email protected]
2. Your page is public
Everything you publish on your card — name, photo, job title, company, phone, email, address, links — is visible to anyone who has the link or holds a phone near your card. That is the point of the product, but it is worth keeping in mind: publish only what you want to be public.
Card pages are not actively indexed by search engines, but since they are accessible without a password we cannot guarantee they will never appear in a search engine if someone links to them from another site.
3. What data we process
| When | Data | Purpose | Legal basis |
|---|---|---|---|
| You request a card | Name, company, job title, email, phone, city, quantity, your message | Contacting you, quoting and commercial follow-up | Pre-contractual steps at your request |
| You are a client | Email and encrypted password for your account | Giving you access to your dashboard | Performance of the contract |
| You configure your card | Photo, bio, company, job title, phone, public email, address, links | Publishing them on your page, which is what you bought | Performance of the contract |
| You write via the site form | Name, email, phone, service of interest, message | Replying and following up | Pre-contractual steps |
We also record the IP address and the browser each form is sent from, for the sole purpose of detecting automated submissions and protecting the system from spam.
4. Data of people who visit a card
When someone opens a card or taps one of its buttons, we store the IP address, the browser and the date, in order to give the cardholder basic visit and click statistics.
We do not use this information to profile people or for advertising, and we do not cross-reference it with other sources. The legal basis is our legitimate interest and that of the cardholder in knowing how their page performs. You can object by writing to us.
5. Contacts your card captures
If you enable the «Capture contact» block, visitors can leave you their name, email and phone. In that case:
- You are the controller of that data: you decide to ask for it and what you use it for.
- We are the processor: we only store it and show it to you.
- It is up to you to have a legal basis for processing it and to inform those people how you will do so.
- We do not use those contacts for anything of our own, we do not transfer them, and we do not send communications based on them.
6. Who we share it with
We do not sell personal data. We share it only with those needed to operate:
| Provider | Purpose | Where |
|---|---|---|
| Hostinger | Site and database hosting | European Union |
| Cloudflare | Content delivery network and site protection | Global |
In addition, if you embed third-party content in your card — a YouTube video, a Calendly calendar, a payment link — those services receive visitor data directly and are governed by their own policies. We do not control what they do with it.
We may also hand over data if a competent authority legally requires it.
7. How long we keep it
- Requests that go nowhere: up to 2 years from the last contact.
- Client data and card content: for as long as the service stays active.
- Visit statistics: 24 months.
- Contacts captured by your card: for as long as you keep the block, or until you delete them.
- Dashboard access logs: 7 days.
When you cancel the service, we delete your page and your data within a maximum of 30 days, except for what we must keep by legal or accounting obligation.
8. Your rights
You can exercise your rights at any time:
- Access: know what data of yours we hold.
- Rectification: correct anything wrong.
- Erasure: ask us to delete it.
- Objection: object to a specific processing.
- Portability: receive your data in a reusable format.
- Suspension: ask us to stop processing it temporarily.
- Not to be subject to automated decisions with legal effects.
Write to us at [email protected]. We reply within a maximum of 15 days. If you believe we did not handle your request properly, you can complain to the Superintendency of Personal Data Protection.
9. Cookies
Public card pages use no tracking or advertising cookies.
In the client dashboard we use a single technical session cookie, needed to keep you signed in while you edit. It is deleted when you log out and does not require consent, being essential to the service.
If you embed third-party content in your card, those services may set their own cookies in the visitor's browser.
10. Security
Measures we apply:
- All traffic is encrypted with HTTPS.
- Passwords are stored with an irreversible hashing algorithm (bcrypt), never in plain text.
- Database credentials live outside the server's public directory.
- Login attempt limits to stop brute-force attacks.
- Uploaded files are validated by their actual content, not just their extension.
- Regular backups of code and databases.
No system is infallible. Should a breach affect your data, we would notify you and report it to the authority as required by law.
11. Minors
eximius card is a professional product aimed at adults. We do not knowingly request or process data of minors. If we find we have received a minor's data without their guardian's authorisation, we will delete it.
12. Changes
We may update this policy. The date of the latest version appears at the top. If a change materially affects how we process your data, we will notify the email on your account before applying it.