NEVO CARD360

Privacy policy

Unfinished signup details, your selected portrait and organisation logo are saved for up to 30 days so you can resume in the same browser. Platform administrators can see signup progress, contact details and the latest saved step. Passwords and visiting-card scans are not stored in signup drafts. Completing signup removes the draft images and retains a completion record linked to your organisation.

Last updated: 8 November 2026

This policy explains how NEVO CARD360 handles information when you create an account, manage an organisation, publish a digital card, scan a visiting card, use NEVOIntel, or purchase a subscription. Contact NEVO Global Technology at executive.office@nevo-technology.com for privacy questions.

1. Information we handle and why

Account and organisation information: names, login identifiers, email addresses, telephone numbers, job titles, company details, websites, addresses, languages, logos and workspace preferences. We use these to provide accounts, cards and organisation administration.
Card content: portraits, multilingual profile details, social links and contact actions you or your administrator supply. These support your digital card and downloadable contact files.
Uploads: portraits, visiting-card images, logos and documents supplied for the features you use. Only upload content you are authorised to use and share.
Account security: password hashes, session identifiers and request-rate records help authenticate users and protect the service. Passwords are stored as hashes rather than readable passwords.
Usage information: card and QR activity records include the relevant card or QR identifier, action and time, enabling reports on views, scans, contact downloads and link clicks. Server and security logs may also contain IP addresses and request metadata.
Support communications: information you send to NEVO is used to respond to your enquiry.

2. Public cards and organisation access

Published cards and their contact details can be accessed by people with the public URL or QR code. Recipients can save, copy or share that information. A UUID in a card URL does not make the card private. Public card analytics can display aggregate activity totals. Workspace access and editing permissions depend on your role, subscription and organisation settings.

Organisation administrators can manage users, cards and activity within their organisation. Platform administration supports operation of the service. If your organisation created your account, contact its administrator about how it uses your details. Disabling or deleting a card cannot recall copies or contact files already saved by others.

Your personal saved-card collection stores references to CARD360 cards, save dates and favourites. Collection pages are accessible only to your signed-in account, not through organisation-admin browsing. If your organisation enables its colleague directory, signed-in colleagues can find active public cards within that organisation. A cookie can remember a card you chose while you sign up or log in for up to 30 days; it is cleared after the card is added. Removing a saved card removes that reference, not the original card. Deleted accounts and cards are removed from active collections.

3. NEVOIntel and external AI processing

NEVOIntel is the feature name. OpenAI is the external processing provider used by the current integration. Signup has one shared permission covering portrait preparation, visiting-card scanning website logo identification and English–Arabic name/job-title translation. It is selected by default and remains available at every step; you can uncheck it before processing. Outside signup, logo identification has its own permission control. With permission enabled, visiting-card reading starts automatically after capture or upload. Portrait preparation starts when you continue, and website logo identification starts automatically in signup when a valid website is available; outside signup, it starts when you choose Find logo from website.

Portrait preparation

When portrait permission is enabled and you continue, your cropped portrait is sent to OpenAI to prepare its background and lighting. Review the result and choose your original or the prepared version. With permission unchecked, your framed original is uploaded to CARD360 for your card, without sending it to the AI provider.

Visiting-card scanning

When scanning permission is enabled and you capture or upload a visiting card, the front and optional back images of the visiting card are sent to OpenAI to extract business contact details. Check the extracted names, email addresses, telephone numbers and other fields before saving. You can uncheck permission and enter details manually instead.

English–Arabic translation

With the shared permission enabled, leaving a name or job-title field can send that text to OpenAI to fill its English or Arabic counterpart. Personal names are transliterated; job titles are translated. Manually entered counterpart values are preserved. Review spelling and meaning before publishing, or disable AI permission and enter both languages yourself.

Public-card languages

When an organisation enables additional card languages, NEVOIntel can send the public card name, job title and company name to OpenAI to prepare the selected language. Translations are cached and reused; private account information, phone numbers and email addresses are not sent for this translation. Administrators can enter or correct translations in My Card. Changing the original details invalidates cached translations. Public visitors can select an available language and download the contact in that language.

Website logo identification

When logo identification permission is enabled and a company name or website is available in the signup organisation step (or you choose Find logo from website outside signup), NEVOIntel can send the company name to OpenAI web search to suggest its official website. Review the suggestion; ambiguous names may require your input. CARD360 retrieves public website information and sends the website address and candidate image information to OpenAI to identify a likely logo. You can review or replace the suggestion. Uploading or capturing a logo manually does not require this AI identification.

Unchecking permission prevents subsequent requests for that feature; it does not undo processing already started. AI output can be inaccurate. CARD360’s temporary-upload expiry does not establish the provider’s retention period. Provider processing is governed by the applicable API service agreements and data controls; this policy does not promise immediate deletion from external systems or a particular processing country. OpenAI’s privacy information explains its general practices and distinguishes business/API processing from consumer services.

4. Payments and subscriptions

PayPal handles payment approval and payment-method information in its checkout. CARD360 maintains subscription and transaction references, amounts, currency, licence quantities, payment status and billing dates to manage access and renewals. The application does not collect your full payment-card number or security code in its own forms. PayPal may request additional information under its own requirements. See PayPal’s privacy statement, including the information applicable to your region.

5. Cookies, camera access and external links

Essential cookies support signed-in sessions and signup security. The application’s login session is configured for up to 12 hours and the signup security cookie for one hour; signing out clears the login cookie and server session. Your browser asks for camera permission before capture. You can upload an image instead. Some chosen fonts load from Google Fonts, which receives the browser request. Opening third-party websites, social links, email or messaging applications is subject to those services’ practices.

6. Service providers and international processing

Hosting infrastructure, AI processing and payment services handle information needed for their functions. Your organisation’s authorised administrators also receive access as described above. External services may process information outside your country. Contact NEVO for questions about provider arrangements or processing locations; no specific data-residency guarantee is made here.

7. Retention and deletion

Temporary signup images and extraction results expire in CARD360 after one hour and are removed by application cleanup. Your selected portrait, saved card details and organisation logo remain part of the account after signup. Accounts, analytics, QR records and subscription records are retained for service operation until removed through the relevant account or organisation deletion process. Cancelling Premium or moving to Basic does not by itself delete the organisation’s data.

Deletion from active application storage is distinct from removal from operational backups, logs, recipients’ downloaded contacts or external providers. A fixed retention period for those systems is not stated here. Contact NEVO about a specific deletion or retention request.

8. Your choices and privacy requests

You can review and correct signup details, choose the portrait to publish, disable optional AI processing before a request, and use manual entry or logo upload. After signup, editing and self-deletion controls depend on your organisation’s settings and plan. Contact your administrator or NEVO to request access, correction, deletion or information about your data. We may need to verify your identity and organisation authority. Available rights and any required retention depend on applicable law and the circumstances of the request.

9. Security and policy changes

The service uses HTTPS, password hashing, session controls and organisation-scoped access. No system or public sharing mechanism can guarantee absolute security. Avoid including sensitive personal information that you do not want published on your card. This policy may be updated as features or processing arrangements change; the date above identifies the current version.