Template: have this reviewed by counsel before launch.
Account data (name, email, hashed password) and the profile information you choose to publish. For visitors to a card, we record the date, the source (NFC tap, QR scan or link), the device type and a daily-rotating anonymous hash. We never store visitor IP addresses.
You choose which contact fields are public, can switch your profile off at any time, and can permanently delete your account and data from Settings.
This policy should be aligned with the Philippine Data Privacy Act of 2012 (RA 10173) and any other law that applies where you operate.