Privacy Policy

Effective Date: August 1, 2026

1. Introduction

Diits ("we," "our," or "us") provides customizable 3D-printed physical NFC cards paired with hosted digital business card profiles, digital e-commerce stores, tip jars, and peer-to-peer payment utilities. This Privacy Policy explains how we collect, store, and protect your data when you purchase physical items, manage your digital profile, transact through our store or payment tools, or interact with a Diits profile link, tap, or contact exchange feature.

Our Core Security & Privacy Commitments:

  • We Never Sell Your Data: We do not monetize, rent, or sell your personal details, contact information, or profile interactions to third parties.
  • High-Grade Encryption: Profile data, credentials, and system records are encrypted using TLS 1.3 in transit and AES-256 at rest.
  • Zero Tracking Cookies: We do not use third-party tracking pixels or behavioral cookies. Platform navigation and profile viewing rely solely on essential session tokens.

2. Information We Collect

  • Digital Profile & Store Data: Profile information you explicitly upload to display on your digital business card (e.g., full name, job title, company, bio, profile photo, phone numbers, email addresses, social media links, and website URLs), as well as store items, item descriptions, and pricing created for your storefront.
  • Account & Order Details: Contact name, email address, shipping address for physical NFC card delivery, billing details, and transaction histories.
  • Financial & Payment Interaction Data: Details related to store purchases, tip jars, and "Pay Me" transactions. Note that full credit card numbers and sensitive financial instruments are handled directly by our payment processor, Stripe.
  • Mailing List Subscriptions ("Join My List"): Email addresses and contact details provided when joining a creator or merchant mailing list. In compliance with UK GDPR, marketing consent is strictly opt-in, un-checked by default, and entirely optional.
  • NFC & Digital Profile Interaction Data: When someone taps your physical Diits card or opens your digital profile URL, our servers log essential connectivity metrics (IP address, operating system, device type, and time of tap/view) strictly for system stability, security, and basic view counters.
  • Contact Exchange & Scanned Data: Information saved into your connection library, including contacts exchanged via profile views, CSV/vCard exports, phone numbers provided for automated text receipts, and details extracted via our AI Business Card Scanner.
  • No Third-Party Cookies: We do not deploy third-party advertising cookies, cross-site trackers, or marketing pixels.

3. How We Use Your Data

  • Programming physical NFC cards and delivering them to your shipping address.
  • Hosting, rendering, and managing your digital business card profile, store listings, and item descriptions for sharing.
  • Processing secure e-commerce transactions, tip jar contributions, and peer-to-peer payments.
  • Managing secure account authentication, login credentials, and tier-based feature access (Free, Lite, Pro, Team).
  • Processing AI-driven business card scanning and contact library management.
  • Delivering order updates, transaction receipts, networking summaries, and automated SMS/WhatsApp notifications via Twilio where opted in.
  • Managing optional mailing list signups ("Join My List") with clear, un-checked user consent controls.
  • Safeguarding infrastructure against misuse, automated scraping, prohibited commercial trading, or unauthorized access attempts.

4. Messaging, SMS, & WhatsApp Communications (Twilio)

When you use Diits to exchange contact information or process a direct interaction, we may collect and use your phone number to facilitate automated digital receipts, networking summaries, and interaction records via SMS or WhatsApp through our communications provider, Twilio.

  • Consent & Opt-In: By providing your phone number during a contact exchange or transaction, you consent to receiving automated text notifications and receipts related specifically to that interaction.
  • How to Opt Out: You can opt out of SMS or WhatsApp notifications at any time by simply replying STOP to any message received from Diits. You can resume notifications at any time by replying START.
  • Data Privacy: We do not sell, rent, or share your phone number or personal CRM data with third-party marketers. Your contact data is used strictly to facilitate digital networking and transaction attribution between you and your connections.

5. Third-Party Service Providers & Stripe Disclosures

We share minimal required data strictly with trusted service providers who help run our physical and digital operations:

  • Payment Gateways & Compliance (Stripe, Inc.): To handle billing, subscriptions, store sales, tip jars, and "Pay Me" transactions securely. By making or receiving payments through Diits, you acknowledge and agree that your payment details, transaction records, and associated metadata are collected and processed by Stripe in accordance with Stripe's Privacy Policy. Stripe also collects device, network, and telemetry data for fraud detection, risk assessment, and regulatory anti-money laundering (AML) compliance. All items and transactions must comply with Stripe's Prohibited and Restricted Businesses Policy.
  • Messaging & Notifications (Twilio, Inc.): To securely dispatch automated SMS and WhatsApp contact exchange receipts and connection summaries.
  • Database & Backend Infrastructure: To manage user authentication, secure file storage, and database records (e.g., Supabase, protected by Row Level Security).
  • AI Processing: To extract text and contact details from physical business cards when utilizing our optional AI scanner feature (e.g., OpenAI/Google Gemini).
  • Shipping & Logistics: To dispatch physical 3D-printed NFC cards to your address.

6. Data Control & Rights

You maintain ownership and control over what appears on your digital card and store:

  • Instant Profile & Store Edits: You can add, edit, or remove store items, descriptions, contact links, and details on your profile at any time through your account dashboard.
  • Mailing List Opt-Out: You may unsubscribe from any merchant or creator mailing list ("Join My List") instantly via the unsubscribe link provided in any communication.
  • Account & Data Deletion: Under UK GDPR, you have the right to request full erasure of your account, hosted digital profile, store listings, and captured contact libraries ("right to be forgotten"), subject to standard legal tax and transaction retention rules required by financial regulators and payment networks.

7. Contact Us

For any privacy-related queries, data requests, or to exercise your rights under UK GDPR, please reach out to:

Email: support@diits.io

Appendix: Cloudflare Turnstile Privacy Addendum

1. Purpose & Overview

To protect Diits against automated attacks, spam, credential stuffing, and malicious bot activity, we integrate Cloudflare Turnstile (and Cloudflare’s Challenge Platform), operated by Cloudflare, Inc. Turnstile is a privacy-preserving security tool designed to distinguish human visitors from automated bots without requiring intrusive user challenges or cross-site tracking.

2. Information & Technical Signals Processed

When you access our platform, Cloudflare evaluates minimal client-side technical signals ("Signals") strictly necessary to evaluate bot risk. These Signals include:

  • Client IP address
  • TLS Fingerprint
  • Browser User-Agent header
  • Sitekey and associated origin metadata

Neither Diits nor Cloudflare utilizes these Signals to directly identify, profile, or track individual users across non-affiliated web properties.

3. Data Processing Roles & Legal Basis (UK / EU GDPR)

Under the UK GDPR and EU GDPR, data processing responsibilities are allocated as follows:

  • Site Security (Processor Role): We process Signals based on our Legitimate Interest (GDPR Article 6(1)(f)) in maintaining the security, integrity, and operational safety of our web properties. For this purpose, Diits acts as the Data Controller, and Cloudflare acts as our Data Processor, handling Signals solely on our behalf and according to our instructions.
  • Security Model Improvement (Controller Role): To the extent that Cloudflare processes anonymized or aggregated Signals to refine its threat-detection algorithms and adapt to evolving web threats, Cloudflare acts as an independent Data Controller. Cloudflare relies on its legitimate interests in securing web infrastructure globally.

4. Cookies & Storage

Turnstile relies on strictly necessary session verification tokens to establish whether a visitor is human. It does not deploy third-party, cross-site tracking cookies, nor does it monetize user data.

5. Data Subject Rights & Inquiries

If you have questions or wish to exercise any data protection rights regarding how security signals are processed on Diits, please contact us directly at support@diits.io. For inquiries specifically concerning Cloudflare's independent data processing operations, you may contact Cloudflare’s Data Protection Officer at dpo@cloudflare.com. For more detailed information on data collection, you can review the Cloudflare Turnstile Privacy Addendum.