Privacy Policy

Who we are

This policy covers GBC (Green Business Card), operated by DevsAus Pty Ltd (ABN 14680953539). It explains what personal information we handle when you visit the site, create an account, publish a card, or buy a plan. Questions about this policy go to admin@greenbusinesscard.com.au.

We follow the Privacy Act 1988 (Cth) and the Australian Privacy Principles. If you are in another country, local law may give you extra rights. This policy does not limit them.

What we collect

We collect only what the service needs. In summary:

• Account details. Your name, email address, and password. We store a salted hash of your password, never the password itself. Phone number is optional and only collected if you enter one at sign-up.
• Google sign-in. If you sign in with Google, we receive your name, email address, and profile picture from Google.
• Card content. The details you choose to put on your card, such as display name, job title, company, contact details, links, and images you upload.
• Company plan details. If your organisation subscribes to a company plan, we hold the organisation name, the names, email addresses, and roles of the people you add, and billing contacts.
• Billing. Our payment provider, Stripe, collects and stores your card details. We never see or store your full card number. We keep your plan, subscription status, and invoice records.
• Usage counts. When someone views your card, scans your QR code, or taps save-contact, we record that event, the time, and the website domain they came from if they followed a link. We do not record IP addresses, device details, or any identifier for the visitor.
• Security and operations. We use IP addresses in memory only, to limit how fast requests can arrive. Our hosting providers keep standard server logs, which can include IP addresses, for a limited period.
• Referrals. If you arrive through a referral link, a cookie stores the referral code for up to 60 days, and we link the resulting account to the referrer.
• Verification and audit records. Email verification and password reset tokens, a record of emails sent to address verification and reset requests (for rate limiting), and an audit log of sensitive actions by organisation admins, such as role changes and offboarding.

What you choose to share

Sharing your details is your choice. Only add information you are happy to share. If you are not willing to share something, leave it out. You can change or remove your card details at any time.

Anyone with your card link can see what you publish. You are responsible for the content you publish, for keeping it accurate, and for having the right to share it.

If you add another person's details, such as a colleague on a company plan or a contact on your card, make sure you have their permission. Organisation admins are responsible for the people they add to their organisation.

This section does not limit GBC's obligations under the Privacy Act 1988 (Cth) or any rights you have under other laws.

Cookies

We use only cookies the service needs to work:

• A session cookie that keeps you signed in. It is required for login.
• A referral cookie, set only when you arrive through a referral link. It lasts up to 60 days.

We do not use advertising or cross-site tracking cookies, and we do not use analytics cookies. Our sign-up and log-in pages use Cloudflare Turnstile, a bot check, which may set its own technical cookie and receives request data to make that check.

How we use your information

• To run the service: sign-in, publishing your card, QR codes, and vCard downloads.
• To take and manage payments and send invoices and receipts.
• To send account emails, such as verification, password reset, and invitations.
• To follow up after sign-up. See the section on sharing with GoHighLevel below.
• To keep the service secure, prevent abuse, and investigate problems.
• To show card owners and organisation admins how their cards are being used.

We do not sell your personal information. We do not use it for advertising.

Who we share it with

We share information only with the providers that run parts of the service for us, and only as far as they need it to do their job:

• Neon hosts our database.
• Vercel hosts the website.
• Stripe handles payments and billing records.
• Resend sends our account emails.
• Cloudflare stores uploaded images (R2) and runs the bot check on sign-up and log-in (Turnstile).
• Google is used only if you choose to sign in with Google.
• GoHighLevel (GHL) receives your name, email address, phone number if you gave one, and sign-up status when you create an account. Our team uses it to contact you about GBC and manage follow-up. GHL processes this information for us under its own terms.

Some of these providers are based or store data outside Australia, including in the United States. By using GBC you agree that your information may be processed in those places. We choose providers that maintain appropriate security safeguards.

Anyone who has your card link can see the details you have published on it. Publishing a card is your choice, and you can change or remove those details at any time.

If your card belongs to a company plan, the organisation admins can see your card details and the usage counts for your card. Your employer decides who holds admin roles. Speak to your organisation about its own policies.

How long we keep it

• Account and card data stay while your account is active. When you delete your account, we delete or de-identify it, except where we must keep records by law.
• Billing and invoice records are kept for as long as Australian tax and accounting law requires.
• Usage counts stay with the card they belong to. Deleting the card removes them.
• Backups hold copies of data for a limited period as they rotate. Deleted data can remain in backups until those backups expire.
• Server logs are kept by our hosting providers for a limited period.

Keeping it safe

Traffic to GBC uses HTTPS. Passwords are hashed. Access to organisation data is limited to members of that organisation, and every change is checked on the server. Sign-up, log-in, and other public endpoints are rate limited. Sensitive organisation actions are logged.

No online service can promise perfect security. If we discover a data breach that is likely to cause serious harm, we will tell you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

Your choices and rights

You can ask us to:

• tell you what personal information we hold about you;
• correct information that is wrong;
• delete your account and your card data;
• stop sending you non-essential emails.

Email admin@greenbusinesscard.com.au from the address on your account. We may need to confirm who you are before we act. We will respond within a reasonable time, and in any case within the timeframe the Privacy Act requires.

If you are not happy with how we handle your information, contact us first so we can fix it. You can also complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Children

GBC is not intended for children under 16. Do not create an account or publish a card for a child. If we learn that we hold information about a child under 16, we will delete it.

Changes to this policy

We will update this page when our practices change and change the date at the top. If a change is significant, we will tell you by email before it takes effect.

Contact

DevsAus Pty Ltd, ABN 14680953539. Privacy enquiries: admin@greenbusinesscard.com.au.