1. Who we are
This policy is published by Axa Technologies LLC, Lyndhurst, New Jersey 07071, USA ("Axa Technologies", "we", "us"). We are responsible for the personal information described here. You can reach us about privacy at info@axa-technologies.com.
It covers:
- our website, axa-technologies.com;
- Axa Cards, our online business card designer at card-generator.axa-technologies.com;
- the sign-in service both use, at auth.axa-technologies.com.
2. What we collect
Your Axa Cards account
When you create an account we store:
- your email address, username, and first and last name;
- your password, in a one-way hashed form that we cannot read or recover;
- the authenticator-app secret used for two-step sign-in;
- records of your sign-ins and active sessions, including IP address, browser and time.
Your cards
Everything you put on a card that you save: names, job titles, company names, taglines, phone numbers, email addresses, websites, locations, QR code contents, and the logos and background images you upload. For each card we also keep its last 20 saved versions, so earlier versions can be recovered.
Cards often contain contact details. If you add details about someone other than yourself, make sure you are allowed to.
Designing without an account
You can design a card without signing in. That work stays in your browser and is not sent to us. If you choose to save or download, it is held briefly in your browser while you sign in, then saved to your account.
Contact form
When you use the contact form on our website we receive your name, email address, company and message.
Analytics
If you accept analytics cookies in our cookie banner, our website and Axa Cards use Google Analytics to tell us which pages are visited, roughly where visitors are (country and city level), and which devices and browsers they use. If you decline, Google Analytics is not loaded at all. The content of your cards is never sent to Google Analytics.
Server logs
Like most web services, our servers record each request: IP address, time, the address requested and browser type. We use these logs for security and to fix problems.
What we do not collect
Apart from your sign-in details, which we use only to sign you in, we do not collect sensitive information, such as health, racial or ethnic origin, religious beliefs or sexual orientation, and we do not collect your precise location. We do not buy information about you from other companies, and we do not offer sign-in with social media accounts.
3. How we use it
- to run Axa Cards: store your cards and show them back to you;
- to keep accounts secure: sign-in, two-step verification, and detecting and blocking abuse;
- to send emails about your account, such as address verification and password resets;
- to answer messages sent through our contact form;
- to understand how our website and app are used and improve them;
- to meet our legal obligations.
We do not sell your personal information, and we do not use it or your card content for advertising.
Legal bases (EU, UK and similar laws)
Where these laws apply, we rely on: performing our contract with you (running your account and cards); our legitimate interests (security, fixing problems, answering enquiries, improving the service); your consent (analytics cookies); legal obligations; and, rarely, protecting someone's vital interests, such as preventing harm.
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
4. Where it is stored and who we share it with
Your account, cards and uploaded images are stored on our own server, hosted by RackNerd in New York, United States. Backups are encrypted.
We use these service providers, who process data on our behalf:
- Google: Google Analytics (usage statistics, only with your consent) and Google Fonts (fonts loaded by your browser, which shares your IP address with Google);
- Web3Forms: delivers contact form messages to our inbox;
- hCaptcha: spam protection on our contact form. It processes your IP address and browser details, and may set its own cookies, when you use the form;
- Namecheap: hosts our email. It sends account emails such as verification and password reset, and stores the emails we receive, including contact form messages.
We may also disclose information when the law requires it, or to protect the rights, property or safety of our users or others. If our business is merged, sold or acquired, your information may be transferred to the new owner, who must keep protecting it as this policy describes.
Our server is in the United States, and so are some of these providers. If you live elsewhere, your information is transferred to the United States. Where your local law requires it, we rely on safeguards such as standard contractual clauses.
5. How long we keep it
- Account and cards: for as long as your account exists.
- Deleted cards: removed from your account straight away, but kept in our database so they can be recovered, until your account is deleted.
- Card history: the last 20 saved versions of each card; older versions are deleted automatically.
- Uploaded images: deleted automatically once no card or saved version uses them any more.
- Backups: encrypted, and deleted after 14 days.
- Sign-in records: 90 days.
- Contact form messages: as long as needed to answer your enquiry and any follow-up, and no longer than 2 years.
- Server logs: rotated automatically and overwritten, typically within a few weeks.
- Google Analytics data: 14 months from your last visit, then deleted by Google. Only collected if you accept analytics cookies.
When your account is deleted, your cards, images and history are deleted with it. Copies in backups expire within 14 days.
6. Cookies and browser storage
- Sign-in cookies from our sign-in service keep you signed in. They are necessary for Axa Cards to work.
-
Google Analytics cookies (named
_gaand_ga_…) measure visits. They are set only after you choose "Accept" in our cookie banner. We ask again after 12 months. - Browser storage: Axa Cards keeps your sign-in session, and your unsaved work while you sign in, in your browser's session storage, which is cleared when you close the tab. Both the website and Axa Cards remember your light or dark theme choice, and your cookie choice, in your browser.
You can change your mind at any time: use "Cookie settings" at the bottom of any page on our website, or "Cookies" in Axa Cards. If you decline after accepting, we stop Google Analytics and remove its cookies. You can also block or delete cookies in your browser settings; blocking sign-in cookies will stop you from signing in to Axa Cards.
7. How we protect it
All traffic is encrypted with HTTPS. Passwords are stored only in hashed form. Accounts use two-step sign-in. Each account can only reach its own cards and images, and backups are encrypted. No system is completely secure, but we work to protect your information and will tell you without undue delay if a breach affects you.
8. Your rights
Depending on where you live, you may have the right to:
- see the personal information we hold about you;
- correct it;
- have it deleted;
- receive a copy of it in a portable format;
- object to or restrict how we use it;
- withdraw consent you have given, at any time;
- complain to your local data protection authority.
You can edit and delete your cards yourself in Axa Cards. For anything else, including deleting your account, email info@axa-technologies.com from the address on your account, or use our contact form. We will reply within 30 days, and may ask you to confirm your identity first.
Withdrawing consent does not affect processing we carried out before you withdrew it.
If you are in the EU or UK and think we have handled your information unlawfully, you can complain to your local data protection authority (see the list of EU authorities, or the UK Information Commissioner's Office). In Switzerland, you can contact the Federal Data Protection and Information Commissioner. We would appreciate the chance to put things right first, so please contact us too.
9. US state privacy rights
Residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia and other states with privacy laws may have these rights, within the limits those laws set:
- to know whether we process your personal information, and to access it;
- to correct it;
- to delete it;
- to get a copy of it;
- to opt out of its sale, its use for targeted advertising, and profiling that produces legal or similarly significant effects;
- to get a list of the categories of third parties, or the specific third parties, we have disclosed it to, where your state allows;
- not to be treated differently for using these rights.
We do not sell or share personal information, and have not done so in the last 12 months. We do not use it for targeted advertising or for profiling. We do not disclose it to third parties for their own direct marketing, so California's "Shine the Light" law has nothing for us to report.
Categories of personal information
In the last 12 months we have collected:
| Category | Examples from section 2 | Collected |
|---|---|---|
| Identifiers | Name, email address, username, IP address | Yes |
| Customer records | Name and contact details on your account and cards | Yes |
| Internet or network activity | Server logs; Google Analytics, only with your consent | Yes |
| Audio or visual information | Logos and images you upload to your cards | Yes |
| Professional information | Job title and company you put on your cards | Yes |
| Precise geolocation | GPS or device location | No |
| Commercial or financial information | Purchases, payment details | No |
| Protected characteristics, biometrics, education | Age, race, fingerprints, student records | No |
| Account sign-in details | Username and password, used only to sign you in (the password is stored hashed) | Yes |
| Other sensitive personal information | Health, government ID or financial account numbers, racial or ethnic origin | No |
| Inferences and profiles | Predictions about your preferences | No |
We collect this information from you directly, from your browser and device, and, if you accept analytics cookies, through Google Analytics. We use it for the purposes in section 3 and keep it for the periods in section 5.
Making a request
Email info@axa-technologies.com or use our contact form. We will confirm your identity before acting, normally by asking you to write from the email address on your account, and will only use the details you give us for that check. You can ask an authorized agent to make a request for you; we will ask for your signed permission and may still need to confirm your identity with you.
Appeals
If we decline your request, you can appeal by emailing info@axa-technologies.com with "Privacy appeal" in the subject. We will reply in writing within the time your state's law sets (usually 45 to 60 days), explaining our decision. If we deny your appeal, you can complain to your state attorney general.
10. Do Not Track and Global Privacy Control
There is no agreed standard for responding to "Do Not Track" browser signals, so we do not respond to them, and we do not currently act on Global Privacy Control signals either. This has little effect in practice: we do not sell or share personal information or use it for advertising, and Google Analytics only runs if you accept it in our cookie banner.
11. Children
Axa Cards is not intended for anyone under 16. If we learn that a child under 16 has created an account, we will delete it.
12. Changes to this policy
We will update the date at the top of this page when the policy changes. If a change is significant, we will also tell account holders by email or in the app before it takes effect.
13. Contact
Axa Technologies LLC
Lyndhurst, NJ 07071, USA
info@axa-technologies.com
· +1 (551) 301 9882
See also our Terms of Use.