Privacy policy

Draft, last updated 2026-10-21
Privacy contact:
cinciotechnologies@gmail.com
In short
•
You choose who sees each detail on your card, and you can change it at any time.
•
We do not sell your information and Cincio shows no ads.
•
We never sell, license or export people data. You can export your own.
•
You can download everything we hold about you, or delete your account, from the app.
Cincio is a card you own, a way to sign in to other apps (Sign in with Cincio), and a directory of people and organisations. You keep your own card current, decide who sees each detail, and share it with a link. This policy says what we collect, why, who helps us run Cincio, how long we keep things, and what you can do about it. It is written for the Protection of Personal Information Act, 2013 (POPIA) in South Africa and for the EU and UK GDPR.
Cincio is run by Cincio Technologies ("Cincio", "we"). We decide why and how your information is processed, so we are the responsible party under POPIA and the controller under the GDPR.
•
Where your information is stored: in Frankfurt, Germany (Neon database on AWS eu-central-1). Requests pass through Cloudflare's network on the way; see "Who helps us run Cincio" for every operator and where it works.
•
Information Officer: not yet registered with the Information Regulator.
•
Regulator: you can complain to the Information Regulator (South Africa), https://inforegulator.org.za, or to your local data protection authority in the EU or UK, at any time and for free.
Your email address (and later a phone number)
From whom
You, at sign-in
Why
To send you one-time sign-in codes and keep your account
Lawful basis (POPIA s11; GDPR art. 6)
Needed to provide the service you asked for (contract)
Your card: name, handle, and any details you add (role, organisation, phone numbers, emails, links, photo [when supported]) with the visibility you choose for each
From whom
You
Why
To show your card to the people you allow
Lawful basis (POPIA s11; GDPR art. 6)
Contract; for each detail, your choice to share it at the visibility you set (consent you can change at any time)
Connections and requests: who you asked, who accepted, declined or was blocked
From whom
You and the people you connect with
Why
To show connections your live card and keep your blocks working
Lawful basis (POPIA s11; GDPR art. 6)
Contract
Organisation listings: an org's name, the people it lists, their role titles, and who administers it
From whom
Org owners and admins
Why
To run the org directory
Lawful basis (POPIA s11; GDPR art. 6)
Contract with the org; legitimate interest of the org in listing its own people
Unclaimed cards: a person's name, role and organisation, and an email or phone number used only to invite them to claim the card (never shown to anyone)
From whom
An org admin, about a member of their own organisation
Why
So a team can list its people before each person joins
Lawful basis (POPIA s11; GDPR art. 6)
Legitimate interest of the organisation, kept to the minimum (see "If someone listed you")
Reports: the card reported, the reason, and for removal requests a contact email
From whom
Anyone, including people without an account
Why
To act on impersonation, abuse, phishing and removal requests
Lawful basis (POPIA s11; GDPR art. 6)
Legitimate interest in keeping Cincio safe; legal obligation where the law requires removal
Security data: one-way hashes of sign-in codes, of session tokens and of the email address or network address used for rate limits
From whom
Generated when you use Cincio
Why
To stop guessing and abuse of sign-in
Lawful basis (POPIA s11; GDPR art. 6)
Legitimate interest in security
How you found Cincio: a link source such as an X post or a shared card, stored once on your account and deleted with it
From whom
Your device, at sign-up
Why
To measure which channels work
Lawful basis (POPIA s11; GDPR art. 6)
Legitimate interest
Usage events [when analytics is switched on]: which screens and actions are used, device type, approximate country
From whom
Your device
Why
To learn what works and fix errors
Lawful basis (POPIA s11; GDPR art. 6)
Legitimate interest; never includes what is on any card
We do not collect your contacts or address book, your location, or anything from other apps on your phone. We never build cards from uploaded address books or other people's phones.
What never leaves the card system: the contents of cards (names, numbers, emails, links) are never sent to analytics, and no AI service receives a card. The one exception is the directory's Ask box: your question, and the public listed details of the entries that match it (name, role, organisation, place, category, a company's one-line description), go to Cloudflare Workers AI to write a short overview.
•
Public details: anyone with your link, and the directory search (name, role and organisation only).
•
Connections details: only people whose connect request you accepted. They see your current card, not a copy, until either of you ends the connection.
•
Hidden details: only you.
•
Your name is always public, because it tells people whose card this is. Your role and organisation start public so people can find you, and you can hide either. Every other detail you add (phone numbers, emails, website, LinkedIn, city) starts as connections-only and is never public unless you choose it; a photo and link buttons start as only me. A card set to "request to view" shows strangers only your name (and role and organisation unless you hid them).
•
Blocking someone hides your card from them completely; they are not told.
•
Organisations cannot see, change or keep anything you hid or changed after you claimed your card.
Card pages are marked so search engines do not index them [Phase 0].
Cloudflare, Inc.
What they do for us
Hosts the web app and the API; every request passes through its network; Workers AI writes the directory Ask-box overview
Where the information is processed
Cloudflare's global network, usually the data centre nearest to you; company in the United States
Neon (part of Databricks, Inc.)
What they do for us
Stores the database (accounts, cards, connections, orgs, reports)
Where the information is processed
AWS eu-central-1, Frankfurt, Germany
Google LLC (a Google Apps Script mail sender on the company Google account)
Where the information is processed
Google's data centres worldwide; company in the United States
PostHog, Inc.
What they do for us
Product counts only: which actions are used (such as a card created or a search made, with the number of results, never the words searched), no card contents, no cookies, no profile of you; off when your browser sends Do Not Track or Global Privacy Control
[Crisp IM SAS]
What they do for us
[Support inbox, when you write to us]
Where the information is processed
[France / EU]
[Polar Software, Inc., from 2027]
What they do for us
[Payments for the Team plan, as merchant of record; Cincio never sees card numbers]
Where the information is processed
[United States]
We do not sell, rent or share personal information with advertisers or data brokers, and Cincio shows no ads.
Your information is stored in Germany and passes through operators in the United States and elsewhere. Under POPIA section 72 we transfer it only where the recipient is bound by law, binding corporate rules or an agreement that gives protection substantially similar to POPIA, or where the transfer is needed to provide the service you asked for.
Sign-in codes (hashed)
Kept
Expire after 10 minutes; single use
Sessions (hashed token)
Kept
30 days, or until you sign out
Your account, card and connections
Kept
Until you delete your account; deletion completes within 30 days of your request
Database restore history
Kept
Deleted data can remain in the database provider's restore history for up to 6 hours after it is deleted [Neon Free: history window up to 6 hours]
An unclaimed card, after a removal request
Kept
Removed within 72 hours
An unclaimed card nobody claims
Kept
Removed [90] days
An unclaimed card, when the organisation removes the person
Kept
Removed at once
Removal-request contact email
Kept
Deleted once the request is handled
A person's membership of an organisation, after the organisation ends it
Kept
The listing is kept 90 days so a verify link can say "ended <month year>", then deleted. The person's own card is not affected. They can also leave a list themselves at any time, which deletes the listing at once
Reports of impersonation, abuse or phishing
Kept
Acted on within 24 hours; the report record is kept [12 months] to handle repeat abuse
[Analytics events]
Kept
[PostHog default retention; set at set-up]
You can, at any time and for free:
•
See what we hold about you, and download all of it in an open format (JSON) from the app.
•
Correct it: edit your card yourself; ask us for anything else.
•
Delete your account and card from the app. Deletion completes within 30 days.
•
Withdraw a choice to share: change a detail's visibility or remove it; the change applies everywhere at once.
•
Object to processing based on legitimate interest, including an unclaimed card about you.
•
Complain to us first if you like, and to the regulator at any time:
•
South Africa: the Information Regulator, https://inforegulator.org.za [complaints address copied from its site at publication].
•
EU/UK: your local data protection authority.
We answer requests within 30 days and will confirm who you are (by a sign-in code to the email on the account) before acting.
An organisation may list you on an unclaimed card so its directory is complete. An unclaimed card shows only your name, role and organisation, never a phone number or email. We use the email or phone the organisation gave us only to invite you to claim the card.
•
Claim it: sign in to Cincio (with a one-time code sent to your email), then open the personal, single-use claim link the organisation gives you. The link is valid for 30 days. We do not check that the email you sign in with matches the one the organisation entered, so only pass your link to the person it is for; the organisation can issue a new one. From then on it is your card: the organisation can no longer change it.
•
Have it removed without an account: use "Not you? Request removal" on the card page. We remove it within 72 hours.
No passwords are stored: you sign in with a one-time code. Codes and session tokens are stored only as one-way hashes, sign-in is rate-limited, and traffic is encrypted in transit. If a security compromise affects your information, we will tell you and the Information Regulator as soon as reasonably possible, as POPIA section 22 requires.
Cincio is for people aged [18] and over. We do not knowingly hold information about children; if we learn of one, we delete it.
Cincio does not use cookies for sign-in or tracking: the app keeps its session in your device's own storage. The product counts above (once switched on) set no cookie and write nothing to your device; they are skipped entirely when your browser sends Do Not Track or Global Privacy Control.
Public card pages (the link to someone's card, the sample card and a verification link) set no cookie, load no third-party script and show no ads, and Cincio's code keeps no record of who viewed a card.
We will post changes here with a new date, and tell signed-in users in the app before a change that reduces your rights takes effect.
Information Officer: not yet registered with the Information Regulator.