Privacy policy

Version 1.9 · effective 6 November 2026

This policy says which data OPÉMA Cards processes, why, for how long, who receives it, and how you can have it deleted.

Who processes your data

The controller is OPÉMA, limited liability company (SARL), with its registered office at 47 rue Tomboktou, Hay Al Massira, Agadir, Morocco, registered with the trade register under number 70253 (Agadir Commercial Court) ("OPÉMA", "we"). Contact: contact@opemacards.com. If you live in the European Union, the European Economic Area or the United Kingdom, the General Data Protection Regulation (GDPR), or its UK version (UK GDPR), applies to how we process your data, even though we are established in Morocco.

In short

Your profile page is public, because you share it: what you put on it can be seen by anyone who has your link or your QR.
We embed no advertising service and no third-party audience measurement or attribution service, in the app or on the website. We do not sell your data.
Your IP address is never stored in our database.
When someone opens your profile page, we measure the visit with no tracking cookie, and their IP address does not go into our statistics. They can refuse this measurement.
When you ask for translation suggestions, the fields of your card to translate go through our server, which sends them to an automatic translation service, without any identifier of your account or your phone.
One technical component of the app communicates with its publisher, which draws its own operating measurements from it: app updates and the routing of notifications. It is described below.
You must be at least 16 years old to use OPÉMA Cards.
If your account's country is in the European Union, the European Economic Area, the United Kingdom, Switzerland or Canada, you receive news and offers from OPÉMA and its partners only if you have agreed. OPÉMA itself sends you its partners' offers: none of your data is passed on to them.
When someone sends you their card from your profile page, their details arrive in your contacts, kept on our servers. Searching your contacts happens on your phone: the words you search for are not sent to us. When you swap cards with another member in the app, each of you receives the other's card in your contacts.
When you turn on notifications, your phone gives us a token that lets us send them to you. A notification goes through our notification sending service, then through your phone's notification service.

The data we process

Processing	Data	Why	Basis
Your account	Account identifier; dates the account and the device were created and last active; model and system of your phone, app version, language; email address if you add one	To provide the service, recognise you on your device, let you get your account back	Performance of the contract formed by the terms of use (GDPR, Art. 6(1)(b))
Account country	The country worked out from the region and time zone in your phone's settings; only the country is recorded	Applying your country's data protection rules, in particular for OPÉMA communications	Legitimate interest: applying to each account the data protection rules of its country (GDPR, Art. 6(1)(f))
Your card	First name, last name, nickname, name in another language and its language, job title, company, sector, city and country, phone numbers, email, website, address, social networks, short bio, photo, logo, template and colour, language of the card and language it opens in, versions in the languages you have validated, with the origin of each field’s text (translation suggestion kept as is, or typed)	To display your card, your QR and your public profile page, and to produce the contact file	Performance of the contract formed by the terms of use (GDPR, Art. 6(1)(b))
Your images	Photo and logo you send, re-encoded on receipt; their metadata, including where the picture was taken, is removed	To display the photo and logo of your card	Performance of the contract formed by the terms of use (GDPR, Art. 6(1)(b))
Email codes	Your email address and a 6-digit code, valid for 10 minutes	To verify your address, or to confirm the deletion of your account	Performance of the contract formed by the terms of use (GDPR, Art. 6(1)(b))
Your agreements	Version of the terms of use and of the privacy policy you accepted, date of each agreement, your agreement to communications from OPÉMA and its partners and the date you withdrew it, if any; in the European Union, the European Economic Area, the United Kingdom, Switzerland and Canada, how many times you declined the invitation and the date of the last time	To keep proof of what you accepted, and to offer the invitation again only at the planned pace	Legal obligation to be able to prove your consent (GDPR, Art. 7(1) and 6(1)(c)) and legitimate interest in proving your acceptance of the terms and in not asking you again beyond the planned pace (Art. 6(1)(f))
Communications from OPÉMA and its partners	Your verified email address, your account's country	Sending you Cards news and member-only offers from OPÉMA and its partners. OPÉMA itself sends its partners' offers: none of your data is passed on to them	Outside the European Union, the European Economic Area, the United Kingdom, Switzerland and Canada: your acceptance of the terms of use, which provide for these messages by default, and you can stop them and turn them back on at any time. In those countries: your consent, given by ticking the box or from the app (in the European Economic Area and the United Kingdom: GDPR, Art. 6(1)(a)), which you can withdraw and give again at any time
Translation suggestions	The fields of your card you ask to translate (first name, last name, job title, city, bio) and the two languages, sent by our server to an automatic translation service; the suggestions received, cached on our server	To suggest a version of your card in another language	Performance of the contract formed by the terms of use (GDPR, Art. 6(1)(b))
App updates	Each time the app opens, a request to the update service with an installation identifier, the app version and the phone system	To deliver fixes to the app	Legitimate interest: distributing app fixes (GDPR, Art. 6(1)(f))
Profile page visits	When someone opens a profile page through a QR code or a shared link: the date and time; how the page was opened (app QR code, shared link, image or PDF); the approximate city and country, inferred from their IP address at the time of the visit, the address not going into our statistics; the device type, system, browser and language; a fingerprint computed from the address and the browser, kept with the visit, with a key destroyed every day at 00:30 (Morocco time), after which nobody can compute it again; actions on the page (call, WhatsApp, add to contacts…). If the person refuses the measurement, we only keep the date and how the page was opened	To measure the audience of each profile page for its owner and for us	Legitimate interest: knowing the audience of cards and improving the service, with a right to object, in every country (GDPR, Art. 6(1)(f))
Website cookies	On opemacards.com, a cookie remembers the language you choose, for 12 months. On the account deletion page, a 10-minute cookie carries your request in progress, then another, kept as long, remembers that it went through. On a profile page, a 12-month cookie remembers a refusal of visit measurement. No analytics or advertising cookie	To show the website in your language, to carry a deletion request through, to remember a refusal of visit measurement	Legitimate interest: running the website; strictly necessary cookies (GDPR, Art. 6(1)(f))
Reports	The reported card, the reason, your explanation, your statement of good faith and its date, the page language and, if you give them, your name and email address; the decision, its reasons and the date they were sent; for the card's owner, their account's verified email address	Reviewing the report, acknowledging it, informing you of the decision, and sending the owner the statement of reasons	Legal obligation for what the EU Digital Services Act requires (GDPR, Art. 6(1)(c)); legitimate interest in protecting users and the service in other cases (Art. 6(1)(f))
Protection against abuse	A fingerprint of your IP address or email address, computed with a secret key and kept for 1 hour at most; the address itself is not stored. For reporting a contact, a fingerprint of your account, kept for 1 hour at most. For translation suggestions, a fingerprint of your account and the number of characters sent to the service, kept for 24 hours at most	To limit the number of requests and protect the service	Legitimate interest: keeping the service secure (GDPR, Art. 6(1)(f))
Technical logs	IP address, date, address requested, browser, kept by our hosting provider	To run and troubleshoot the service	Legitimate interest: keeping the service secure (GDPR, Art. 6(1)(f))
Contacts	The contacts received from your profile page or swapped in the app (first name, last name, phone, email address, company, job title, message, date and city of the meeting) and the note you write on each. A copy is kept on your phone, so you can read your contacts without an internet connection. You can save a contact to your phone's contacts: the app opens your phone's form, filled in, and you are the one who saves it; the app does not read your phone's contacts and sends us nothing	Find the people you met and get back in touch with them	For you: performance of the contract formed by the terms of use (GDPR, Art. 6(1)(b)). For the people whose details it holds: their consent given to the exchange (GDPR, Art. 6(1)(a)), then your legitimate interest in keeping a contact you received lawfully (GDPR, Art. 6(1)(f))
Card exchange from a profile page, for the person who sends their card	The first name, last name, phone or email address, company, job title and message entered; the city inferred from the IP address, which is not recorded; the language of the page; the date and version of the consent; the link with the visit to the page that preceded the exchange, if it was measured. If the card holder has blocked you, your submission is neither passed on nor kept; your name and a fingerprint of your email address and phone number stay with us until the block is lifted or their account is deleted. If the card holder reports your submission, your name, email address, phone number and message are copied into the report and kept for 24 months after it is received, so that it can be reviewed	Pass these details on to the card holder, and keep proof of the exchange and of the consent	Consent: you tick the consent box yourself, never ticked in advance (GDPR, Art. 6(1)(a)); after a withdrawal, proof of your consent is kept so that it can be demonstrated (GDPR, Art. 7(1) and 6(1)(c))
Blocking a contact	The name of the contact you block, and a fingerprint of their email address and phone number, computed with a secret key; the address and number are not kept for this block	Refuse their future card submissions to you, and show you your list of blocked contacts	For you: performance of the contract formed by the terms of use (GDPR, Art. 6(1)(b)). For the blocked person: your legitimate interest in no longer receiving their submissions (GDPR, Art. 6(1)(f))
Reporting a contact	The name, email address, phone number and message of the contact you report, with your account identifier, kept in our database	Review the report and reach a decision	Legitimate interest: protecting users and the service (GDPR, Art. 6(1)(f))
Push notifications	Your device's notification token, kept with your device; for each notification, its title and text: the first name, last name and company of the person who left you their card	Let you know when someone leaves you their card	Performance of the contract formed by the terms of use (GDPR, Art. 6(1)(b)), once you have allowed notifications on your phone. For the person named in the notification: their consent given to the exchange from a profile page (GDPR, Art. 6(1)(a)), or the swap they asked for themselves in the app (GDPR, Art. 6(1)(b))
Card swap in the app	The card you give and the one you receive: first name, last name, company, job title, phone and email address, copied in each card's opening language; the date; the city inferred from your IP address, which is not recorded; the link between each contact and the other member's card and account; the opening of their card from the app, with a fingerprint of your account computed with a key destroyed every day at 00:30 (Morocco time), counted in their statistics without anything that identifies you. If either of you has blocked the other, the swap does not take place and nothing is kept	Put each person's card in the other's contacts, and let the other member know	Performance of the contract formed by the terms of use, for you and for the other member (GDPR, Art. 6(1)(b))

How long we keep it

Data	Duration
Details, cards and images	As long as your account exists. When the account is deleted: profile page switched off immediately, data erased no later than 30 days after your request
Device account with no email address and no activity	Deleted after 24 months without activity
Code received by email	10 minutes
Profile page visits and actions	36 months, then only anonymous counts; the fingerprint stays with the visit, the key that computes it is destroyed every day
Cookie refusing visit measurement	12 months
Proof of your agreements	While the account exists, then 5 years, on a record that no longer carries any other data about you
Database backups	30 days at most: erased data may remain in them for up to 30 days after it is erased
Technical logs of the hosting provider	30 days
Email sending logs at our email sending service	30 days at most
Fingerprints for protection against abuse	1 hour at most
Count of characters sent for translation	24 hours at most
Translation suggestions cached on our server	28 days at most, counted from when they were computed, never extended
Texts sent to the automatic translation service	Held briefly in memory for the time of the translation, neither kept nor reused by this service
Reports	24 months after they are received
Name and email address of the person who reports	Erased as soon as the decision is notified to them, and at the latest 6 months after the report
Link of your card	Kept with no data at all after erasure, so that it is never given to anyone else
Your contacts, notes included	As long as you keep them; erased from our servers no later than 30 days after they are deleted or your account is deleted, and from your phone when the app is reset
Card exchange from a profile page	36 months after the exchange, or until the card holder's account is deleted if that comes first. If the person withdraws their consent, their details are erased from our exchange records, where only proof of the consent and of its withdrawal is kept, for 5 years; if the card holder reported their submission, the report keeps a copy of their details and message until 24 months after it is received. The copy received by the card holder stays in their contacts, on our servers, for as long as they keep it
Blocking a contact	Until you unblock them or your account is deleted, even if you delete the contact
Reporting a contact	24 months after it is received, then erased from our database; this data stays kept during that time even if you delete the contact or your account
Notification token	As long as your device is connected to your account; erased when the device is disconnected, when your account is deleted, or when the notification service reports it as invalid
Notification awaiting delivery	24 hours at most, if your phone cannot be reached
Notification sending task	Deleted as soon as it is sent; if it fails, kept 7 days, with the contact identifier only
Contacts swapped in the app	Like the other contacts in your list; the link to the other member's card is removed when their account is deleted, and the copy received stays in your contacts. The opening of their card from the app is kept 36 months, like profile page visits

Who receives your data

Recipient	Role	Data	Area
Anyone who has your link or your QR	They view your profile page	What you published on your card	Everywhere
The holder of the card	They view the audience of their profile page, once the statistics screen arrives in the app	Visits to their profile page, as statistics, with nothing that identifies a visitor	Everywhere
Our hosting provider	Hosting of the service and its data; technical logs; backups	Your account, your card, your agreements, your contacts, the exchanges received, the logs	European Union; company established in the United States
Our image storage provider	Image storage	Photo and logo of your cards	European Union
Our email sending service	Sending codes and communications by email; delivery logs	Your email address, the message sent, the date and status of its delivery	European Union; company established in the United States
Our automatic translation service	Translation suggestions for the fields of your card, when you ask for them	The fields to translate and the two languages, sent by our server, without any identifier of your account or your phone. Technical data about our server's requests stays with this service under its own rules	Worldwide, on the service's global infrastructure; company established in the United States
The app update service	Distribution of app updates	Installation identifier, app version, phone system, and the IP address of the request	United States
The card holder you send your card to	They receive your details in their contacts	What you entered for the exchange, the date and city of the meeting	Everywhere
Our notification sending service	Routing notifications to your phone	The notification token, the notification's title and text	United States
Your phone's notification service	Delivering the notification on your phone	The notification token, the notification's title and text	Worldwide; company established in the United States
The other member you swap cards with	They receive your card in their contacts, and a notification	First name, last name, company, job title, phone and email address of the card you give, date and city of the meeting	Everywhere

Some of these recipients process data outside the European Union, the European Economic Area or the United Kingdom: the next section says which safeguard each of these transfers relies on. We do not pass your data to anyone else, unless the law requires it. For any question about these recipients, write to contact@opemacards.com.

Transfers outside the European Union

For the data of people living in the European Union, the European Economic Area or the United Kingdom, each transfer outside those countries relies on one of the safeguards below.

Recipient	Zone	Safeguard
Our hosting provider	European Union; company established in the United States	transatlantic Data Privacy Framework and its UK Extension; otherwise, the European Commission's standard contractual clauses
Our email sending service	European Union; company established in the United States	transatlantic Data Privacy Framework and its UK Extension; otherwise, the European Commission's standard contractual clauses
Our automatic translation service	Worldwide; company established in the United States	transatlantic Data Privacy Framework and its UK Extension; otherwise, the European Commission's standard contractual clauses
The app update service	United States	transatlantic Data Privacy Framework and its UK Extension; otherwise, the European Commission's standard contractual clauses
Our notification sending service	United States	transatlantic Data Privacy Framework and its UK Extension; otherwise, the European Commission's standard contractual clauses
Your phone's notification service	Worldwide; company established in the United States	transatlantic Data Privacy Framework and its UK Extension; otherwise, the European Commission's standard contractual clauses

We ourselves process your data from Morocco, which is not covered by a European Commission adequacy decision. The GDPR, or the UK GDPR, applies directly to us for this processing, and you exercise the rights described below with us. You can get more details about these transfers by writing to contact@opemacards.com.

Security

Exchanges between the app, the website and our servers are encrypted (HTTPS).
Images are kept in private storage: they are only served by our service, while the card is online.
Codes sent by email are not kept in plain form, and expire after 10 minutes or five attempts.
Each device has its own session; deleting the account closes them all.

Your profile page is public and opens on the Internet, an open network: the data you publish there travels without any guarantee of security and may be read and used by third parties.

Your rights

You can access your data, have it corrected or erased, ask for processing to be restricted, receive the data you gave us in a structured, machine-readable format (portability), and object to processing based on our legitimate interest. Where processing relies on your consent, you can withdraw it at any time, without affecting what was done before. You can edit your details in the app at any time.

For communications from OPÉMA and its partners: you stop them or turn them back on at any time in the app, from the Account screen, and you can also stop them through the link in every message or by writing to us.

The person who opens a profile page can refuse the measurement of their visits through the link at the bottom of the page, or through the Global Privacy Control setting of their browser. A visit does not let us recognise who made it, unless they then send their card from that page: the exchange then keeps the link with that visit. We cannot find their other visits to show them or erase them (GDPR, Art. 11).

If you sent your card to a user from their profile page, you can withdraw your consent by writing to contact@opemacards.com, with the email address or number you gave: we erase your details from our exchange records. If the card holder reported your submission, the report keeps a copy of your details and message until 24 months after it is received, so that it can be reviewed. The copy received by the card holder stays in their contacts; you can ask them to delete it.

To exercise your rights, write to contact@opemacards.com. We reply within one month; if your request is complex, this can be extended by two months, and we tell you so within the first month.

If you live in the European Union or the European Economic Area, you can lodge a complaint with the supervisory authority of the State where you live, where you work, or where the infringement allegedly took place. If you live in the United Kingdom, you can complain to the Information Commissioner's Office (ICO), ico.org.uk. Elsewhere, you can contact your country's data protection authority.

Minimum age

OPÉMA Cards is only for people aged at least 16.

Deleting your account and your data

Two ways, whichever you prefer:

in the OPÉMA Cards app: My cards, then Account, then "Delete my account";
without the app: on opemacards.com/suppression, with the code we send to the verified email address of your account.

A card whose account has no verified email address is deleted from the app. If you no longer have access to the app, write to contact@opemacards.com.

What happens next:

immediately: your profile page is switched off, QR codes already shared show "This card is no longer available", and all your sessions are closed;
no later than 30 days after your request: your details, your cards, their versions in other languages, your images, your devices and your email address are erased;
within the same period, your contacts are erased, notes included, as are the card exchanges received from your profile page, except the copy of a contact you reported (see below);
backups may still contain this data for up to 30 days after it is erased, and technical logs for 30 days.

What is kept:

the link of your card, with no data at all, so that it is never given to anyone else;
proof of your agreements (versions and dates), for 5 years;
the name, email address, phone number and message of a contact you reported, copied into the report, until 24 months after it is received, no longer linked to your account.

Deletion is permanent: we cannot restore a deleted account.

To delete a single contact without deleting your account: open it in your contacts, then "Delete this contact". It disappears from your contacts at once, and is erased from our servers no later than 30 days after the deletion reaches us (without an internet connection, it is sent when the connection returns).

Changes to this policy

This policy describes the processing in service at the date of its version. When a new feature processes other data, a new version is published on this page with its effective date, and the app asks you to accept it before you publish a new card.

Contact

For any question about your data: contact@opemacards.com.