Your work is not raw material.

Only what the relationship requires.

The information Cards receives depends on how you interact with the service. It may be provided directly by you, created through normal product use, or generated by the systems required to operate Cards.

To provide the service people asked for.

Cards uses information to operate and secure accounts; coordinate work; maintain project, review, time, financial, and client-facing records; respond to beta and support requests; send service communications; investigate errors; prevent abuse; maintain backups; and meet legal obligations.

Cell phone numbers submitted through public forms are used for the purpose stated beside the field. Beta applicants may separately and optionally consent to transactional SMS about their application, onboarding appointments, and beta milestones, and may separately consent to promotional SMS about product updates, launch announcements, pricing, and offers. Consent is not a condition of applying for or participating in the beta. Message frequency varies; message and data rates may apply. Reply STOP to opt out or HELP for help. Opting out of one SMS purpose does not withdraw consent for a different purpose unless you ask us to do so.

Access is limited by purpose and context.

Information may be visible to authorized members of your organization according to their role and the work they are permitted to access. Client users receive client-visible records connected to the projects and reviews shared with them, rather than unrestricted access to internal workspace information.

Cards uses service providers for application hosting and delivery, database, authentication, private storage, transactional email, beta relationship management, appointment scheduling, SMS delivery, error and availability monitoring, meeting integration, malware scanning, and CardBot processing. These providers receive only the categories of information needed to perform their services under their own governing terms.

Mobile information and SMS consent are not sold or shared with third parties for their own marketing or promotional purposes. They may be disclosed to service providers that help Cards deliver messages you requested, subject to purpose and confidentiality restrictions.

Cards may disclose information when legally required, to protect the service or people from harm, or as part of a business transaction subject to appropriate notice and safeguards. Cards does not sell personal information.

Keep what supports the record. Remove what no longer should.

Retention depends on the type of information, why it was collected, the choices of the organization controlling the workspace, operational and legal requirements, and the need to preserve an accurate history of work.

• Active workspace information is generally retained while the account or customer relationship remains active.
• Removed attachments are recoverable for 30 days before the binary is deleted. A minimal history marker may remain so the work record does not silently change.
• Backup copies may persist for a limited recovery period before aging out through the backup lifecycle.
• Some audit, billing, legal, fraud-prevention, and security records may be retained when necessary to meet legitimate obligations.

Monitor the system, not the person.

Cards uses authentication, workspace isolation, role and permission boundaries, private file storage, server-validated commands, protected audit history, malware scanning, controlled support access, encrypted off-site backups, and separate staging and production environments.

Cards monitors application errors and service availability. Session replay is disabled, and performance tracing remains disabled pending a separate privacy review. No system can guarantee that an incident or outage is impossible; current operational boundaries are described in more detail on the Trust page.

A service built for workplace use.

Cards is intended for organizations and workplace users, not children. We do not knowingly collect personal information from children through the service.

When this policy changes, Cards will update the effective date and provide additional notice when a change materially affects how information is collected, used, or shared.