Privacy Policy

1. Data controller

U-SITE S.A.S BIC, NIT 901.846.435-1, domiciled in Bucaramanga, Santander, Colombia (mailing address available on request at [email protected]). Phone: +57 316 895 0803. Email for personal data matters: [email protected]. Our support team handles requests and claims.

2. Data we collect

• Required at sign-up: email, password (hashed) and country, to create your account and show prices and payment methods for your region.
• Optional: name, company, phone, city and the information you choose to put on your cards (title, description, social links, photos, logo, links, AI agent).
• Payment: reference, amount, plan, date and status of each payment. Card data is processed by the gateway and never reaches our servers.
• Technical: IP address (to detect your country and, in the health directory, estimate your city without storing it), browser, language, access date and time, and cookies (see "Cookies and analytics").
• Card usage: we count visits and clicks (phone, WhatsApp, email, social, QR and VCF downloads) to show you statistics. Our statistics do not identify who visits your card; the analytics tools described below do collect technical data from visitors.
• If you sign in with Google, we receive your name, email and profile photo from that account.
• If you add a card to Apple Wallet or Google Wallet, we store a device identifier and a push token to keep it updated.
• Conversations with the dashboard AI assistant, so you can resume them; they are deleted when you delete your account.

3. Data you receive from third parties through your vCard

When a visitor shares their contact, books an appointment, leaves a review or pays you from your vCard, you are the controller of that data and U-site acts as processor: we host and process it on your behalf to deliver it to you, send service emails (confirmations, receipts and one review request) and, if you set it up, send it to your integrations (for example HubSpot, Zapier or Make). We only process that data for those purposes. Visitors can exercise their rights with you or by writing to [email protected].

4. Sensitive data (health sector)

Appointments a patient books with a health professional may include health-related information, which is sensitive data. We only process it with the patient's express authorization and to manage the appointment. Data subjects are not required to authorize the processing of sensitive data. We do not use this data for advertising or share it with anyone other than the chosen professional.

5. How we use data

• Create and manage your account, cards, mini-websites and collaborators.
• Process payments, activate plans, send billing notifications and calculate referral commissions.
• Send service emails: verification, account recovery, magic links, expiry notices and changes to these documents.
• Send people who shared their contact with you or paid you a single review request about the service (at most one every 90 days per card). You can turn it off in each card's editor.
• Send you, unless you object, commercial information about vCard plans and news, within the hours allowed by Colombian Law 2300 of 2023. You can stop these emails with the link in each email or by writing to [email protected].
• Show your card statistics, measure site usage and improve the platform.
• Prevent fraud and abuse (attempt limits, API call logs).

6. Authorization

We process your data with your prior, express and informed authorization, given when you sign up or submit a form, and to perform the service contract, under Law 1581 of 2012 and Decree 1074 of 2015. We keep proof of that authorization. If you reside in the European Union you may also exercise your GDPR rights by writing to [email protected].

7. Who we share data with

• Payment gateways (dLocal, PayPal, Bold): they receive email, amount and reference to process the charge, under their own policies.
• admin.u-site.app: U-site's internal system that handles payments and plans.
• Google (Gemini) when you use the dashboard AI assistant: your messages and basic account and card data are sent to answer you.
• Google Analytics (Google LLC) and the Meta Pixel (Meta Platforms, Inc.): see "Cookies and analytics".
• Infrastructure, file storage (Amazon Web Services) and email delivery providers.
• Apple and Google, if you add a card to their Wallet.
• AI assistants and integrations you connect via OAuth or your API key: they access your cards, statistics, reviews and received contacts only with the permissions you grant. You can revoke access at Help > AI assistant > Connected apps.
• Authorities, when required by law.

We do not sell your data or hand it to third parties for their own advertising.

8. International transfers

Several of the providers above are outside Colombia, mainly in the United States (Amazon Web Services, Google, Meta, PayPal and dLocal). We transmit data to them only to provide the service, and they are bound to keep it confidential and secure. By accepting this policy you authorize that international transmission and transfer.

9. Public cards and directory

• Each card has a unique URL and is visible to anyone with the link. You decide what to include and who to share it with.
• If you enable "appear in the directory", your name, title, company, city and photo are shown in the public search and may be indexed by Google. You can turn it off at any time; removal from search engines may take a while.
• You can hide your phone and email on the card from the editor.

10. Retention and validity

• We keep your data while your account exists and the purposes described last. When you delete it, we erase your profile and cards within 30 days; we keep payment records for as long as accounting and tax law requires.
• Technical and security logs are kept for up to 12 months.

11. Your rights

• Know, update and correct your data, including partial, inaccurate or incomplete data.
• Request proof of the authorization you gave us.
• Be informed of how we use your data.
• Revoke the authorization or request deletion of your data when there is no legal or contractual duty to keep it.
• Access your data free of charge.
• File complaints with the Superintendence of Industry and Commerce after completing the request or claim process with us.

You may exercise them yourself, through your successors, or through your representative or attorney, proving that capacity. Many changes can be made directly from your profile and cards.

12. Requests and claims

• Requests: write to [email protected]. We respond within ten (10) business days of receipt. If that is not possible, we will tell you why and give a new date, no more than five (5) additional business days.
• Claims (correction, update, deletion or non-compliance): send them to [email protected] with your name and ID, a description of the facts, the reply email or address and any supporting documents. If the claim is incomplete we will ask you to complete it within five (5) business days; if two (2) months pass without your reply, we will consider it withdrawn.
• We handle claims within fifteen (15) business days from the day after receipt. If that is not possible, we will tell you why and give a new date, no more than eight (8) additional business days. While it is processed, the data will be flagged as "claim in progress".

13. Security

• Encryption in transit (HTTPS) and hashed passwords.
• Protected dashboard routes, login attempt limits and per-user API keys you can regenerate.
• Unique identifiers for each card, preventing discovery without the link.
• Server access restricted by credentials and audit logs.

14. Cookies and analytics

We use necessary cookies (session, CSRF security, language and referral). We also use third-party cookies and tags: Google Analytics (Google LLC) to measure site usage, including visits to public cards, and, only if you accept it in the cookie notice, the Meta Pixel (Meta Platforms, Inc.) to measure conversions and show U-site ads. These providers may collect your IP address, browser or device identifiers and pages visited, and process them outside Colombia under their own policies. You can block or delete them from your browser, or opt out of Google measurement at tools.google.com/dlpage/gaoptout.

15. Minors

vCard is intended for people aged 18 and over. We do not knowingly collect data from children or adolescents; if we find that a minor gave us data, we will delete it.

16. Effective date and changes

This policy is effective as of October 16, 2026. If we change it substantially we will notify you by email and on the platform before the changes apply. The date above shows the current version.