Privacy policy

Who we are

Prestige Connect is operated by Prestige Graphics Inc., 20 Hanlan Road, Unit 17, Woodbridge, Ontario L4L 3P6, Canada.

This policy covers cards.prestigegraphics.ca and the Prestige Connect service. For anything in it, write to info@prestigegraphics.ca.

Which of two situations you are in

You signed up yourself. We decide what is collected and why, and we answer to you for it. Ask us directly.

Your employer or another organization gave you a card. They decide what goes on it. We hold and display it on their instructions, and they can see and change your details. Ask them first. If you ask us, we will pass your request on and help them answer it.

What we collect

Your account. Your email address, and a password stored as a hash that cannot be turned back into your password. If you sign in with Microsoft, Google, Apple or Facebook, we receive your name and email address from them and nothing else.

Your card. Whatever you or your organization puts on it: name, preferred name, pronouns, job title, department, accreditations, a line about what you do, company, phone number, email address, website, street address, extra links, and a photo if one is uploaded. An organization also stores an accent colour and a logo.

Details handed back. When somebody reads a card and sends their own details in return, we store the name, email address, phone number, company, job title and note they entered, and the email address of the person whose card they used.

How often a card is viewed. One number per card per day.

What we use it for

• Showing your card to anyone who opens its link, and building a Wallet pass or a contact file when somebody asks for one.
• Signing you in and keeping you signed in.
• Letting an organization's administrators manage its cards, and letting you edit your own.
• Passing a contact to the organization whose card captured it.
• Counting how often a card is viewed, and showing that number to the card holder and their administrators.
• Answering you when you write to us, and telling you about changes to the service or to these documents.

We do not use your information for anything else.

What we do not do

• We do not use analytics, advertising or tracking technologies of any kind.
• When somebody views a card we add one to a daily count. We do not record who they were, their IP address, their device or their location.
• We do not buy personal information about you, and we do not add to your details from outside sources.
• We do not sell personal information, and we do not share it for advertising.
• No artificial intelligence service receives your card details or your contacts. Nothing in the product sends them anywhere.

Where your data is kept

The database is in the Canada Central region and it does not leave. Your account, your cards, your contacts and any photo you upload are stored there, at rest, in Canada.

Pages are delivered through Vercel's content delivery network, which has servers around the world. When somebody opens a published card, the content of that card travels through, and can be briefly held on, infrastructure outside Canada.

Sign in codes are sent through Resend, a mail service in the United States, so your email address passes through it to reach you.

Who else handles it

This list is current as of the date at the top of this page. We update it when it changes.

Cookies

One cookie, which keeps you signed in. It is strictly necessary and does not require consent. Signing out removes it.

There are no advertising or analytics cookies, and this site has no consent banner.

If you do not have an account

Your information can be here in two ways without you ever signing up.

Somebody made a card for you. Your employer or another organization entered your details. They control that card. Ask them, and see the section above on which situation you are in.

You sent your details back after reading a card. Those details went to the person whose card you read and to their organization. They are not shown on any public page.

To have them removed, write to info@prestigegraphics.ca from, or quoting, the email address or phone number you gave. We will find the record, delete it, and tell the organization holding it. We do this whether or not you have an account with us.

How long we keep it

• Your account and your cards are kept until you delete them. You can delete your account, or close an organization, from inside the product without asking us.
• Deleting removes the record from the live database straight away.
• A complete copy of the database is taken automatically once a day, and the last seven copies are kept before being overwritten. A deleted record can therefore still exist in a backup for up to seven days.
• Contacts belong to the organization that captured them. They outlive the card they came in through and the person who captured it, and they are deleted when the organization is closed, or on request as described above.
• View counts are kept indefinitely. They are a number per card per day and identify nobody.

Your rights

You can ask to see the personal information we hold about you, have it corrected, or have it deleted. You can withdraw your consent, and you can complain.

Most of this you can do yourself. Your details, your photo and your links are editable in the product, and you can delete your account without asking us.

For anything else, write to info@prestigegraphics.ca. We respond within 30 days, which is what Canadian privacy law requires. If your card is controlled by an organization, we pass your request to them and help them answer it.

How we protect it

• Everything travels over an encrypted connection, and is encrypted where it is stored.
• The database decides for itself who may read each row, rather than trusting the application to ask correctly. A signed-in person can reach their own organization's data and nothing else.
• The only thing readable without signing in is a published card, and only the fields meant to be public.
• The address of a card is random rather than sequential, so a card cannot be found by guessing and an organization's staff list cannot be enumerated.
• Published cards are not indexed by search engines, on any plan. Anyone with the link can still open one.

No system is perfectly secure, and we do not hold a security certification.

Who at Prestige can see client data

Prestige staff, and the tools they use, can access client data in order to set up an organization, import a staff list, and provide support. We do not read cards or contacts otherwise.

If something goes wrong

If personal information is lost or exposed, we assess it. Where there is a real risk of significant harm we notify the people affected and report it to the Office of the Privacy Commissioner of Canada, as Canadian law requires. Where a client organization's data is involved, we tell that organization without delay so they can meet their own obligations.

Age

Prestige Connect is a tool for working professionals and is not directed at anyone under 18. We do not knowingly collect personal information from anyone under 18, and we delete it if we find we have.

Questions and complaints

Write to info@prestigegraphics.ca. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

If your card came from an Ontario hospital, school board, municipality or other public sector organization, you can also contact the Information and Privacy Commissioner of Ontario at ipc.on.ca.

Changes to this policy

The date at the top of this page is when it last changed. If we make a change that affects you materially, we will tell you by email or on the site before it takes effect.