Privacy Policy

1. Who we are

Openings is operated by Elbo Pte. Ltd., a company registered in Singapore ("Openings", "we", "us"). We provide digital business cards that you design in our app and share with a link or QR code. Elbo Pte. Ltd. is the controller of the personal information described here. You can reach us about anything in this policy at hello@openings.ai.

2. Information you give us

Account information: your email address and a password. Your password is stored only as a secure, one-way hash by our authentication provider; we can never see it.

Card information: the details you choose to put on your card — first and last name, job title, company, phone number, email address, website, LinkedIn profile, a short bio, your chosen template and colour, your link name (for example /c/your-name), and an optional profile photo and company logo. Photos and logos are resized on your phone before upload.

Business cards you scan: when you use Scan a business card, the photo you take or pick is sent to read the printed text. See section 5.

Messages you send us: if you email us, we keep the message and your email address so we can reply.

3. Information collected automatically

When the app or website talks to our servers, our hosting and database providers automatically record standard technical logs: IP address, device and browser type, date and time, and the page or action requested. These logs are used for security, abuse prevention and fixing errors, and are kept for a short period.

We do not use advertising identifiers, third-party analytics SDKs, ad networks, cross-app tracking or fingerprinting. We do not track you across other companies' apps or websites.

The app stores a small amount of data on your phone itself — your sign-in session (in the phone's secure storage) and an unsaved card draft — so you don't lose your work. This stays on your device.

4. Your card is public by design

The purpose of Openings is to share your card. Everything you put on your card can be seen by anyone who has your link or scans your QR code, and anyone who views it can save it to their own contacts or forward it. Only add details you are happy to share this way.

Your card is only reachable by its exact link — we do not publish a directory of cards and cards cannot be listed or searched through our service. However, once you share a link we cannot control where others send it.

Your login email and password are never shown on your card.

5. AI business-card scanning

When you scan a paper business card, the image is sent over an encrypted connection to our AI provider for the sole purpose of reading the name, company, title, phone, email and website printed on it. The extracted text is returned to your phone and placed in a form you review before saving.

Openings does not store the image or the extracted details on our servers. Our AI provider processes the image on our behalf and is not permitted to use it to train its models or for any other purpose.

The person on that card did not give their details to us. You are responsible for having a legitimate reason to save someone's contact details, which is normally the case when they handed you their card.

6. Your address book, camera and photos

Contacts: when you tap Save to contacts or Add someone, Openings opens your phone's own New Contact screen pre-filled with the details. The contact is saved by your phone. Openings never reads, uploads or stores your address book.

Camera: used only when you choose to photograph a business card.

Photos: used only when you choose a profile photo, logo or business-card image, and to save your QR image to your library if you ask us to.

You can withdraw any of these permissions at any time in your phone's Settings. The rest of the app keeps working.

7. How and why we use information (legal bases)

To create and run your account and show your card to people you share it with — necessary to provide the service you asked for (performance of a contract).

To read business cards you scan — at your request, as part of the service (performance of a contract).

To keep Openings secure, prevent abuse and spam, and fix problems — our legitimate interest in running a safe, reliable service.

To answer your questions and send essential service messages such as sign-up confirmation and password resets — performance of a contract.

To meet legal obligations, such as responding to lawful requests from authorities.

We do not sell your personal information, share it for cross-context behavioural advertising, or use it to build advertising profiles. We do not make decisions about you that have legal or similarly significant effects based solely on automated processing.

8. Who we share information with

We share personal information only with service providers that help us run Openings, under contracts that require them to protect it and use it only on our instructions:

• Hosting and database provider (Supabase) — stores your account and card and runs our servers.

• Website hosting (Cloudflare) — serves the public card pages and this policy.

• AI provider (accessed through a secure AI gateway) — reads scanned business-card images, as described in section 5.

• Apple and Google — distribute the app; their own privacy policies cover your use of their stores.

We may also disclose information if required by law, to protect the rights, safety or property of our users or others, or as part of a merger or sale of the business (in which case this policy will continue to apply or you will be notified).

9. International transfers

Our providers may process information in countries other than where you live, including the United States and the European Union. Where the law requires it, transfers are protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses.

10. How long we keep information

Account and card information: for as long as your account exists.

When you delete your account (Settings → Delete account), your card, its public link and your login are permanently deleted from our live systems immediately. Your link stops working at once. Residual copies in provider backups are overwritten within their normal backup cycle (typically within 30 days).

Technical logs: kept for a short period for security and debugging, then deleted.

Scanned business-card images: not kept.

Emails you send us: kept as long as needed to deal with your request.

11. Your rights and choices

You can view and edit everything on your card at any time in the app (Settings → Edit my card), and delete your account and all its data in the app (Settings → Delete account) or at https://openings.ai/delete-account.

Depending on where you live — including the European Economic Area, the United Kingdom, and US states such as California — you may also have the right to: access a copy of your information; correct it; delete it; receive it in a portable format; restrict or object to certain uses; and withdraw consent where we rely on it.

To use any of these rights, email hello@openings.ai from the address on your account. We will respond within one month (or the time the law requires) and will not treat you differently for exercising your rights. We may need to verify your identity first.

California residents: in the last 12 months we have collected identifiers (name, email, phone), professional information (title, company), and internet activity (technical logs), for the purposes in section 7. We have not sold or shared personal information as those terms are defined by the CCPA/CPRA.

If you are unhappy with how we handle your information, please contact us first. You also have the right to complain to your local data protection authority (for example the ICO in the UK or your EU national authority).

12. Security

Information is encrypted in transit (HTTPS) and at rest by our database provider. Access to card data is controlled so only you can change your card, and cards can only be opened by their exact link. Your sign-in session is kept in your phone's secure storage. No system is perfectly secure, so please use a strong, unique password; we check new passwords against known breached passwords.

13. Children

Openings is a professional networking tool and is not intended for anyone under 16. We do not knowingly collect information from children. If you believe a child has created an account, contact us and we will delete it.

14. Changes to this policy

We may update this policy as Openings changes. We will change the date at the top, and if a change is significant we will tell you in the app or by email before it takes effect.

15. Contact

Questions, requests or complaints: hello@openings.ai.