Privacy

Last updated: October 9, 2026.

Who is responsible

POCCard is operated by Alexander Lugo, 1711 W Francis Ave, Midland, TX, United States. Contact: [email protected]

Where to write

For any request about your personal data (access, export or deletion) write to [email protected].

What we store

• Your account: email, name and your chosen language. The email is your identity here.
• Signing in with Google or Facebook, only if you choose it: they tell us your name, your email and an identifier of your account with them, and nothing else. We do not post anything, and we do not see your contacts, friends or activity. Revoke it whenever you want from your Google or Facebook settings; to delete what we keep, use Delete my account.
• What you publish: the contents of your cards and sheets (business card, vehicle, pet, health), including photos you upload. You write it, you decide what is public, and you can delete it.
• Health information: allergies, conditions, medication and emergency contacts you choose to enter on a Health card, for you or for someone in your care. It is only shown on the private emergency page you turn on, behind an address that cannot be guessed.
• Your vehicle: VIN, specifications, maintenance and, if you add them, plate and an emergency phone. The vehicle sheet is never indexed by search engines.
• Your contacts: the details people leave you through your card and the cards you scan. That is information about other people: you are responsible for having a reason to keep it.
• Purchases: name, email, country and what you bought, and your shipping address only if you order something physical. Payments are handled by Stripe or PayPal; we never see or store a card number.
• Interpreter: your credit balance and its movements. The audio is translated live and is not recorded; the text of a room lasts at most two hours and is deleted when the room ends.
• Affiliates: your commissions and, if you give them, the details to pay you.
• Visit counters: no IP address and no cookie. Each visitor becomes a salted code that changes every day (and every month for monthly counts), plus approximate city, device type, operating system and browser. Kept for 13 months.

Why we use it, and on what basis

• To provide the service you asked for (your account, your cards, your purchases, sign-in links): performance of our contract with you.
• Health information and anything you publish about yourself or someone in your care: your explicit consent, which you give by entering it and can withdraw by deleting it.
• Analytics cookies (Google Analytics) and purchase attribution: your consent in the European Union and the United Kingdom; elsewhere, our legitimate interest in knowing how the site is used, which you can refuse in the cookie settings or with Global Privacy Control.
• Security (bot checks, rate limits, error logs): our legitimate interest in keeping the service and your account safe.
• Accounting records (orders, refunds, credits, commissions): legal obligations.

We do not sell personal data and we do not use it for advertising.

Who processes it for us

• Hostinger (United States): hosting of the site, the database and the backups.
• Cloudflare (United States): content delivery, protection against attacks, bot checks and aggregated traffic statistics.
• Stripe and PayPal (United States): payments and refunds.
• Brevo (France): sending our emails.
• Google (United States): Google Analytics, only with your consent where it is required; and the Gemini model that reads a card you scan.
• Anthropic (United States): backup reader for scanned cards.
• OpenAI (United States): live translation and voice for the interpreter.
• NHTSA (U.S. Department of Transportation): receives only the VIN you decode.

Each one receives only what it needs for that task. A scanned image is discarded as soon as it has been read.

Where it is stored

Our servers are in the United States. If you use POCCard from the European Union, the United Kingdom or elsewhere, your data is transferred to the United States. We rely on each provider’s safeguards for international transfers, such as certification under the EU–U.S. Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

How long we keep it

• Your account and what you publish: until you delete it or close your account.
• Visit counters: 13 months.
• A room of the interpreter: at most two hours.
• Accounting records, anonymised after your account is closed:

Interpreter credit ledger entries are kept for five years after the account is deleted, anonymised (no name or e-mail), to meet accounting obligations, and purged afterwards.

Affiliate commission and payout records are kept for five years after the account is deleted, anonymised, to meet accounting obligations, and purged afterwards. Payout details (bank account) are deleted together with the account.

Backups are kept for up to eight weeks, so something you delete disappears from them within that time.

Your rights

You can ask to access, correct, download or delete your data, to restrict or object to how we use it, and withdraw any consent you gave. Most of it you can do yourself: edit your cards at any time, and use Download my data or Delete my account in your account settings. We confirm every request by email and complete it within 30 days. For anything else, write to the address above. If you are in the European Union or the United Kingdom, you can also complain to your data protection authority.

Children

POCCard is not directed to children, and we do not knowingly collect personal information from anyone under 13 (under 16 in the European Union). If you are a parent or guardian and think a child has given us information, write to the address above and we will delete it. What a parent or guardian enters about a minor in their care, such as a Health card, stays in that adult’s account.

Security

Everything travels encrypted (HTTPS), passwords are stored as one-way hashes, and sign-in links expire after one use. Private pages, such as an emergency page, are reached only through addresses that cannot be guessed.

Cookies

The full list, with what each one is for and how long it lasts, is on the cookies page.

Changes

If we change this policy in a way that matters, we will say so on this page and, if you have an account, by email.