The
fine print.

This policy explains what Cardpager collects, how we use it, and the rights you have. We process personal data in line with the General Data Protection Regulation (GDPR).

Data controller

Cardpager is operated by FEAD Mühendislik Ltd. Şti., a company registered in Türkiye. Cardpager is the data controller for the personal data described here. Privacy and data protection inquiries: [email protected].

What we collect

• Account: email address, username, display name, and the photo, location, and public email you choose to add. Theme and color choices.
• Content: the social links and blocks you add to your card.
• Messages: the text of messages sent to you through the pager, plus a one-way keyed hash derived from the sender's IP address and device signals. The raw IP address and the raw device signals are never stored — only the hash, which we use to rate-limit and block abuse.
• Network: if you send a pager message while signed in, you and the recipient are added to each other's contact list — the recipient as accepted on yours, you as a pending request on theirs (they can accept or ignore it). Anonymous messages don't create a contact entry. A contact entry never includes your message text, IP, or device signals — only the fact of the connection.
• Stats: page views, link clicks, and pager interactions for your own dashboard.
• Account history: a record of past usernames and email-change events for accountability.

How we use it

• To provide your card, inbox, and dashboard.
• To deliver messages and build your contact list.
• To enforce rate limits and stop abuse.
• To show you stats about your card's performance.
• To send transactional emails you need to receive (sign-up confirmation, password reset, account changes).

Legal basis

We process most data under GDPR Article 6(1)(b) — performance of the contract you enter into when you create an account. IP and fingerprint logging for abuse prevention is processed under Article 6(1)(f) — legitimate interest in keeping the service safe.

Where data is processed

We don't run our own data centres. Personal data is processed by the third-party infrastructure providers listed below, in the regions those providers operate — we don't commit to a specific processing region ourselves. Each provider is used only as necessary to operate the service.

Sub-processors

• Supabase — database and authentication. Stores account, content, and message data.
• Vercel — application hosting and scheduled jobs (e.g. message expiry, deletion).
• Cloudflare — network proxy, file/image storage (R2), the bot-protection challenge (Turnstile), and email routing.
• Resend — transactional email (sign-up confirmation, digests, account notices).
• Sentry — error monitoring. When a client-side error happens, a masked recording of the on-screen session (all text and media hidden) may be captured to help us debug. It is not used for analytics or tracking.
• Telegram — internal alerting only. Abuse reports and moderation flags, including the reported username, are sent to our admin chat. No other user data is sent to Telegram.

Data retention

• Messages: 7 days (free) or 30 days (Pro), then automatically deleted.
• Stats: 90 days, then deleted.
• Account data: kept while your account is active.
• Deactivated account: your card is hidden immediately and data is preserved. Self-service reactivation isn't available yet — email [email protected] to reactivate, or request deletion at any time.
• Deleted account: Free accounts are purged 7 days after the deletion request. Pro accounts are purged at the end of the current paid subscription, unless you choose to forfeit the remaining time.

Your rights

Under GDPR you can access, correct, or delete your data; restrict or object to processing; and request a portable copy. Most of these are self-service from Settings: change email, change password, change username, deactivate, or permanently delete your account. For anything else, write to [email protected].

You also have the right to lodge a complaint with a data protection supervisory authority in the EU member state where you live, work, or where the alleged infringement occurred. A list of EU supervisory authorities is available at edpb.europa.eu.

Reporting illegal content

Under the EU Digital Services Act (Article 16), anyone may report a card or message used for illegal activity — including impersonation, harassment, fraud, CSAM, or spam. Email [email protected] with the username and a short description. We review every report and act under applicable law and our Acceptable Use rules below.

Law enforcement requests

We respond to valid legal requests from competent authorities. Disclosure is limited to the minimum data described in the request and required by law. Where lawful, we notify the affected user before disclosure.

Data breach

In the event of a breach affecting your rights and freedoms, we will notify the relevant supervisory authority within 72 hours, as required by GDPR Article 33.

Age

Cardpager is not intended for users under 16. By creating an account, you confirm you meet this minimum age.

Cookies

We use only essential cookies needed for sign-in and the bot protection challenge. We do not use cookies for advertising or cross-site tracking.

By creating an account or using Cardpager, you agree to these terms. If you do not agree, do not use the service.

Eligibility

You must be at least 16 years old to use Cardpager. By signing up you confirm that you meet this requirement.

Your account

• You are responsible for keeping your account secure.
• Usernames are first come, first served. You may change your username up to two times per 30 days; old URLs stop working immediately and the freed handle becomes available to others.
• You may not impersonate another person, brand, or organisation.
• One active account per person. Creating multiple accounts to circumvent bans, abuse free-tier limits, or impersonate others is prohibited.

Your content

You own the content you put on your card — links, blocks, text, photo. You are responsible for making sure it does not break any law or third-party rights.

You grant Cardpager a non-exclusive, worldwide, royalty-free licence to host, store, display, and transmit your content as necessary to operate the service. This licence ends when you delete the content or your account; we may keep limited backups for the technical retention periods listed in the privacy section.

Messages (Pager)

• Messages can be sent anonymously by default. You can switch your pager to Members-only or Closed in Settings.
• Senders are limited to one message per IP per minute. Anonymous senders are limited to three messages per IP per day.
• Messages are kept for 7 days (free) or 30 days (Pro), then automatically deleted.
• You can report or delete any message you receive. Reported messages may lead to bans on the sending device.

Free and Pro

• The free plan is free forever.
• Pro is billed annually at $36/year. There is no monthly option.
• Pro renews automatically at the end of each 12-month period at the then-current price for new subscribers. We notify you by email at least 14 days before each renewal.
• 14-day full refund, no conditions. Within 14 days of purchase you may request a full refund for any reason — whether or not you activated Pro, whether or not you used it. No waiver, no checkbox, no forfeited right. See Refund below for how it works and what happens to your account.
• Outside the 14-day window, no refunds are issued for partial subscription periods — see Refund below.
• There's no self-service cancel button yet — email [email protected] to cancel. Your account stays on Pro until the end of the current paid year, then reverts to free.
• Your subscription price is locked while your subscription is active. Price increases apply only to new subscribers with at least 30 days notice.

Account lifecycle

• Deactivate hides your card from public view immediately. Self-service reactivation isn't available yet — email [email protected] to reactivate.
• Delete permanently removes your account and all associated data. Free accounts are deleted 7 days after the request — you can cancel during that window. Pro accounts are scheduled to delete at the end of the current paid subscription, so you can use what you paid for. You may instead choose to delete immediately and forfeit the remaining time.

Termination

We may suspend or close accounts that violate these terms or the Acceptable Use rules below. No refund is issued for terminated accounts, except that the 14-day refund described in Refund below still applies if you are within 14 days of purchase.

Limitation of liability

Cardpager is provided "as is", without warranty of any kind. To the maximum extent permitted by law, we are not liable for indirect, incidental, or consequential damages arising from your use of the service. Mandatory consumer rights in your country of residence are not affected.

Governing law

These terms are governed by the laws of Türkiye, where FEAD Mühendislik Ltd. Şti. is registered. If you are a consumer, the mandatory consumer protection laws of your country of residence still apply.

Changes

We may update these terms from time to time. Material changes are announced on this page and, where required, by email. Continued use after the updated date is acceptance of the new terms.

Contact

Questions: [email protected].

This applies to Pro, Cardpager's only paid plan, billed annually at $36/year.

14 days, no conditions

Within 14 days of purchase you may request a full refund for any reason — whether or not you activated Pro, and whether or not you used it. There is no waiver to sign and no right you give up by using Cardpager during those 14 days. The window starts on the purchase date.

Why it works this way

Cardpager Pro is a subscription service — you pay for continuous access to your page, your pager, and your messages, not for a file we hand over once. Under EU consumer law the right of withdrawal for a service ends only when the service has been fully delivered; for an annual plan that is the end of the paid year. So there is nothing for you to give up when you start using Pro, and we never ask you to. The Pro embed is a small HTML file that points back at cardpager.com — it holds no copy of your card and shows nothing on its own, so it does not change this.

What happens after a refund

When your refund is approved, we move your account back to Free ourselves — it does not close it. Your card, your handle, and everything you've built stay exactly as they are. You keep using Cardpager on the free plan; you lose the longer message retention until you resubscribe.

After 14 days

The subscription runs for the paid year. There's no self-service cancel button yet — email [email protected] to cancel renewal. Your account stays on Pro until the end of the current paid year, then reverts to Free. No partial refund is issued for the unused months.

How to request

Email [email protected] with your username and your request. There is no self-service refund button yet — every request is handled by a person.

These rules apply to every account, every card, and every message sent through the pager. Violations lead to suspension, closure, or — for serious cases — a report to law enforcement.

Prohibited use

• CSAM — child sexual abuse material. Zero tolerance. Reported to law enforcement immediately.
• Harassment and threats — targeted abuse, threats of violence, sustained harassment.
• Doxxing — publishing someone's private identifying information without consent.
• Extortion or blackmail — demanding money or conduct under threat.
• Fraud, phishing, scams — deception intended to obtain credentials, payment, or identity information.
• Self-harm encouragement — content that promotes suicide, self-injury, or eating disorders.
• Intellectual property infringement — copyright, trademark, or other IP violation.
• Spam — unsolicited bulk messaging or automated sending.
• Identity misrepresentation — pretending to be a person, brand, or institution you do not represent.
• Illegal activity — any use that breaks applicable law.

Self-hosted embeds

Pro users can download an HTML bundle of their Cardpager card and deploy it on their own domain (e.g. alex.com). The card is rendered in the user's browser via our public embed loader, which fetches live card data from our servers. These rules apply to embeds:

• No impersonation — your card profile (display name, title, bio, links) may not imitate banks, payment providers, government services, or major brands. Daily automated checks flag matches.
• No phishing or credential harvesting — via link blocks, on your card, or anywhere your embed is deployed. Link URLs are checked daily against public phishing databases.
• Ban kills the embed — if your account is banned for abuse, the public embed API returns 404 for your handle. Any external site serving your card renders blank immediately.
• Your hosting, your responsibility — Cardpager does not host or provision SSL/CDN for your custom domain. You choose the host (Netlify, Vercel, Cloudflare Pages, etc.) and bear responsibility for any abuse complaints they receive.

Reporting abuse

Email [email protected] with the username and a short description. Verified complainants (companies, institutions, or individuals with proof of identity) should attach supporting documentation. Every report is reviewed and recorded.

Enforcement

• Confirmed violations result in suspension or closure without refund — the 14-day refund window is the only exception.
• CSAM violations are reported to the relevant authority without exception.
• Repeated violations from the same device against the same recipient may lead to that device being permanently blocked from messaging them again.
• All enforcement actions are logged with reason for audit and transparency, in line with EU DSA Article 17.

Appeals

If your account is suspended or closed and you believe it was a mistake, you may appeal within 30 days by emailing [email protected] from the verified email on the account. Include the username and your reasoning. We respond within 14 days. Successful appeals reinstate the account; unsuccessful appeals stand.