Privacy Policy

Effective 25 October 2026

This policy explains how INSTROSOFT SDN. BHD. (“Cardly AI”, “we”, “us”), a company registered in Malaysia, handles personal data when you use the Cardly AI mobile apps, the website at cardly.omsrim.org, public card and business pages, and the business directory (together, the “Service”). We are the data controller for the personal data described here.

1. Data we collect

Data you give us

Account: name, email address and password. Passwords are stored only as a one-way Argon2 hash. Operator accounts also store an encrypted two-factor authentication secret.
Sign in with Google or Apple: if you choose it, Google or Apple tells us your account ID with that provider, your email address (with Apple this can be a private relay address) and, where you allow it, your name. We don't receive your Google or Apple password or any other data from those accounts.
Cards and organisations: what you put on your cards, such as name, role, business, phone, WhatsApp, email, website, location, services and brand colours, plus organisation and team membership details.
AI introductions: the introduction script you approve and your chosen voice, accent and video settings.
Directory listings: business details, opening hours, menus, photos and location that merchants submit.
Appointments: when someone requests an appointment, their name, contact details, preferred time and message are shared with the card owner.
Reviews and reports: reviews, owner replies and content reports you submit.
Support: messages you send us, for example to [email protected].

Data collected automatically

Card and listing analytics: views, saves, taps and shares. Each visitor is represented by a one-way hash of their IP address and browser details, combined with a secret key, so we can count unique visitors without storing who they are. We do not store the IP address with analytics.
Server logs: our web server records IP address, time, requested page and browser details for security and troubleshooting. These logs are deleted after 14 days.
Device data: app version, device type and operating system, used to keep the app working on your device.

Purchases. Payments are handled by Apple (App Store), Google (Google Play) or Stripe (website). We never receive your full card number. We receive a transaction or subscription identifier, the plan, its status and renewal dates so we can unlock your plan.

We do not use advertising trackers, sell personal data, or build advertising profiles.

2. On-device processing

AI scripts are generated on your device from the fields you have filled in. Card details are not sent to any third-party AI service.
Narration uses the voices installed on your device.
Location: if you tap “Use my location”, your device provides your position with your permission. Your coordinates are sent with that directory search only to return nearby results and are not stored. You can choose a city instead.
Sign-in tokens are kept in your device’s secure storage (Keychain or Keystore).

3. How we use data

To create your account and provide the Service, including publishing the cards and listings you choose to share.
To process subscriptions and unlock plan features.
To deliver appointment requests and send service emails such as verification, sign-in security and appointment updates.
To show card owners and organisation admins analytics for their own cards.
To moderate the directory, prevent fraud and abuse, and keep the Service secure. This includes audit logs of administrative actions.
To respond to support requests and meet legal obligations.

4. Legal bases

We process personal data in line with Malaysia’s Personal Data Protection Act 2010. Where other laws apply, such as the GDPR for users in the EU or UK, we rely on:

contract: to provide the Service you signed up for;
legitimate interests: security, fraud prevention, aggregate analytics and improving the Service;
consent: for example device location, which you can withdraw at any time in your device settings;
legal obligation: for example tax records for payments.

We share personal data only with providers who help us run the Service, under agreements that require them to protect it:

Amazon Web Services: hosting and database (Sydney, Australia region) and email delivery (Amazon SES).
Cloudflare: network delivery, security and bot protection (Turnstile).
Apple and Google: app distribution and in-app purchases.
Stripe: payments made on our website.
OpenFreeMap / OpenStreetMap and Apple Maps: map display. Your device requests map images directly from these services, which receive your IP address as part of that request.

We may also disclose data if required by law, to protect the rights and safety of users or the public, or as part of a merger or acquisition (we would tell you first). Otherwise we share it only with your consent.

6. Public content

Cards you publish, directory listings, and reviews or owner replies are public by design. Anyone with the link can see them, and anyone can save a copy of a card to their phone. Publish only what you are comfortable sharing. Unpublishing a card stops its link working, but cannot recall copies others have already saved.

7. International transfers

Our servers are in Australia, and our providers may process data in other countries. Where data leaves Malaysia (or your own country), we take steps required by applicable law to ensure it receives a comparable level of protection.

8. Retention

Account data: kept while your account is active.
Deleted accounts: unpublished immediately and permanently erased after a 30-day grace period. Reviews you wrote show as “Former customer” during the grace period and are then deleted, with business ratings recalculated.
Analytics events: kept for up to 400 days, then deleted.
Server logs: 14 days.
Payment and tax records: kept as long as the law requires.

9. Security

We protect data with:

encryption in transit (HTTPS);
hashed passwords;
encrypted storage of sensitive secrets;
short-lived sign-in tokens;
rate limiting;
mandatory two-factor authentication and bot protection for staff access;
audit logs of administrative actions.

No system is perfectly secure. If a breach affects you, we will notify you and the authorities as the law requires.

10. Your rights

Depending on where you live, you can ask to:

access your data;
correct it;
delete it;
receive a copy (portability);
restrict or object to certain processing;
withdraw consent.

You can export your data and delete your account directly in the app (Profile). For anything else, email [email protected]. We reply within 21 days, as required by the PDPA, or sooner where local law requires. You may also complain to your data protection authority. In Malaysia, that is the Personal Data Protection Commissioner.

11. Deleting your account

In the app, go to Profile → Delete account. Your cards are unpublished straight away and your account is erased after 30 days. You can also request deletion without the app at cardly.omsrim.org/account/delete or by emailing [email protected].

Deleting your account does not cancel an App Store or Google Play subscription. Cancel it in your store account settings to stop renewals.

12. Children

The Service is not intended for children under 13, or under the minimum age required in your country. We do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes

We will post any changes on this page with a new effective date, and tell you in the app or by email before material changes take effect.

INSTROSOFT SDN. BHD., Malaysia · [email protected] · See also our Terms of Service.