Privacy policy

This translation is provided for convenience; the French version prevails. Read the French version.

Who are we?

nacard publishes digital loyalty cards and passes for merchants. nacard is a service of MADRA, a SAS with a share capital of €1,000, registered with the Paris Trade and Companies Register (RCS) under SIREN number 990 410 391, whose registered office is located at 200 Rue de la Croix Nivert, 75015 Paris, France. Contact: hello@nacard.io.

What data do we collect?

• Customers of businesses: first name, phone number (optional), visit history (stamps), technical pass identifier. Collected when your loyalty card is created.
• Merchants: email, business name, billing data.
• Prospects (contact form): name, business, email, message (requests sent before October 2026 may include a phone number).

What for?

• To make your loyalty card work (legal basis: performance of a contract).
• To send you the merchant's offers by pass notification or SMS, only if you have ticked the consent box (legal basis: consent, which can be withdrawn at any time: every SMS contains an unsubscribe link).
• To get back to merchants who request it via the form (legal basis: pre-contractual measures).

Who has access to it?

The merchant who issued your card (only its own customers), and our technical subprocessors: Supabase (database, hosted in the EU), Netlify (hosting), Apple/Google (wallet passes), Twilio (SMS sending, only if you have given consent). We never sell data.

For how long?

As long as your card is active. If the card is deleted or the business closes: erasure within 30 days. Contact requests are kept for a maximum of 12 months.

Your rights

Access, rectification, erasure, withdrawal of consent: write to hello@nacard.io or ask your merchant directly (they can delete your record in two taps). You can also lodge a complaint with the CNIL (the French data protection authority).

Cookies

The nacard.io website does not set any advertising cookies or third-party trackers.