Privacy notice (Draft · Pending legal review)

This document is a draft for MVP trial operations and is not the final Privacy Policy. Retention periods, processing delegation, and user notification wording must be finalized before official launch.

All2Wallet uses all2wallet.com as its primary domain. Historical n2w.generaltype.com card and QR links remain available. Both use the same production service; this move does not transfer ownership or reissue your Wallet card. Sign-in and consent cookies are host-only, so you may need to sign in and choose your preferences again on the new domain. The N2W Lab landing page is not a sandbox connected to a copied production database.

Operator and contact

Operator: 뉴브리드
Contact: info@nubrid.com

Items collected and used, and their purposes

We store the name, company, title, department, office phone, mobile phone, email, address, website and logo entered for a card. Only permitted fields are shared. Shared office phone numbers appear only in contact QR/vCard and VCF, not on the card face or public profile. Addresses and websites are not published. Personal Apple Wallet cards can be downloaded as signed passes and added on iPhone. Employee and enterprise Apple issuance remain closed pending separate approval. Enterprise accounts also process administrator email and employee rosters.

Member sign-in and your cards

We use the selected NAVER or Kakao provider and its unique user identifier to manage an internal member ID, account status, sign-up time and ownership of your cards. We do not collect or store sign-in email, name or profile information. Provider access tokens are used only within the authentication request and are not stored long term. Accounts from different providers are not automatically merged.

Member sessions and authentication requests

Sign-in sessions are valid for 7 days. OAuth state and card-draft return references are valid for 10 minutes. These are validity lifetimes, not deadlines guaranteeing physical deletion. Expired rows are cleaned up on related requests. Signing out removes that session.

Account withdrawal and deletion receipts

Account withdrawal removes the operational account, linked provider identifiers, member sessions and member-owned personal card data, and attempts to unlink the provider. Incomplete deletion or unlinking is reported separately. To reapply deletions after a backup restore, a separate journal outside the app and public root stores keyed HMACs instead of original identifiers, a timestamp and a random ID. Maximum backup and journal retention periods are not yet determined; immediate final destruction is not guaranteed. This does not delete external Wallet Objects, device copies, recipients’ contacts or Google save history.

Restore procedure and limits

When restoring the app or database, the operator must preserve the latest deletion journal and matching key separately from the restore target, reapply the journal in an offline recovery environment and verify that no matching targets remain before reopening the site. A full snapshot restore of the same server can also roll back the journal and key, so this arrangement does not guarantee independent preservation. Existing unresolved retention and processing arrangements remain unresolved.

Guest card retention

For newly created guest cards notified of this rule, server access expires 24 hours after creation, even if edited or reissued. A cleanup job runs every minute; failures are flagged for the operator and retried. Cards explicitly imported into a member account before expiry are preserved. Signing in alone does not claim a guest card. Historical cards without this notice are not bulk-deleted under this rule.

Server links stop working at expiry and server data is automatically cleaned up. Wallet cards, direct contact QR codes and contacts already saved on devices are not remotely deleted.

Public Scope

The contact QR contains a public profile link or a vCard. Public cards and profiles show the name, company when visible, title, department and shared mobile phone and email. Contact vCards and VCF also include shared office phone numbers. When a logo hides the company name, profiles and contact files hide its text too. Office phone numbers are excluded from the card face and public profile; addresses and websites remain private even on older cards with sharing enabled. A QR containing a vCard or a saved contact cannot be recalled. Issuance links are private: anyone who knows one can open the card. No-index and no-cache headers cannot prevent recipients from sharing copies.

Access Log

For service operations, we log the IP address, time, request method, and response status. New access logs do not record URL paths or secret issuance tokens. Existing pilot logs are restricted to operators, and the log retention period is pending.

Delete

Personal business cards can be deleted at any time from the issuance page. Enterprises can delete by employee or for the entire organization. Deletion removes the corresponding information and profile page from the production database. The timing of deletion from backup copies cannot be guaranteed until the retention policy is finalized. Cards already saved to Wallet and contacts saved by recipients cannot be deleted by the server. Temporary data from employee list uploads is blocked from access immediately upon confirmation/cancellation or after 24 hours, and is deleted by a cleanup job running every 5 minutes.

When using a business account

Businesses uploading employee personal data are responsible for notifying employees of collection and usage and obtaining necessary consent or legal basis (clarification of processing delegation relationships is pending before official launch).

Optional advertising and privacy

AdSense code is prepared for this domain, but ad requests remain disabled until its site review and consent configuration are verified. Verification metadata and ads.txt do not mean the site is approved.

Google AdSense Auto ads are used on the public home and new-card form. Placement, formats and ad count depend on Google Auto ads and Auto optimize settings; there are no fixed manual slots. No ad code is included on secret management or issuance pages, personal profiles, Wallet or error pages. The service does not add card inputs, raw QR content or secret links to advertising request URLs or advertising or analytics events. This does not guarantee that third-party advertising SDKs collect no information.

On the public home and new card form, the AdSense loader and consent-management connections may start before a choice is made, sending IP address and browser information to Google. Loading the SDK does not mean consent was obtained. Google’s published consent message and official ad tag handle ads according to the applicable region and consent choices. The service does not fabricate a region or consent status. It pauses ad requests and removes ad displays when an explicit rejection, error, consent change or withdrawal is received. This does not guarantee that all third-party SDK communications stop. Card features are available regardless of advertising choices.

Ad privacy settings in the footer show the current Google consent status. The separate privacy notice link provides more information. Google choices can only be reopened when an actual applicable-region signal and the Google reset API are both ready. Not ready, errors, and an explicit non-applicable signal are shown separately; an unknown state is not treated as a non-applicable region. Opening the information panel alone does not change consent or ad request status. Reopening settings or withdrawing consent pauses requests and removes ad displays; requests are not resumed again within that document. On the home page, stopping ads after a consent change opens a new ad-free document. The form preserves input without navigation or additional storage. This does not guarantee that all communications from already loaded Google scripts terminate, and requests already sent cannot be recalled. Advertising choices are separate from consent to transfer data to Google Wallet. How Google uses information from partner sites

Optional visit analytics

Google Analytics is used on the public home and privacy notice pages. Before you allow analytics cookies, consent mode may send limited cookieless visit signals, IP and browser information to Google. If you allow visit analytics, analytics cookies are used and page visits, time spent, browser and device information, and online identifiers may be sent to Google. Card editing, issuance, administration and personal profile pages are not measured. Card contents, secret links, URL queries and referring page addresses are not included in analytics events. Ad personalization and Google Signals are disabled. Your choice is saved in this browser and can be withdrawn in the footer under Ad and analytics settings. Turning it off deletes the related analytics cookies in this browser and stops further measurement. Data already sent cannot be recalled. Card features work regardless of your analytics choice.

Undetermined items

The retention periods for operational data and backups and third-party processing arrangements must be finalized before official launch. Employee roster upload and finalization remain suspended because separate database backup and recovery verification is incomplete. Do not enter actual employee data.