NemKad Privacy Policy
Effective date: 31 October 2026
Last updated: 2 November 2026
1. Who we are
NemKad is operated by NEMKAD SOLUTIONS, registration number 202603223322 (003882261-V), with its registered address at No. 22-2, Jalan Prima Setapak 3, Taman Setapak, 53300 Kuala Lumpur, Malaysia ("NemKad", "we", "us", "our").
We are the data user (data controller) responsible for your personal data under the Personal Data Protection Act 2010 ("PDPA").
Privacy contact: admin@nemkad.com
2. What this policy covers
This policy explains how we collect, use, store and share personal data when you:
- create a NemKad account and card ("Card Owner");
- view someone's card, save a contact, or send an enquiry through a card's Contact me form ("Visitor");
- use NemKad AI or Write with AI ("AI User");
- join the Affiliate Program ("Affiliate"); or
- join a waitlist for a feature ("Waitlist Member").
3. Personal data we collect
3.1 Data you give us
- Account data: email address, display name, username, and whether you opted in to tips emails. If you sign in with Google, we receive your name, email and profile picture from Google.
- Card content: everything you put on your card, including name, title, company, photo, banner, phone, WhatsApp, email, links, social profiles, bio, and showcase items. For phone, WhatsApp and email, you choose whether each is public, for connections only, or private. Your email address is never shown to visitors.
- Connections: connection requests, optional notes (up to 140 characters), and who invited you if you used an invite link.
- Messages: messages sent and received in Messages, timestamps, read status (unless you disable read receipts), message requests, and reports you make.
- Enquiries: your name, email address, message, the card it was sent to, and the time. Without an account, you confirm your email address and read replies through a private link we email you (valid 30 days).
- NemKad AI: what you type, the assistant's replies, card drafts, Helpful / Not helpful ratings, message usage counts, and a topic label for each question. We do not send your private data (such as your account details or card content) to the AI provider. Only the text you type into the chat box, or into the Write with AI fields, is processed. You should not include personal data of yourself or others in your prompts.
- Support: your email, topic, message, the page you were on, and (if you choose) the chat.
- Affiliate data: referral link and code, referrals, commission records, and bank details for payouts (account name, bank, account number).
- Waitlist: email address, feature of interest, and date.
3.2 Data collected automatically
- Server logs: IP address, browser type, pages requested, and timestamps, kept for security and debugging.
- Rate limits: a salted hash of your IP address (not the IP itself) to limit Contact me messages and AI use.
- Product activity: card view counts, link taps, and events like "card claimed" or "banner uploaded".
- Analytics: anonymous page-view and performance statistics through Vercel Web Analytics and Speed Insights (no cookies).
- Push notifications: the push address your browser provides, if you allow notifications.
3.3 Data from others
- Paddle (our reseller for Premium) tells us your order and subscription details: plan, price, discount, status, renewal and payment dates, billing country, and the email on the order. We never receive your full card number.
- Google provides sign-in data if you choose Google sign-in.
- Other members, when they send you a connection request, message or enquiry.
3.4 Cookies
We use the following cookies:
| Cookie | Purpose | Duration | Type |
|---|---|---|---|
| Sign-in session | Keeps you signed in | Until you sign out or it expires | Essential |
| NemKad AI visitor | Remembers a visitor's chats and daily limit | 30 days | Essential |
| Cookie choice | Remembers your cookie choice | 12 months | Essential |
| Visit statistics | Counts visits and where they came from (for example a shared link or QR code), without identifying you | 7 to 30 days | Non-essential |
| Invite | Credits the member who invited you | 7 days | Non-essential |
| Affiliate referral | Credits the member whose link you used | 60 days | Non-essential |
We do not use advertising or cross-site tracking cookies.
Cookie consent: When you first visit NemKad, a cookie notice will appear explaining our use of cookies and asking for your consent to non-essential cookies. You may accept or decline non-essential cookies, and change your choice at any time with Cookie settings at the bottom of every page. Essential cookies (required for the Service to function, such as sign-in sessions) cannot be declined.
3.5 What not to share
We do not ask for identity card or passport numbers, bank card details, or sensitive personal data (such as health or religious beliefs). Please do not put them on your card, in messages, or in NemKad AI.
Important for NemKad AI: Do not include any personal data (yours or anyone else's) in your prompts. This includes names, contact details, identity card numbers, financial information, health information, or any other sensitive data. The AI processes only the text you type, and that text is sent to our AI provider. You are responsible for what you choose to type.
4. Why we use your data
| Purpose | Data used |
|---|---|
| Provide the Service | Account, card content |
| Run connections, messages and enquiries | Connections, messages, enquiries |
| Run NemKad AI | The text you type into the chat (prompts and replies) |
| Send service emails and notifications | Account, messages, push address |
| Send tips and news (only if you opted in) | Email, your choices |
| Run Premium (checkout, billing, refunds) | Paddle order details |
| Run the Affiliate Program | Affiliate data, referral cookie |
| Keep the Service safe | Logs, hashed IP, bot check results |
| Improve the Service | Product activity, analytics, AI topic labels |
| Comply with law | Any of the above, as needed |
We process your data with your consent (when you create an account, send an enquiry, use NemKad AI, or join a waitlist), to perform our contract with you, to comply with law, and for our legitimate interest in running a secure service.
5. What is public, and what others see
- Your card is public by design. Everything on it (except contact channels set to "connections only" or "private") can be seen, copied, or saved by anyone with your link, and may be indexed by search engines. You can turn search indexing off in your card's Privacy settings.
- Connections: when you ask to connect, the owner sees your name, picture, card (if any), email and note. Once connected, each of you sees the other's "connections only" channels.
- Save contact: a visitor who taps Save contact gets your name, company, title, photo, card link, headline and bio, but not your phone, WhatsApp or email.
- Enquiries: the card owner sees your name, email address, message, and whether you confirmed your email. The owner's email address is not shown to you.
- Messages are private to the people in the conversation. We do not read them, except that our team may review a reported conversation.
6. Who we share data with
We do not sell personal data. We share it only with:
| Who | What for | Where |
|---|---|---|
| Supabase | Database and sign-in | Singapore |
| Vercel | Hosting and anonymous analytics | Singapore (primary) and other regions |
| Cloudflare | DNS, network security, storage of photos and banners, bot checks | Global network |
| Resend | Sending emails | Japan and the United States |
| Sign-in, if you choose it | Global | |
| Browser push services | Delivering notifications you allowed | Global |
| Paddle.com Market Limited | Reseller and Merchant of Record for Premium for buyers outside the United States; processes payments as an independent controller | United Kingdom |
| Paddle.com Inc. | Reseller and Merchant of Record for Premium for buyers in the United States; processes payments as an independent controller | United States |
| AI service providers | Generating NemKad AI replies from the text you type into the chat | Outside Malaysia |
| Other users | As described in section 5 | — |
| Authorities | Where the law requires, or to protect rights and safety | — |
| A successor | If NemKad is sold or merged; this policy continues to apply | — |
Our service providers process data only on our instructions and are bound by contract to protect it.
Cross-border transfers. Some of our service providers store and process personal data outside Malaysia, including in Singapore, Japan, the United States, and other locations. In particular, the text you type into NemKad AI is processed by our AI service provider outside Malaysia. We choose providers with recognised security practices and contractual safeguards. Where required under section 129 of the PDPA, we rely on your consent or another lawful basis for these transfers.
7. How long we keep data
| Data | Retention |
|---|---|
| Account and card | While your account exists. After deletion: live systems within 30 days, backups within 90 days |
| Connection requests | Declined: 12 months. Accepted: while connection exists. Removed: 90 days |
| Messages | While conversation exists; deleted 90 days after removal, block, or account deletion |
| Ignored message requests | 90 days |
| Reports | 12 months |
| Enquiries | Until card owner deletes them. Senders can ask us to remove theirs |
| AI chats (signed in) | Until you delete them or 12 months after last message |
| AI chats (visitor) | 30 days unless you sign up |
| AI chat emails you asked for | Your email until you unsubscribe; unconfirmed requests 7 days |
| Support requests | 24 months |
| Waitlist | Until you unsubscribe or 12 months after the feature launches |
| Push addresses | Until you turn notifications off or the push service says they expired |
| Billing records | While your account exists, then 7 years (tax and accounting law) |
| Affiliate commission and payout records | 7 years |
| Affiliate bank details | 90 days after leaving the program |
| Server logs | Up to 90 days |
8. Security
Data is encrypted in transit (TLS) and at rest by our providers. Access to production data is limited to people who need it. Contact details marked "connections only" or "private" are enforced on our servers, not only hidden in your browser. No system is perfectly secure. If a personal data breach occurs, we will notify the Personal Data Protection Commissioner and, where required, affected users within the timelines the PDPA sets.
9. Your rights
Under the PDPA you may:
- access the personal data we hold about you;
- correct it;
- withdraw consent (we may then be unable to provide parts of the Service);
- ask us to stop using it for marketing;
- ask for a copy in a portable format, from the date that right comes into force.
Most of this you can do yourself in the dashboard. For anything else, email admin@nemkad.com. We reply within 21 days. We may charge the fee the PDPA allows for access requests and will verify your identity first.
If you are unhappy with our reply, you can complain to the Personal Data Protection Commissioner of Malaysia (pdp.gov.my).
10. Children
The Service is for people aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has an account or card, contact us and we will remove it.
11. Changes to this policy
We will post changes here and update the date above. For material changes we will email account holders before they take effect. Continued use after that date means you accept the updated policy.
12. Contact
NEMKAD SOLUTIONS
202603223322 (003882261-V)
No. 22-2, Jalan Prima Setapak 3, Taman Setapak, 53300 Kuala Lumpur, Malaysia
admin@nemkad.com