Who we are
vision5 is run by EvolvLabs, LLC, a Maryland limited liability company at 6028 Monroe Ave, Sykesville, MD 21784, USA. For your account, your teams and this website, we decide how your information is used; in GDPR terms we are the controller. Write to privacy@evolvlabs.ai about anything in this statement.
Who decides about the contacts a team collects
When someone sends their details back through a card, those details belong to the team that owns the card. The team decides what to do with them, and we hold and process them on the team's behalf; in GDPR terms the team is the controller and we are its processor, and under the CCPA we are its service provider. A request about those details goes to that team, and the visitor's receipt link reaches it directly. If you write to us instead, we pass the request to the team.
What we hold about you
Your email address, your password as a hash, your team memberships and roles, the cards you build and every version you published, the photos you uploaded, and a record of your active sign-in sessions. Team owners and administrators can see the team's cards, its contacts and its audit history.
What we hold about your visitors
A published card sets no cookie, stores no IP address and loads no third-party script. When someone opens a card we count the delivery attempt and its source — a QR code, an NFC tap, an email signature or a plain link. We do not estimate unique visitors and we do not fingerprint. A contact file download is counted as an attempt; it does not prove the visitor saved you. IP addresses and browser details are used in memory to filter bots and limit abuse, then discarded.
If the exchange is on and a visitor sends their details back, we keep what they typed, because that is the point of the exchange. They get a receipt link that lets them ask your team to delete it, without seeing anything else.
This website
vision5.com runs no analytics or tracking scripts and sets no cookies. Our network provider, Cloudflare, keeps standard technical logs of requests to it, such as IP address and browser type, to deliver and protect the site.
Why we use it
- To run your account and your cards, because you asked us to: in GDPR terms, to perform our contract with you.
- To keep the service secure, stop abuse and count card views without identifying anyone: our legitimate interest, which does not override yours because nothing identifies the visitor.
- To send the email you need: sign-in, verification, invitations and notices you turned on.
- To meet a legal obligation, when the law requires it.
We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use it to train AI models.
Where it is kept
In a database and a private file store on Google Cloud in the United States. Card photos and published card files are held per team, and nothing in one team's store can be listed from another. Public card pages are served without any cookie, from a different domain than the console.
Who else sees it
These providers process information for us, under their data processing terms:
- Google Cloud: hosting, the database and file storage, in the United States.
- Cloudflare: the network in front of vision5, which delivers pages and blocks attacks.
- Resend: email delivery.
If your team connects a webhook, HubSpot or Salesforce, accepted exchanges are sent there and that system's own terms apply. We disclose information when the law requires it, and it would pass to a buyer if EvolvLabs were sold, under this statement. Nothing else is shared, and nothing is sold.
How long
Published card versions: the newest twenty per card. Analytics events: ninety days, after which only daily totals remain. Audit history: one year. Contacts: for as long as the team keeps them, or the retention period the team sets. Deleted teams, accounts and cards are purged after their fourteen-day cancellation period; addresses stay reserved for twelve months so a printed code cannot be reissued to someone else.
What you can ask for
Export everything a team holds, as one file, from Settings. Delete a card, a contact, a team or your whole account from the console. A visitor who used the exchange can ask for deletion through their receipt link. For anything else, write to privacy@evolvlabs.ai from the email address on your account, so we know the request is yours. We answer within the time the law allows, and we never treat you differently for asking.
If you are in the EEA, the UK or Switzerland
The GDPR, or the law that mirrors it where you live, gives you the right to access your information, to correct it, to delete it, to restrict or object to how we use it, to receive it in a portable form, and to withdraw consent you gave. You can also complain to the data protection authority where you live or work. We answer within one month.
If you are in California
The CCPA gives you the right to know what personal information we collect, use and disclose, to get a copy of it, to correct it and to delete it. Over the last twelve months we collected: identifiers such as your email address; the professional details you put on a card; the details visitors chose to send back; and counts of card deliveries that identify no one. Your password is used only to sign you in.
We do not sell or share personal information as the CCPA defines those words, and have not in the last twelve months, so there is nothing to opt out of; a Global Privacy Control signal is honoured all the same. You may use an authorised agent, who must show us your signed permission. We answer within forty-five days, and we never treat you differently for using these rights.
Children
vision5 is for adults at work. It is not directed at anyone under sixteen, and we do not knowingly collect their information. If you think a child has given us theirs, write to us and we will delete it.
Security
Every connection is encrypted. Passwords are stored only as hashes, secrets are kept in a managed secret store, and each team's files are kept apart from every other team's. The service answers only through our network edge. No system is perfectly secure; if a breach affects you, we will tell you as the law requires. Report a security problem to security@evolvlabs.ai.
Information outside the United States
We are based in the United States, and information is processed there. Where the law requires a safeguard for a transfer from your country, we rely on our providers' data processing terms, which include the European Commission's standard contractual clauses.
Changes
When this wording changes, the version is raised and you are asked to read and accept the new one before continuing. Every version you accepted is kept, with its text.
Contact
Privacy requests: privacy@evolvlabs.ai. Security: security@evolvlabs.ai. Post: EvolvLabs, LLC, 6028 Monroe Ave, Sykesville, MD 21784, USA.
This is the same wording the app asks you to accept. Every version you accepted is kept, and you can read it again in the app. See also the terms of service.