How vision5 looks after data.
What we hold, where it runs, who else touches it, and how it goes away. Everything here describes the service as it runs today.
Two kinds of data, two owners.
Yours
Your account, your teams, the cards you build and the photos on them. EvolvLabs, LLC decides how this is used, and is its controller under the GDPR.
Theirs
The details a person chose to send back to your team. They belong to your team. We hold them on its behalf, as its processor and service provider.
The person who only opens your card leaves nothing that identifies them: no cookie, no stored IP address, no third-party script.
Built in, not bolted on.
Nothing tracks the visitor
Public cards set no cookies, store no IP addresses and load no third-party scripts. They work with JavaScript switched off.
Two domains, kept apart
You sign in at app.vision5.com. Cards are served from vision5.cc, which sets no cookies and can't see a sign-in.
Every team is kept separate
Each team's photos and published cards sit under their own keys. Nothing in one team's store can be listed from another.
Careful sign-in
Passwords are stored only as hashes. Repeated wrong passwords lock the account for a while. Sessions can be ended.
Off in a minute
Removing a member, deleting a card or taking one down takes it offline everywhere within a minute.
One way in
The service only answers requests that come through our network edge. Secrets live in a managed secret store, and sign-in keys are encrypted.
Where it runs, and who else touches it.
Everything runs in the United States. These providers process data for us under their data processing terms.
| Provider | What it does | Where |
|---|---|---|
| Google Cloud | Runs the service, the database and the file store | Iowa, United States (us-central1) |
| Cloudflare | The network in front of vision5: encryption, addresses and attack protection | Its global network |
| Resend | Sends account email: sign-in, invitations and notices | United States |
If your team connects HubSpot, Salesforce or a webhook, new contacts go there too, because you asked. That system's own terms apply.
How it goes away.
You can export everything a team holds as one file, and delete anything from the app.
- NowA deleted card, contact or member disappears from the app at once, and from the web within a minute.
- 14 daysA deleted team or account can still be restored. Published cards keep serving, and editing stops.
- 30 days laterContent is purged, including backups. Only the address stays reserved, for twelve months, so a printed code can't lead to someone else.
GDPR and CCPA rights, built in.
Export a team's data in one file. Delete a card, a contact or an account from the app. Set how long contacts are kept. Everyone who sends their details gets a receipt link to ask for deletion. We never sell personal information. The privacy statement has the details.
Your part, and ours.
We run the service, keep teams apart, enforce who can see what, and fix what goes wrong. Your team decides who to invite, what role each person has, and how long contacts are kept: anywhere from 30 days to two years.