CardIndexer

Privacy Policy

Last updated: 8 September 2026

This Privacy Policy explains how JES WEB PTY LTD (ABN 38 667 034 148) ("we", "us", "our") handles personal information in connection with CardIndexer (the "Service"). We handle personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and, where applicable, the EU/UK GDPR.

1. Our privacy-first design

CardIndexer is built to hold as little sensitive data as possible. We store only what is needed to recognise a card: a label you choose, the card brand, the last four digits, and the expiry. We do not collect or store full card numbers (PAN), CVV/security codes, or PINs, and the browser extension does not capture card credentials you enter on merchant sites.

The extension runs on any site because a card can be charged on any merchant, but its scope is deliberately narrow. It performs no detection at all unless you are signed in — before that it reads nothing and sends us nothing. When signed in, it reads page text only to recognise that a checkout is happening and to pick up a masked card last-four already displayed on the page; it never reads payment fields, and it never runs inside a payment processor's iframe. Before any URL leaves your browser it is reduced to scheme, host and path, so query strings and fragments — which can carry session tokens or personal data — are discarded at the source. You can permanently disable the extension on any site with "Never on this site".

2. Information we collect

  • Account information: name, email address, and authentication identifiers (managed by our authentication provider).
  • Card metadata: the label, brand, last four digits, and expiry you add; and records of where and when a card was used (merchant, timestamp, whether a charge is recurring).
  • Payment-page activity: while you are signed in, the extension reports each payment page you reach — the merchant domain and the URL reduced to scheme, host and path — whether or not a payment completes, so you can see where a card may be saved. We retain this log only on plans that include payment-page tracking; on the Free plan the report is discarded when received and no record is kept.
  • Billing information: processed by Stripe. We receive limited billing metadata (for example plan, status, and the last four digits of your billing card from Stripe); we do not receive your full payment card number.
  • Usage and device data: log data, IP address, browser type, and similar technical information.

3. How we use information

We use personal information to provide and operate the Service, authenticate you, process payments, provide support, maintain security, comply with legal obligations, and improve the Service. Where we rely on consent (for example certain cookies), you may withdraw it at any time.

4. Disclosure

We disclose personal information to service providers who help us run the Service (see our Sub-processors list), including hosting, database, authentication, and payment providers. We may disclose information if required by law or to protect our rights and users. We do not sell your personal information.

5. Overseas disclosure

Some of our service providers may store or process data outside Australia (for example in the United States or the European Union). Where we disclose information overseas, we take reasonable steps to ensure it is handled consistently with the APPs.

6. Security

We use technical and organisational measures to protect personal information, including encryption in transit (TLS) and access controls scoped to your account or organisation. Our minimal-data design means a breach would not expose full card numbers. No method of transmission or storage is completely secure, however.

7. Retention

We retain personal information for as long as your account is active or as needed to provide the Service, and thereafter as required for legal, accounting, or security purposes. You can request deletion as described below.

8. Your rights

Subject to applicable law, you may access, correct, or request deletion of your personal information, and export your stored data (CSV/JSON) from within the Service. You may also object to or restrict certain processing. To exercise these rights, contact privacy@cardindexer.com. If you are in the EU/UK, you have rights under the GDPR, including the right to lodge a complaint with a supervisory authority.

9. Cookies

We use cookies and similar technologies as described in our Cookie Policy.

10. Children

The Service is not directed to children under 18 and we do not knowingly collect their personal information.

11. Changes

We may update this Policy from time to time and will post the updated version with a new "Last updated" date.

12. Contact and complaints

For privacy questions or complaints, contact privacy@cardindexer.com or write to JES WEB PTY LTD (ABN 38 667 034 148), 1/26 Ellingworth Parade, Box Hill VIC 3128, Australia. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC).