Privacy Policy

Last updated: [DATE]

This Privacy Policy explains how JES WEB PTY LTD (ABN [ABN]) ("we", "us", "our") handles personal information in connection with CardIndexer (the "Service"). We handle personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and, where applicable, the EU/UK GDPR.

1. Our privacy-first design

CardIndexer is built to hold as little sensitive data as possible. We store only what is needed to recognise a card: a label you choose, the card brand, the last four digits, and the expiry. We do not collect or store full card numbers (PAN), CVV/security codes, or PINs, and the browser extension does not capture card credentials you enter on merchant sites.

2. Information we collect

• Account information: name, email address, and authentication identifiers (managed by our authentication provider).
• Card metadata: the label, brand, last four digits, and expiry you add; and records of where and when a card was used (merchant, timestamp, whether a charge is recurring).
• Payment-page activity: on paid plans, a log of payment pages you reach, so you can see where a card may be saved. URLs are stored without query strings or fragments.
• Billing information: processed by Stripe. We receive limited billing metadata (for example plan, status, and the last four digits of your billing card from Stripe); we do not receive your full payment card number.
• Usage and device data: log data, IP address, browser type, and similar technical information.

3. How we use information

We use personal information to provide and operate the Service, authenticate you, process payments, provide support, maintain security, comply with legal obligations, and improve the Service. Where we rely on consent (for example certain cookies), you may withdraw it at any time.

4. Disclosure

We disclose personal information to service providers who help us run the Service (see our Sub-processors list), including hosting, database, authentication, and payment providers. We may disclose information if required by law or to protect our rights and users. We do not sell your personal information.

5. Overseas disclosure

Some of our service providers may store or process data outside Australia (for example in the United States or the European Union). Where we disclose information overseas, we take reasonable steps to ensure it is handled consistently with the APPs.

6. Security

We use technical and organisational measures to protect personal information, including encryption in transit (TLS) and access controls scoped to your account or organisation. Our minimal-data design means a breach would not expose full card numbers. No method of transmission or storage is completely secure, however.

7. Retention

We retain personal information for as long as your account is active or as needed to provide the Service, and thereafter as required for legal, accounting, or security purposes. You can request deletion as described below.

8. Your rights

Subject to applicable law, you may access, correct, or request deletion of your personal information, and export your stored data (CSV/JSON) from within the Service. You may also object to or restrict certain processing. To exercise these rights, contact [privacy@cardindexer.com]. If you are in the EU/UK, you have rights under the GDPR, including the right to lodge a complaint with a supervisory authority.

9. Cookies

We use cookies and similar technologies as described in our Cookie Policy.

10. Children

The Service is not directed to children under 18 and we do not knowingly collect their personal information.

11. Changes

We may update this Policy from time to time and will post the updated version with a new "Last updated" date.

12. Contact and complaints

For privacy questions or complaints, contact [privacy@cardindexer.com] or write to JES WEB PTY LTD, [registered address]. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC).