Privacy Policy

Last updated 23 October 2026

This policy covers clinch.cards: the website, the Clinch app for card owners, the profile pages a Clinch card opens, and the booking pages on those profiles. Clinch Cards is operated by Clinch Technologies, based in Mumbai, India (“Clinch”, “we”, “us”).

In short

• We collect what you give us to buy a card, run your profile, and pass on the details people choose to share with you. Nothing more.
• We do not sell your data or show advertising. This website uses Meta’s ad pixel, which you can turn off with Decline; profiles and the app never use it.
• People who tap your card see what you publish. What they choose to share with you goes to you.
• You can ask us to show, correct or delete your data at any time, even if you have no account — see how.
• Every deletion of your data, and every change made to it outside the app, is recorded.

What we collect, and why

If you join the waitlist

Your name, WhatsApp number, email address if you give one, whether you want the card shipped inside or outside India, and whether it is for you or a team. We use them only to tell you when cards are available.

If you buy a card

Your name, WhatsApp number, email address, delivery address, any instructions you add, and your GSTIN if you give one. We use these to make and deliver your order, issue your invoice, and send you updates about it on WhatsApp and by email.

Where you came from

If you reached the site from one of our ads or a tagged link, the link carries labels such as “Instagram ad” and the ad’s name. When you join the waitlist, send an enquiry or place an order, we keep those labels and the website that sent you (its address only, not the page) with it, so we know which ads work. Your browser holds them only until you close the tab. We do not use them to follow you anywhere else.

Payments are taken by Cashfree Payments. You enter your card or UPI details with Cashfree, not with us; we receive only whether the payment succeeded and its reference.

Your Clinch account

You sign in either with a one-time code sent to your WhatsApp number, or with Google. We keep your phone number or email address to identify your account and to match it to the cards you ordered. Signing in with Google is described in its own section below.

Your profile

Whatever you add to your profile — your name, role, photo, links, work, education, pictures and the rest — is published on your profile page for anyone who taps or scans your card or opens its link. Profiles are not listed on search engines unless you switch that on.

If you use Fill from a document (Clinch+), the file you choose is sent to an AI model, through the provider OpenRouter, only to read your details out of it. Clinch does not store the file. Nothing it suggests is saved until you review it and press Save.

When a card is opened

We record the time, the country the request came from, whether the phone was an iPhone or an Android, and whether the page was opened by a card, a QR code or a link. We do not record precise location and do not build a device fingerprint. The country is the finest detail we hold. Cookies used for this are listed below.

If you share your details on someone’s profile

What you type into the “share your details” form — your name and the email, phone, company and note you choose to give — goes to the owner of that profile, who may be told about it on WhatsApp or by email. We store it so they can see it. They decide what to do with it, just as if you had handed them your card.

If you book a time on someone’s profile

Your name, WhatsApp number and/or email address, and any note you add, go to the owner of that profile. We use them to confirm the booking and remind you of it on WhatsApp or by email, and to let you cancel it. If the owner has connected Google Calendar, the booking is added to their calendar (see below).

Messages

If you message us on WhatsApp or by email, we keep the conversation, including any files you send, so we can reply and keep a record of your order.

Google sign-in and Google Calendar

Clinch uses Google in two places, and only when you choose to: signing in with Google, and connecting your Google Calendar to your booking page.

Signing in with Google. Google shares your name, your email address and a link to your profile picture. We use your email address to identify your Clinch account and to match it to the cards you ordered, and your name to address you in the app. We do not use your profile picture. These details are kept with your account record by our sign-in provider, Supabase.

Connecting Google Calendar. This is optional and is offered on the Appointments page. When you connect, you allow Clinch two things:

• See when you are busy (free/busy only). Clinch asks Google for the times your calendar is busy, so your booking page never offers a slot that clashes with an existing meeting. We never see the titles, people or details of your events.
• Add and remove the bookings made through Clinch in your own calendar. When someone books a time on your Clinch page, we create one event in your primary calendar with the time, the place you set, and the guest’s name, contact details and note. If the booking is cancelled, we delete that event. We only change events that Clinch created.

To keep the connection working we store a Google token, the email address of the connected Google account, and the identifiers of the events we created, in our database. That is accessible only to our server. Pressing Disconnect on the Appointments page deletes the stored token straight away. You can also remove Clinch’s access at any time from your Google Account at myaccount.google.com/permissions.

How it is protected. Google data travels only over encrypted (HTTPS/TLS) connections, and is stored in our database, which is encrypted at rest by our provider, Supabase, and reachable only by our server with a secret key. The Google token is encrypted a second time by Clinch, with a key kept outside the database. Nothing from Google is kept in your browser.

How long we keep it. The calendar connection (the access token and the connected email address) is kept until you press Disconnect or remove Clinch from your Google Account, and is deleted straight away when you do. The identifiers of the calendar events we created are kept with the booking they belong to, and deleted with it. Your Google sign-in details are kept with your account and deleted when your account is deleted. To have any of it deleted sooner, use Request deletion in Settings or contact us below.

What we never do with it. We use Google data only to provide the features described above. We do not use it for advertising of any kind, sell it, or pass it to data brokers or information resellers; we do not use it to decide anyone’s creditworthiness or for lending; we do not build databases from it; and we do not share it with anyone else. We do not use Google Workspace API data, including Google Calendar data, to develop, improve or train generalised or non-personalised AI or machine-learning models. People at Clinch do not read it, except where you ask us to help with your account, where it is needed for security, or where the law requires it.

Clinch’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Cookies

Profiles and the app use no advertising or analytics cookies, and none from other companies. The cookies we set are needed for the service to work:

• clinch_s — a random string set when a card is opened, so a second read moments later is not counted twice and a shared contact can be matched to the card open it followed. 30 days.
• clinch_owner — marks a card owner’s own phone, so their own opens are not counted. One year.
• clinch_uid — keeps you signed in to the Clinch app. 180 days, or until you sign out.
• clinch_pv — lets a phone that tapped a private profile open it again. 30 days.
• Short-lived sign-in cookies (clinch_next, clinch_pkce, clinch_google, clinch_gcal, clinch_phone_pending, clinch_link_pending, clinch_auth_recent) — carry a sign-in or a calendar connection from one step to the next. Ten minutes.

The app also remembers a few display choices, such as whether the sidebar is collapsed, in your browser’s own storage. The website keeps the ad labels described under “Where you came from” in the same storage until you close the tab.

We count visits to this website (not to anyone’s profile, and not inside the app) with Vercel Web Analytics. It sets no cookie and, Vercel says, keeps only anonymised data: the page, the site that sent you, your country and the kind of device and browser, counted into totals. We remove everything from the page address except the ad labels before it is sent, so an order reference is never part of it. The website loads its typefaces from Google Fonts, so your browser asks Google for them.

Meta’s ad pixel. This website uses Meta’s pixel to measure and improve our ads. It sets a cookie (_fbp) and tells Meta the pages you open here and when you open the order form, along with your IP address and browser details. Meta uses this, under its own terms, to tell us how our ads perform and to show them to people likely to be interested. A notice says so on your first visit. Choose Decline on it, or later under Cookie settings at the foot of the home page, and the pixel stops at once, its cookie is deleted, and it does not run on your later visits. It never runs on anyone’s profile, in the app, or on a page showing an order reference.

OpenAI’s ad pixel. We also advertise in ChatGPT, and use OpenAI’s pixel to measure those ads. It sets two cookies (__oppref, which holds a reference from the ChatGPT ad you clicked, and __obref, a random reference for your browser) and tells OpenAI that this website was visited, when you open the order form, and when an order is paid and for how much. It sends our website’s address only, never the page you are on or your order reference, and none of your name, phone or email. The same notice and the same Decline cover it: decline, and it stops at once and its cookies are deleted. It never runs on anyone’s profile or in the app.

Who we share it with

We do not sell or rent your data, and we do not share it with anyone for their own marketing, apart from the ad pixels described under Cookies, which you can turn off. We use these service providers to run Clinch, and they handle your data only to provide their service to us:

• Supabase — our database, sign-in and file storage.
• Vercel — hosts the website and the app, and counts visits to the website (see Cookies).
• Cashfree Payments — takes payments.
• Delhivery — delivers orders; receives your name, phone and delivery address.
• Meta (WhatsApp) — sign-in codes, order updates, booking messages and alerts.
• Meta (ads) — the pixel on this website described under Cookies, unless you decline it.
• OpenAI (ads) — the pixel on this website described under Cookies, unless you decline it.
• Google — our email (Google Workspace), Google sign-in and, if you connect it, Google Calendar. On a business’s page with films, YouTube plays a film only when you press play; until then the page asks YouTube for nothing.
• OpenRouter — only for Fill from a document, as described above.

We may also disclose data where the law requires it, or to protect people from harm or fraud.

Where it is stored

Our database and file storage are hosted by Supabase in Tokyo, Japan, and the website and app run on Vercel’s servers in Mumbai, India and Tokyo, Japan. Some of the providers above may also process data in other countries. Data travels to and between them encrypted.

How long we keep it

• Your account and profile — for as long as you keep your account. When you ask us to delete it, we do.
• Orders and invoices — for as long as Indian tax and accounting law requires us to keep them, even if you delete your account.
• Card opens, shared contacts and bookings — for as long as the profile they belong to exists, unless its owner or the person who shared them asks us to delete them sooner.
• Waitlist entries — until we have told you cards are available, and for up to 12 months after that in case you order.
• Google Calendar access — until you press Disconnect or remove Clinch from your Google Account.
• The record of deletions and changes (ids, times and actions — never the data itself) — at least one year.

Your rights

Under India’s Digital Personal Data Protection Act, 2023 you can ask us to:

• Show you a summary of the personal data we hold about you, what we do with it, and who we have shared it with.
• Correct, complete or update it.
• Delete it, unless a law requires us to keep it (orders and invoices, for tax).
• Stop using it — withdraw a consent you gave, as easily as you gave it.
• Accept a nominee who can do any of this for you if you die or cannot do it yourself.
• Hear a complaint about how we handled your data.

There is no charge and you do not need to give a reason. How to ask: email dipesh@clinch.cards, or message WhatsApp +91 83560 05671 — this works without an account, including if you only left your details on someone’s profile. Signed in, you can also download everything we hold about your account, name a nominee and ask for deletion in Settings › Data and privacy; disconnect Google Calendar on the Appointments page; and untick WhatsApp updates on any form that offers them.

To identify you we need the phone number or email address you gave Clinch: for an account, the one you sign in with; for a shared contact or a booking, the one you typed into that form. We confirm a request with you on that number or address before showing or deleting anything.

We answer every request and complaint within 90 days at most, usually far sooner. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

Keeping it safe

• Everything travels over encrypted (HTTPS) connections, and the database is encrypted at rest. The few secrets we must keep, like a Google token, are encrypted again by Clinch.
• Sign-in uses one-time codes on WhatsApp or Google, never passwords.
• The database cannot be read from the internet: only our server, with a secret key, can reach it.
• In the Clinch app, only named people can see customer orders and messages. Direct database access is limited to the same people.
• Every deletion of personal data, and every change made directly in the database, is recorded, and that record cannot be edited.

No system is perfectly secure. If a breach affects your data, we will tell you without delay, along with what happened and what you can do, and report it to the Data Protection Board of India and CERT-In as the law requires.

Children

Clinch is not intended for anyone under 18, and we do not knowingly collect their data.

Changes

If this policy changes we will update this page and the date at the top. If a change affects how we use data you have already given us, we will tell you before it applies.

Contact

For anything about your data, including complaints: Dipesh Chandiramani answers questions about how Clinch processes personal data. Clinch Technologies, Mumbai, India · dipesh@clinch.cards · WhatsApp +91 83560 05671