Privacy Policy

Last updated 11 Sep 2026

This explains what OnePageCard Staging collects, why, who else sees it, and how to get it back or have it deleted. It describes what the system actually does today — where something is not built, it says so rather than describing an intention.

Two different sets of people

OnePageCard Staging is used by two groups, and the distinction matters for who is responsible for what.

• Business owners — people who hold an account with us and build a mini-site. For their data, we decide what is collected and why. We are the controller.
• Visitors to those mini-sites — people who look at a business's page, send it an enquiry or book an appointment. That information belongs to the business, not to us. They decide what to do with it; we hold it on their behalf. We are the processor.

What we collect from account holders

• Your account — name, email address, mobile number, and a password we store only as a hash. Optionally a date of birth and a profile photo.
• Billing details — billing name and email, postal address, and the country used to decide your price and currency.
• Your business details — everything you type into your site: business name, description, opening hours, address, phone, images, products, services.
• Business identity, if you fill it in — business type, legal name, and registration, tax or VAT numbers. You choose whether these appear publicly on your site.
• Payments — amount, currency, and the reference the payment gateway gives us. We never see or store your card details. Those go directly to the gateway.
• Support — the contents of tickets you raise and messages to the help assistant.

What we collect from site visitors

Held on behalf of the business whose page it is:

• Enquiries — name, email, phone, the message, and the IP address it came from.
• Appointment and event bookings — name, phone, email, the times or seats booked, and any note left.
• Abuse reports — the reason, the detail given, and the reporter's email and IP address. IP is kept because a reporting form with no accountability is a tool for harassing a competitor.
• Visitor statistics — country, and sometimes city, counted per day and never per person. We do not build a profile of a visitor, follow them between sites, or store their individual page views.

What we do not collect

None of the following is collected anywhere in the product: government identity documents, biometrics, precise GPS location, health information, or your browsing on other websites.

Who else sees it

Who	Why	What they get
Razorpay	Payments from India	Name, email, payment details
Stripe	International payments	Name, email, payment details
Openprovider	Registering domains you buy	Registrant contact details
Cloudflare	Serving and protecting the site	IP address, request details
Zoho Books	Our accounting	Invoice and billing details
Postmark / Resend / Amazon SES	Sending email	Email address, message contents

We do not sell personal information, and we do not share it for advertising.

Things we have built but do not run

Worth stating plainly, because other policies often describe features that are switched off:

• The help assistant does not use an external AI service. It matches your question against a list of answers on our own server. Nothing you type into it is sent anywhere else.
• Sign-in with Google and Facebook is active. If you use it, we receive your name, your email address and the account's id — nothing else, and we ask for nothing else. We never receive your password, and we do not post anything. Signing in with it is entirely optional; an email address and a password works the same.
• WhatsApp notifications are not active. Owners are notified by email.

If any of these is switched on, this page will be updated before it is.

Cookies

What the site needs to work: your session, a security token, your chosen language and theme, and your cookie choice itself. Those are set on every page and cannot be turned off without breaking something.

On our own pages we also use Google Analytics, to see which parts of the site help people and which do not. It sets cookies and sends your IP address and the page you are on to Google, outside your country. It does not load until you allow the analytics category — and if you are somewhere with an opt-in law, that means nothing is sent on your first visit, because you have not been asked yet. It does not run on a business's mini-site.

There is no advertising and no cross-site tracking from us: we do not follow you from one business's page to another, and we do not build a profile of you.

A business owner can add their own Google Analytics to their mini-site. If they do, that is their decision and their analytics — the cookies you meet on a business's page may not be ours.

How long we keep things

• Your account — while it exists. You can ask us to delete it at any time from your dashboard.
• Deletion takes 14 days, and you can cancel throughout. That delay is the point: deletion is the one action with nothing to undo it, so if the request was a mistake — or made by someone who had got into your account — the confirmation email gives you time to stop it. Your account works normally in the meantime.
• Dormant free sites are deactivated after a long period of inactivity, with reminders first, and deleted after a further period.
• Payment records are kept after deletion because we are required to hold them for tax purposes. They are no longer attached to a live account.

Your rights

You can ask us to show you what we hold, correct it, delete it, or give you a copy. Email privacy@onepagecard.com.

Where you live may give you more than this policy does — the UK and EU, Australia and others all do. Those rights apply regardless of what is written here, and you never have to argue that with us.

How it is protected

What is actually in place, rather than a list of reassuring words:

• Passwords are stored as hashes and cannot be read back, by us or anyone else.
• Two-factor sign-in by email — a one-time code, asked for as well as your password. It is required on administrator and reseller accounts, which can reach other people's data. On a customer account it is available and off until you switch it on, in your profile settings, and we recommend that you do.
• Each business's data is isolated from every other, and that isolation is covered by automated tests.
• A content security policy, security headers, request rate limits, and signature checks on payment notifications.
• Invoices are served from private storage through a signed link, not a guessable URL.

We do not claim a security certification, an external audit or a penetration test, because we have not had one. If that changes, this section will say so.

Where your data is

Our servers are in Amsterdam, in the Netherlands. Your information is stored and processed there, not in India, even though Tilefin IT Solutions (OPC) Private Limited is an Indian company and most of our customers are in India.

Indian law permits this. The Digital Personal Data Protection Act 2023 allows personal data to be transferred outside India except to countries the Government has specifically restricted, and the Netherlands is not among them. The Netherlands also has its own strong data protection regime under the GDPR, so your information is not less protected for being there.

Some of the services listed above operate in other countries again, so information reaching them may be processed elsewhere. Where that happens it is listed above with the service.

Children

OnePageCard Staging is for businesses and is not intended for anyone under 18. We do not knowingly collect information from children.

Changes

If this policy changes in a way that affects you, we will say so rather than quietly updating the date at the top.

Getting your data, or getting it deleted

You can download everything we hold about your account yourself, at any time: sign in, open your profile, and choose Download my data. It arrives as a file containing your account details, your sites and their content, your payment history, and the enquiries and bookings your own customers sent you. Your password is not in it — we cannot read it either.

To have your account deleted, use Delete Account on the same page. It is carried out after 14 days, and you can stop it at any point during those two weeks. Records of payments you made are kept afterwards, because tax law requires us to hold them.

Complaints

If you are unhappy with how we have handled your information, tell us and we will look into it.

Grievance Officer
privacy@onepagecard.com
Tilefin IT Solutions (OPC) Private Limited, Anakkara P O, Anakkara, Palakkad, Kerala 679551, India

We will respond within 30 days. If you are still not satisfied, you may complain to the Data Protection Board of India.

Contact

Privacy and data requests: privacy@onepagecard.com
Anything else: support@onepagecard.com