Privacy Policy

IconaPost (“we”, “us”) lets you build a digital name card with an AI concierge that answers visitors from the notes you give it. This policy explains what we collect, why, who helps us run the service, and the choices you have. It applies to www.iconapost.com and every card published on it.

What we collect

Account details. Your name, email address and password (stored only as a secure hash). If you sign in with Google we receive your name, email address and profile picture from Google.

Card content. What you put on your card: name, role, company, contact details, links, photos you upload, styling choices, and the knowledge you add (notes, text, files and web pages you import).

Visitor activity. When someone views a card we record the visit with approximate location (country, region, city), device type, browser, operating system, language and time zone, so the card owner can see analytics. We do not store visitors’ IP addresses. Visitors who use the chat, booking or contact forms share the messages they write and, if they choose, their name, email, phone number and website.

Google Calendar. If you connect Google Calendar, we create and update events for meetings booked through your card. If you turn on instant booking, we also check your free/busy times so visitors only see open slots. We see only when you are busy, never the titles, attendees or details of your other events.

Payments. Paid plans are processed by Stripe, PayPal or Razorpay. They handle your card and bank details; we only receive the plan, amount, status and a payment reference.

Technical data. Sign-in cookies that keep you logged in, and small browser-storage entries that remember things like when a confirmation code was last sent.

How we use it

• To run your account and publish your card.
• To let your card’s AI concierge answer visitors using the knowledge you provided.
• To send account emails: confirmation codes, password resets and important service notices.
• To let visitors book a meeting with you and send both of you a confirmation email.
• To show you analytics about your card.
• To understand how people use our public pages and measure our ads (see below).
• To process payments and manage your plan and credits.
• To keep the service secure and prevent abuse.

AI answers

When a visitor asks your card a question, the question, recent chat history and the relevant parts of your card’s knowledge are sent to our AI provider, xAI, to write the answer. We send only what is needed to answer that question.

Analytics and advertising cookies

On our public pages (the home page, pricing, published cards and similar) we may use Google Analytics 4, Microsoft Clarity and the Meta (Facebook) Pixel. They use cookies and similar technology to count visits, show how pages are used (Clarity can record anonymised sessions of clicks and scrolling), and measure and improve our ads on Meta and Google. We also tell Google Analytics and Meta when key actions happen, such as creating an account, leaving contact details on a card, booking a meeting or buying a plan, without sending your name, email or phone number. To make sure these are counted even when a browser blocks tracking scripts, we may also send them to Meta from our own servers (Meta’s Conversions API) together with your IP address, browser type and Meta’s cookie IDs; this follows the same cookie choices. Our own site pages (not the cards people publish) may also show ads from Google AdSense, which uses cookies to show and measure ads and, where you allow it, to personalise them; see how Google uses this data. Screens inside your dashboard and the admin area are masked in Clarity and do not send page views.

Where the law requires it (for example in the EU, EEA, UK and Switzerland) none of these load until you agree in our cookie banner. Elsewhere they load by default. Wherever you are, you can change your choice any time with Cookie settings at the bottom of the page. You can also block them with your browser’s cookie settings or an ad blocker, and manage ad preferences in your Google and Meta accounts.

Google user data

We use Google sign-in only to create and log in to your account, and Google Calendar access only to add or update meetings booked through your card and, if you turn on instant booking, to check your free/busy times so visitors are offered open slots. We do not use Google user data for advertising, we do not sell it, and people cannot read it except where you ask us for support, it is needed for security, or the law requires it.

IconaPost’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove IconaPost’s access at any time from your Google Account permissions.

Who helps us run IconaPost

We share data only with providers that run parts of the service for us:

• Vercel: hosting.
• Neon: database.
• Our email provider (such as Resend): sending account emails.
• xAI: writing AI answers.
• Stripe, PayPal and Razorpay: payments.
• Google: sign-in and calendar, when you choose to use them.
• Google, Microsoft and Meta: analytics, ad measurement and (Google AdSense) ads on our public pages.

We do not sell personal data.

What is public

A published card is public: anyone with the link can see what you chose to show and talk to its concierge. Unpublish your card at any time to take it offline.

How long we keep data

We keep your account and card data while your account exists. When you ask us to delete your account we remove it and its card data, except records we must keep for legal or accounting reasons, such as payment records.

Your choices and rights

You can edit or remove your card content in the dashboard at any time. To get a copy of your data, correct it, or delete your account, email hi@iconapost.com. Depending on where you live, you may also have the right to object to or restrict how we use your data, and to complain to your local data-protection authority.

Security

Data is sent over encrypted connections, passwords are hashed, and access tokens from Google are encrypted at rest. No service is perfectly secure, so please use a strong, unique password.

Children

IconaPost is not meant for children under 16, and we do not knowingly collect their data.

Changes and contact

If we change this policy we will update the date above and, for important changes, tell you by email or in the app. Questions or requests: hi@iconapost.com. See also our Terms of Service.