- Last updated
- Responsible organisation
- TCIG LTD · cardoff.ai
- Privacy requests
- Write to us
Who we are
This policy explains how TCIG LTD, trading as cardoff.ai ("cardoff", "we"), handles personal data in the cardoff Field and cardoff Merchant apps and the web consoles they work with. Both apps are business tools: accounts are issued by an organisation (a bank, cardoff.ai, or a merchant business) to its staff. A bank's own customer apps and websites have their own privacy notices.
Who decides
For a bank's field team, the bank decides why and how its staff's data is used, and we process it on the bank's behalf. For cardoff.ai's own field team and programme members, and for merchant businesses, we decide.
What we collect, and why
- Account and contact details: your name, work phone number (used to sign in), email, job title and photo, to give you an account and let your colleagues and managers know who you are.
- Location: when you check in at a visit, plan a route, look for businesses near you or sign an agreement. If your organisation turns on the live team map, the app shares your location with your organisation's managers, also in the background, as your organisation has set; the app always shows a "Sharing location" sign while it does, and you can refuse background location in iOS Settings. Location history is kept for 90 days unless your organisation sets a shorter time. cardoff Merchant uses location only while you place a branch or sign an agreement.
- Photos, documents and signatures: merchant documents, offer pictures, proof-of-visit photos, signatures and stamps you capture, to sign businesses up and keep the agreement.
- Messages, posts, voice notes and calls: what you send in your team's feed and chats. Calls and push to talk are carried live and are not recorded. Voice notes may be turned into text to make them searchable.
- Business records: visits, results, merchant and prospect details, offers, sales confirmed at the till (the bill, the discount and the last 4 digits of the card; never a full card number), wallet and invoices.
- Programme members: payout details and tax or identity documents your programme asks for, kept encrypted.
- Device data: an installation id and push tokens, to deliver notifications and calls to your phone.
- Usage: whether you are online, read receipts and progress in courses, to make the team features work; in cardoff Merchant, which screens are used, in aggregate, to improve the app.
We do not sell personal data, show ads in the apps or track you across other companies' apps and websites.
Who receives it
Your organisation and its authorised people; service providers that run features for us (hosting and storage, push notifications through Apple and Expo, live calls through our real-time media provider, text messages for sign-in codes, map tiles, and an AI service for translation and transcription), under contract and only for those features; authorities where the law requires it.
Where and how long
Our application servers run in Singapore today, and our hosting, storage and other service providers may process data in other countries, including the United States. We keep data while your account is active and then for as long as the law or your organisation's records require (for example signed agreements and financial records), then delete or anonymise it.
Your choices and rights
You can change your profile, turn off notifications and location in iOS Settings, and delete your account in the app (cardoff Field: Settings → Delete account; cardoff Merchant: More → Delete account). Deleting removes your sign-in and personal details; records your organisation or the law requires are kept. Depending on where you live you may have rights to access, correct, delete or object; contact us or your organisation.
Security
Data travels over encrypted connections, sensitive fields are encrypted at rest, access is limited by role and every sensitive action is recorded in an audit log.
Children
The apps are for staff of businesses and are not meant for children.
Contact
To ask about your data or make a privacy request, write to us through our contact page and start your message with "Privacy". We answer within 30 days. If your account was issued by a bank, you can also ask the bank. The organisation responsible is TCIG LTD, trading as cardoff.ai.
Changes
We will update the date at the top of this page and, for important changes, tell you in the app.