A LINK, IN ALL SIMPLICITY
Your data, basically.
Who is responsible for your data?
iSDO, 7, avenue du Mas rouge, 34670 Baillargues, France, is responsible for the processing carried out by PlugWit. For any questions or requests relating to your data, contact Philippe Contal at philippe@plugwit.com. The full identity of the publisher appears in the legal notices.
Registration and subscription
When registering by e-mail, a confirmation link is sent to your address by PlugWit's OVHcloud messaging. You choose your password after confirmation. Confirmation and reset links are single use, valid for one hour; only their condensate is stored on the server. Expired requests are deleted when new requests are made.
If you sign up for Pro when this offer is open, Stripe will process payment and billing. PlugWit will retain your Stripe identifiers and subscription status, without recording your credit card number. Free registration does not trigger any payment.
If you choose to register or sign in with Google, Google verifies your identity and transmits your ID, confirmed email address, and name. PlugWit maintains the association with your account. Your Google password is never transmitted to PlugWit. No access to Gmail or your contacts is required for this connection. Temporary journey data expires after ten minutes and is purged during requests and daily backup. Google login access tokens are not retained.
Published cards
The coordinates of a card are made public by its owner. They can be viewed, shared and downloaded in vCard format. Unpublishing blocks future access; it does not delete copies already saved by recipients.
The service processes the information provided when creating the account and that which you enter: name, first name, activity, company, presentation, photo, contact details and links. The account email is used for connection; it is not published automatically. The first and last name are required on the card; contact details and photo are optional.
Why do we use this data?
Account, draft, publication and export management allows us to provide you with the digital card service requested. The legal basis is the execution of this service. Access protection, backups and internal counters meet iSDO's legitimate interest in ensuring security and evaluating the operation of the service. We do not sell your data or use it for advertising targeting.
Notifications on this device
If you enable notifications, PlugWit stores this device’s technical subscription in encrypted form, together with the language, time zone and chosen time. Browser notification services deliver an encrypted alert containing only the number of follow-ups and a link to your contact book. No names or private notes appear in this alert. You can disable notifications in your PlugWit settings; the server subscription is then deleted. Delivery logs are kept for up to 35 days and older backups follow their usual rotation.
A protected personal space
The connection uses a session cookie necessary for the functioning of your space. It expires after seven days. Drafts are only visible to their owner. Photos are processed to remove their metadata.
Counters, without individual monitoring
If you choose “Use this card as my card”, PlugWit only remembers the ID of this card in the local storage of your browser or application. This choice allows you to directly open your QR; it contains no password or contact details and does not grant any access to the editor. It remains on this device until you “Forget my card on this device” or the site data is deleted. Consulting another card does not replace this choice.
We count views and actions per card per day, for 90 days. No measurement cookies, visitor IDs, IP addresses or user agents are stored in these counters. A download does not prove that a contact has been saved.
The paper card scanner
Local playback processes your photo in the browser's memory without transmitting images. AI reading, reserved for connected accounts, transmits the photos to our server then to OpenAI after your confirmation, to extract the coordinates. Images are reduced and their metadata removed before sending. PlugWit does not store these photos. Extracted contacts are only retained if you choose “Save to my PlugWit meetings”. The number of calls, their date and their technical cost are kept to limit expenses. You can erase the contents with “Clear All”; it is also reset when leaving the page. The vCard file you download stays on your device and can be imported into the Contacts app of your choice.
API response storage is disabled. OpenAI may, however, retain abuse control data for up to 30 days by default, with exceptions described in its data documentation . AI reading involves processing by that provider; no exclusively European location is guaranteed for this test. Choose local reading if you do not want to transmit the card. Cancellation after sending does not remove data already transmitted.
GA4, only with consent
If audience measurement is enabled and you accept it, Google Analytics receives the presentation pages visited, language and technical browser information. Page addresses contain only the path and language; names, contact details, notes and card data are not sent. Advertising features are disabled. Google may process data outside the European Union. GA4 cookies are limited to six months without automatic renewal. You can refuse or withdraw consent in privacy preferences; withdrawal blocks future requests and removes GA4 cookies accessible on this site. It does not delete data already sent to Google. Google retains detailed events for 2 months and user data for 14 months, resetting the user retention period on new activity. These periods do not apply to most standard aggregated reports.
Who can access it?
The private notebook stores the contact details you choose to record, your notes, your labels, the origin and the date of the recorded meeting. It does not access your phone's contacts. The “Leave me your contact details” form transmits the information to the card owner after your explicit agreement, to continue the exchange. It does not enroll you in any automatic campaigns. Only the owner accesses it in the application; authorized persons at iSDO can intervene in the operation of the service. You can edit, export or delete contacts from “My meetings”. Notes and tags are included in the CSV export, not in vCards. Notebook data is retained until deleted or account closure. To remove transmitted contact details, contact the card owner or philippe@plugwit.com specifying the card concerned. Anti-abuse limits use temporary global and card counters, without collecting your IP address.
Anyone with the link can view a published card. Drafts, connection details and meters remain accessible to the owner concerned and, for the operation of the service, to persons authorized by iSDO. Hosting is provided by OVHcloud; an encrypted copy of the backups is kept on a second VPS administered by iSDO. Contact or share links open the apps you choose; their treatments are their own policies.
Optional connection to Google Contacts
After your authorization with Google, PlugWit uses your account address to display the destination and searches for matches by email or telephone. No global import of your notebook or access to Gmail is carried out. You choose the form to create or complete and confirm the contact details before each transfer. Existing contact details are retained; PlugWit does not delete any Google contacts. Ratings and tags remain in PlugWit and are not transmitted to Google.
The Google Contacts permission technically covers viewing, editing, and deleting contacts; the service only uses the requested search, creation and complement. Google results are used exclusively for this overview and transfer, without advertising, resale or transmission to an AI service. Their use respects the Google User Data Policy , including its limited use requirements.
The authorization token is encrypted on our server until disconnected. The previews are encrypted, usable for ten minutes then cleaned at the next transfer or daily backup. We keep the identifier of the transferred file and the date to avoid repeated creations, until the meeting is deleted. A ten-minute temporary cookie secures Google's return. Disconnecting erases the active token and requests its revocation from Google; you can also remove access in your Google account. Backup copies follow the rotation described below and permissions are not reactivated during a restore. Contacts already transferred remain in your Google account and also fall under its privacy policy.
How long?
Your language is remembered for one year in a functional cookie. A local copy keeps this choice available offline. This setting is not used for advertising tracking.
The account, profile and photos are kept until the account is closed. Unpublishing hides the card without deleting the account or its draft. Old, replaced photos may remain in private storage until administrative cleaning; you can request its deletion.
The session cookie is valid for a maximum of seven days. The limitations on connection attempts are valid for fifteen minutes and those for sending photos for one hour; Expired records are cleaned up on retries. The meters are kept for 90 days in the active database. Backups follow a rotation of seven daily and four weekly copies: old copies are deleted as they are replaced. They are used only for disaster recovery and may temporarily contain data deleted from the active database.
Your rights and your contact
You can correct your contact details and unpublish your card from your space. To request access to your data, their rectification or erasure, limitation of processing, portability of the data concerned or to oppose processing based on legitimate interest, write to philippe@plugwit.com. These rights are exercised under the conditions provided for by the regulations. We normally respond within one month; any justified extension is explained to you. You can also send a complaint to the CNIL.
Last updated: September 24, 2026.