Privacy policy

About this translation

This English version is provided for convenience. In case of any discrepancy, the Spanish version prevails.

1. Who processes the data

Siscorpdigital, as the provider of NexoCard AI, processes the data of client companies and their users to provide the service. For the employee data shown on the cards, the client company is the controller and NexoCard AI acts as the processor.

2. What data we process

Data about the company and the person who signs up; business contact details of the people with a card (name, job title, department, photo, phone numbers, emails, social profiles and website); and card usage records.

When someone opens a card we record the date and time, the source (QR code, NFC, link), the device type and operating system, and the approximate country and city that our hosting provider derives from the IP address. We do not store the IP address: only an encrypted identifier that changes every day and is used to count unique visitors.

Attendance tracking records each employee's clock-in and clock-out times, the terminal used and the device's location at the time of the punch (coordinates, accuracy and distance to the work site), which the browser only shares with permission. The location is captured only when clocking in or out, never continuously. The client company decides whether it is mandatory, must inform its staff and uses it only to verify working time.

If the company enables mobile clock-in, each person receives a personal, secret link to clock in from their phone. The company can bind each link to a single device with a technical cookie; the location is also captured only when the clock-in button is pressed.

If you accept analytics cookies, on the public pages of our website (home, solution, country and guide pages, sign-up, login and legal pages, in Spanish and English) we collect browsing data: pages and sections viewed, clicks, scrolling, device type and approximate country.

3. What we use it for

To provide the contracted service (legal basis: contract), show analytics to the client company (legitimate interest and the client's instructions), handle support requests and, if you ask for it in the demo form, contact you about our services (consent).

To measure and improve our website with Google Analytics and Microsoft Clarity, only if you accept analytics cookies, and to measure our campaigns and show you relevant ads on Meta (Facebook, Instagram) and Google, only if you accept advertising cookies. In both cases the legal basis is your consent, which you can withdraw at any time.

4. Where it is hosted

The application and the database run in data centers in the European Union (Frankfurt). Transactional emails are sent through a specialized provider. We do not sell data to third parties.

Card payments are processed by Stripe (Stripe Payments Europe, Ltd.), which handles payment data under its own privacy policy (stripe.com/privacy). NexoCard AI never receives or stores card numbers: it only keeps the subscription status, the amounts and links to the invoices.

Analytics and advertising are provided by Google (Google Analytics, Google Ads and Google Tag Manager, Google Ireland Ltd.), Microsoft (Clarity) and Meta (Meta Platforms Ireland Ltd.), which may process data outside the European Union under the safeguards of the EU-US Data Privacy Framework and standard contractual clauses. More information at policies.google.com/privacy, privacy.microsoft.com and facebook.com/privacy/policy. Google Tag Manager is the tool we use to manage advertising tags: it only loads on the public website if you accept advertising cookies, and it passes your choice on to each tag.

5. Cookies

Technical (always on): “nc_session” keeps dashboard users signed in for the length of their session; “nc_consent” stores your choice about analytics and advertising cookies for 180 days; “nc_lang” remembers the language you chose (Spanish or English) for one year; “nc_clock” binds an employee's personal clock-in link to their device (up to 400 days, only on that page).

Analytics (only if you accept them), on the public pages of our website —home, information pages and guides, sign-up, login and legal pages—: Google Analytics sets “_ga” and “_ga_<id>” (up to 2 years) to measure visits, sections viewed and conversions in aggregate; Microsoft Clarity sets cookies such as “_clck” (up to 1 year) and “_clsk” (1 day) for heat maps and anonymous session recordings. Form content is masked and advertising signals are turned off.

Advertising (only if you accept them), on the same public pages: the Meta Pixel sets “_fbp” (3 months) and Google Ads sets “_gcl_au” (3 months) to measure which campaigns bring visits, sign-ups and demo requests, and to show you relevant NexoCard AI ads on those platforms.

We do not use analytics, advertising or tracking cookies in the client dashboard, the operator panel or the public digital cards.

You can accept, reject or change your choice at any time from “Cookie preferences” at the bottom of the website.

6. Retention and rights

We keep data for as long as the contract lasts and, afterwards, for the periods required by law. You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to us through the support channels; if you are an employee of a client company, you can also contact that company.