Terms of service for NFC.cool Business Card

Who we are and what these terms cover

These terms are an agreement between you and Nicolo Stanciu, trading as NFC.cool, Rua Carminé Nobre 6, 3040-193 Coimbra, Portugal, NIF PT315901934, phone +351 925 378 989, email info (at) nfc (dot) cool (“NFC.cool”, “we”, “us”). They cover:

• the Business Card by NFC.cool app for iPhone, iPad and Android, and its App Clip on iPhone;
• the card pages at mycard.nfc.cool, and at a team's own domain when a team connects one;
• NFC.cool Business Card for Teams: the web console at business.nfc.cool, its API, and its connection for AI assistants.

In these terms, “the service” means all of them. They also cover business card accounts and cards used in the NFC.cool Tools app. Everything else in the NFC.cool Tools app, and the nfc.cool website, have their own terms.

You accept these terms when you create an account, or when you set up a team or accept an invitation to one. In the app and at business.nfc.cool, we ask you to accept them, with a link to them, before you continue. If you accept them for a company or another organisation, you confirm that you are allowed to bind it, and “you” then also means that organisation.

You must be at least 16 to use the service. If you are under 18, you need a parent’s or guardian’s permission to buy a plan or a team.

Someone who only opens a card, or leaves their details on one, does not need an account and is not bound by these terms. The privacy policy tells them how their details are handled.

Your account

• You need an account to make cards. You can create one in the app with an email address and a password or with Sign in with Apple, or at business.nfc.cool when you set up a team or accept an invitation to one.
• Give us true details and keep your email address current: we send notices about your account and your team to it.
• Your username is part of your card's web address, so it is public.
• An account is for one person. Do not share it, and do not create accounts by automated means or under a false name.
• Keep your password and your access tokens secret. You are responsible for what is done with your account and your tokens, unless it happens through our fault. If you think someone else has used them, change your password, which signs you out everywhere, and tell us.

Your cards, and what may be on them

A card is a web page. Anyone who has its link, taps its NFC tag or scans its QR code can open it and save its details as a contact. A public card can be found by search engines. A private card opens only with its PIN, but anyone you give the PIN to, or a link that carries it, can open it.

You decide what goes on your cards, and you are responsible for it. A card may show only:

• you, or a person or business you are allowed to present;
• information about who you are and what you do that is true and not misleading;
• photos, logos, names and other material you have the right to use.

A card, and anything it links to, must not:

• pretend to be another person or business, or suggest that you work for or with a company when you do not;
• contain anything illegal, such as material that infringes someone's rights, defames, harasses or threatens someone, incites hatred or violence, or exploits children;
• be used for phishing, malware, scams or other fraud, or to collect people's details under false pretences;
• show other people's personal data without a lawful reason, or sensitive data about others, such as their health.

When you use the service, do not:

• try to get into accounts, cards, teams or data that are not yours, or probe or get around our security, PIN limits or rate limits;
• overload or disrupt the service, or copy cards or other people's data from it by automated means;
• use it to send spam;
• resell the service, or copy, decompile or reverse engineer the apps, except as far as the law allows you to.

To report a card that breaks these rules, see Reporting content, and how we moderate. If a card or an account breaks these rules, we may act as described there and in If we suspend or close an account.

Reporting content, and how we moderate

Points of contact. Our single point of contact under the Digital Services Act, for authorities of the EU Member States, the European Commission and the European Board for Digital Services, and for everyone who uses the service, is dsa (at) nfc (dot) cool. You can write to us in English or Portuguese. A person reads and answers every message.

Report a card. Anyone can report a card, or something on it, that they think is illegal or breaks these terms. Use the Report link at the bottom of the card, or email dsa (at) nfc (dot) cool. Include:

• the card's link, and which content you mean;
• why you think it is illegal or breaks these terms;
• your name and email address (not needed if you report child sexual abuse material);
• a statement that you believe in good faith that your report is accurate and complete.

We confirm that we received your report, and tell you what we decided and how you can contest it.

How we moderate. We do not monitor cards in general, and we use no automated tools to find or judge content. A person reviews every report, and every case we come across ourselves. We act carefully and objectively, and take into account the rights of everyone involved, including freedom of expression. We may then hide content or a card, suspend or close an account or a team, or take no action.

Our decision, and how to contest it. When we restrict your card or your account, we tell you by email what we did and for how long, the facts behind it, the rule in the law or in these terms it is based on, and how to contest it. To contest it, reply to that email within six months: we review the decision again and answer you. You can also go to court.

The contacts you collect

When you switch on lead capture, people can leave their details with you on your card: their name, email address, phone number, job title, company, a note and, if your card asks for one, a selfie.

• You are the controller of these details. You decide whether to collect them, which details to ask for and what to do with them. On a team card, the team is the controller. You are responsible for collecting and using them lawfully, under the GDPR and any other data protection law that applies to you.
• Tell people what you do with them. When you collect someone's details, tell them who you are, what you will use their details for, and how they can reach you about them (Art. 13 GDPR).
• Use them as people expect. Use the details to get back in touch as the person would expect from meeting you. Do not send them marketing emails or messages without the consent the law requires, and stop when they ask you to. Do not use a selfie for anything but recognising the person you met.
• Answer their requests. When someone asks to see, correct or delete their details, answer them. You can edit, export and delete contacts in the app, and for a team in the console. If someone asks us instead, we pass the request on to you and help you answer it.

How we process contacts for you

We process the contacts you collect on your behalf, as your processor under Art. 28 GDPR. This covers the details people leave on your cards, as listed under “Details people leave on a card” in the privacy policy, and what you add to them, for as long as you keep them, to provide the service to you. Your instructions to us are these terms and the settings you choose in the service. We:

• process them only on your instructions, unless EU or Portuguese law requires us to do something else. In that case we tell you first, unless that law forbids it. If we think an instruction breaks data protection law, we tell you at once;
• use them only to provide the service to you: to store them, show them to you and the people you share them with, notify you, and send them where you or your team choose. We never use them for our own purposes and never sell them;
• give access to them only to people who need it to run the service and who are bound to confidentiality;
• protect them with the security measures described in the privacy policy;
• use only the service providers listed in the privacy policy to process them, under contracts that protect them in the same way, and transfer them outside the EU only with the safeguards described there. We add a new provider to that list at least 30 days before we start to use it for your contacts. If you object for a reasonable data protection reason and we cannot solve it, you can stop using lead capture and delete your contacts, or delete your account;
• help you, as far as we can, to answer people's requests and to meet your duties on security, data breaches and impact assessments;
• tell you without undue delay, and where we can within 48 hours, if we become aware of a breach that affects them;
• let you export them as a CSV file at any time, and delete them when you delete them or your account, except where the law requires us to keep them. Deleting a card alone keeps the contacts it collected;
• give you the information you need to show that these rules are met, and allow and contribute to audits, including inspections, by you or an auditor you appoint and who is bound to confidentiality, where that information is not enough. You give us reasonable notice and bear your own costs.

For a team, our data processing agreement applies instead of this section. It is part of these terms, and a team accepts it when it accepts these terms. Nothing else needs to be signed.

Teams: NFC.cool Business Card for Teams

A team is set up at business.nfc.cool. Whoever sets it up becomes its owner and accepts these terms for the company or organisation the team belongs to.

• Roles. Owners have full control, including billing and deleting the team. Admins manage members, cards, the brand, billing and connections. Managers manage cards and contacts. Billing members manage the subscription only, and do not see contacts. Members manage their own cards within the limits the team sets.
• Members' cards belong to the team. Admins can create and edit members' cards and lock the brand on them. The cards a member holds for the team, including a card they brought into it, stay with the team when they leave, and so do the contacts those cards collected. A card moves into or out of a team only with an admin's approval.
• The team is responsible for its members' cards and invitations. The team decides what goes on its members' cards and whom it invites, so it is the controller of those details. Our data processing agreement covers them.
• Tell your members. The team decides what goes on its members' cards and sees the contacts they collect. Tell your members how the team uses the service.
• Ownership. An owner can hand the team to another member, who has to accept. A team always has at least one owner.

Plans and payment

What each plan includes is shown in the app and on the Business Card page.

Free

The Free plan has one card. It has no lead capture, and the card shows a small “Made with NFC.cool” link. We may change what the Free plan includes. If we remove something from it, we tell you by email at least 30 days before.

Personal and Pro, in the app

Personal and Pro are subscriptions you buy in the app, through the App Store or Google Play. Apple or Google takes the payment, and their terms govern billing, renewal, cancellation and refunds:

• the price and the billing period are shown in the store before you buy;
• the subscription renews automatically at the end of each period until you cancel it in your App Store or Google Play account settings;
• deleting the app or your account does not cancel it;
• refunds, including any right of withdrawal, are handled by Apple or Google under their own rules.

This does not affect your rights under consumer law, including the legal guarantee that the service works as described. If something is wrong with the service, contact us and we will put it right.

Plans we no longer sell

If you have a plan we no longer sell, it keeps what it was sold with for as long as it runs.

Team, through Stripe

• Per seat. NFC.cool Business Card for Teams is bought at business.nfc.cool and paid through Stripe, per seat. Every active person in the team, owners included, uses one seat. A team starts at 2 seats and can have up to 500 when bought online. For more, or to pay by invoice, write to business (at) nfc (dot) cool.
• Price. Seats are billed monthly or yearly, as chosen when you order, at the start of each period. The price per seat, the currency and the total are shown before you order. Prices include VAT where it applies. If you are a business in another EU country and give a valid VAT number at checkout, we do not charge VAT: you account for it yourself under the reverse-charge rule. Promotion codes apply as their terms state.
• Free trial. A new team gets a 14-day free trial. The trial needs a payment card. When it ends, the card is charged for the seats the team has then, and the subscription renews each month or year until it is cancelled. To avoid being charged, cancel before the trial ends. We email the team's owners about 3 days before the trial ends, unless it has already been cancelled.
• One trial per person. Someone who already had a trial, or who owns a team that was paid for, starts a further team without one. A team that subscribes again after its subscription ended gets no new trial.
• Before the trial. After setting up a team, you can see your own card in the team's brand for 7 days without a payment card. Inviting others starts with the trial. If no trial starts within those 7 days, that card stops being shown.
• Changing seats. Owners and admins can add or remove seats at any time, but not below the number in use. Added seats are charged straight away for the rest of the period, prorated; during the trial nothing is charged. Removed seats are credited, prorated, on the next invoice. Switching between monthly and yearly billing is prorated in the same way, and keeps a running trial.
• Invoices and payment details. Owners and admins can see invoices and change the payment card in the console, under Billing, Manage payment and invoices, which opens Stripe's billing portal.
• Failed payments. If a payment fails, Stripe tries again for a while, and the team keeps working meanwhile. If it still fails, the subscription ends: see When a team's subscription ends.
• Separate agreements. A team that pays under a separate agreement with us follows that agreement where it differs from these terms.

How a team is bought

1. You set up the team at business.nfc.cool, and choose the number of seats and monthly or yearly billing.
2. You accept these terms. If you are a consumer and want the service to start straight away, you also ask us to start it (see If you buy as a consumer).
3. You check your order: the seats, the billing period, the price per seat, the total and the trial dates. You can go back and change anything.
4. You place the order with the button "Order with obligation to pay", then enter and confirm your payment details on Stripe's page.

We then email you a confirmation with these terms, including the withdrawal information and the withdrawal form. The contract is in English. We keep the version of these terms you accepted, and you can ask us for a copy at any time.

Price changes. We may change the price of a seat for a valid reason, such as a change in our costs, in taxes or in what the service includes. A new price applies to an existing subscription only from its next renewal, and only if we have told the team’s owners by email at least 30 days before. The team can cancel before the new price applies.

If you buy as a consumer

NFC.cool Business Card for Teams is made for businesses and professionals, and you can also buy it as a consumer. If you do, these rules apply in addition.

Right of withdrawal. You have the right to withdraw from the contract within 14 days without giving any reason. The withdrawal period ends 14 days after the day the contract is concluded.

To exercise the right of withdrawal, you must inform us (Nicolo Stanciu, trading as NFC.cool, Rua Carminé Nobre 6, 3040-193 Coimbra, Portugal, phone +351 925 378 989, email business (at) nfc (dot) cool) of your decision to withdraw from this contract by an unequivocal statement, for example a letter sent by post or an email. You may use the model withdrawal form at the end of these terms, but you do not have to. To meet the withdrawal deadline, it is enough that you send your communication before the withdrawal period has ended.

Cancelling your subscription on the Billing page is not the same as withdrawing: it stops the next renewal. To withdraw, write to us as above.

Effects of withdrawal. If you withdraw from this contract, we reimburse all payments received from you without undue delay, and in any event within 14 days of the day we are informed of your decision. We use the same means of payment as you used, unless you have expressly agreed otherwise. In any event, you pay no fees for the reimbursement.

If you ask us to start straight away. The service starts within the withdrawal period only if you ask for it. Before you order, we ask you to tick this box:

I ask NFC.cool to start the service now, within the 14-day withdrawal period. I understand that if I withdraw, I pay for the service provided until I tell NFC.cool, and that I lose my right of withdrawal once the service has been fully provided.

If you then withdraw, you pay an amount in proportion to what was provided until you told us, compared with the full coverage of the contract. During a free trial nothing is charged, so a withdrawal during the trial costs nothing.

Cancelling, and what happens to your data

Cancelling a team subscription

Owners and admins cancel in the console, under Billing, Manage payment and invoices. The subscription then ends at the end of the period already paid, and the console shows the date. Until then the team works as before. Apart from a withdrawal and the other cases in these terms, we do not refund the rest of a period you cancel, except where the law requires it.

When a personal plan ends

Your account, your cards and the contacts you collected stay. Your cards follow the Free plan: your oldest card can still be saved as a contact, your other cards still open but cannot be saved, and lead capture stops.

When a team’s subscription ends

Nothing is deleted straight away. The team’s cards show a “temporarily unavailable” page and collect no contacts, and nobody new can join the team. Owners and admins can still sign in to the console and subscribe again from the Billing page, without a new trial. Everything then comes back as it was.

We keep the team’s data for 12 months after its subscription ended, or after its 7-day preview ended without a trial. We email the owners 30 days and 3 days before. If nobody subscribes again by then, we delete the team as described in Deleting a team.

Deleting a team

An owner can delete a team in the console, under Settings, Delete team. This cancels its subscription at once, with no refund for the rest of the period; during a trial nothing has been charged. Then:

• a card held by a member goes back to that member as a personal card;
• cards held by nobody are deleted;
• contacts assigned to a member: the owner chooses, when deleting the team, whether they move to that member's own account, where that member becomes responsible for them, or are deleted with the team. Unless the owner chooses to move them, they are deleted;
• contacts assigned to nobody are deleted;
• the team's brand, settings, members, invitations, connections, domains and access tokens are deleted.

Export the team’s contacts first if you want to keep them. Deleting a team cannot be undone.

Leaving a team

When you leave a team, or an admin removes you, the cards you held for the team stay with it, and so do the contacts they collected. The team decides what happens to the details on those cards. Your seat becomes free. Your personal cards and their contacts are not affected.

Deleting your account

You can delete your account in the app, in the console under your account, or by emailing info (at) nfc (dot) cool. We then delete your account, your personal cards and the contacts they collected, as the privacy policy describes. Cards you held for a team stay with the team, with your personal details removed from them. If you are a team’s only owner, first hand the team to someone else, or delete it together with your account.

If you stop using Sign in with Apple for the app in your Apple ID settings, Apple tells us and we delete your account in the same way, together with any team you own alone.

Deleting your account does not cancel a subscription bought through the App Store or Google Play. Cancel it in your store account settings.

Inactive accounts

We may delete an account that nobody has signed in to for a year, none of whose cards, its own or a team’s, has been viewed in that year, and that has no active subscription. We email a warning 30 days before, and a last one 3 days before. We never delete an account this way while it owns a team or has lifetime access.

Getting your data out

You can download a copy of your data at any time, as described in the privacy policy. A team’s owners, admins and managers can export the team’s contacts as a CSV file from its Leads page.

If we suspend or close an account

We may suspend or close an account, a card or a team if it seriously or repeatedly breaks these terms, if the law requires it, or to stop harm to other people or to the service. Unless the matter is urgent or the law does not allow it, we tell you first, explain why, and give you a reasonable chance to put it right. When we act, we tell you why and how you can contest the decision, as described in Reporting content, and how we moderate. If we close a paid team that has not broken these terms, we refund, through Stripe, the part of the period already paid that is left.

You can stop using the service, and delete your account, at any time.

Custom domains

A team on a paid plan or a running trial can show its cards on a domain it owns, such as cards.example.com.

• You must own or control the domain. You confirm it by publishing a DNS record we give you. If we cannot find it within 7 days, the check fails.
• We get a TLS certificate for the domain from a public certificate authority, so the card pages on it use HTTPS.
• You are responsible for the domain's registration and its DNS. If the domain lapses or stops pointing to us, card links on it stop working. The same cards keep working at mycard.nfc.cool.
• When you remove the domain, or delete the team, we stop serving it at once.

Integrations and AI assistants

A team’s admins can connect the team to other services. Data then goes where the team sends it.

• Webhooks. We send each new or changed contact to an address the team chooses, such as a Zapier or Make hook, signed with a secret only the team and we know. If the address does not answer, we try up to four times, then give up on that delivery.
• HubSpot and Salesforce. An admin connects the team's account through that service's own sign-in. We then create or update contacts there. The team can disconnect it at any time.
• Access tokens and AI assistants. An admin can create access tokens for the team's API, or to connect an AI assistant through our MCP server. A token reaches one team, acts with its holder's role, reads only unless it is allowed to make changes, and stops working when it expires, when it is revoked, or when its holder leaves the team. Admins can see what each token did.
• Follow-up emails. A team can email the contacts it collected. The emails are sent from an NFC.cool address in the member's name, and replies go to the member. Every email has an unsubscribe link, and an address that unsubscribed, bounced or reported spam cannot be emailed by the team again. The number of emails is limited.

For these, the team is responsible for:

• the services it connects. HubSpot, Salesforce, Zapier, Make and AI assistants are not ours: their own terms apply, and we are not responsible for what they do with the data the team sends them. The team needs its own legal basis, and where required its own data processing agreement, for sending data there;
• keeping tokens and webhook secrets safe, like passwords. Anything done with a token counts as done by its holder;
• checking what an AI assistant does. An assistant can make mistakes. Give a token the right to make changes only if you want the assistant to act for you;
• the content of its follow-up emails, and the consent or other legal basis the law requires to send them, in particular for marketing.

We may limit how often the API and the MCP server can be called, and we may pause a team’s follow-up emails if they draw spam complaints or put the delivery of our emails at risk.

Your content and our software

• Your content stays yours. You keep every right in what you put into the service. You allow us to store, copy, adapt and show it, only as far as we need to run the service for you: for example to show your public cards to anyone, resize images, build vCard files and Apple Wallet passes, and send an App Clip card's title, subtitle and image to Apple. This permission ends when you delete the content, apart from copies in backups until they expire.
• Our software stays ours. The apps, the App Clip, the card pages, the console and their design are ours or our licensors'. We give you a personal, non-transferable right to use them under these terms.
• App stores. If you got the app from the App Store, Apple's standard Licensed Application End User License Agreement also applies to the app. If you got it from Google Play, Google Play's terms apply to the download and to purchases. Apple and Google are not parties to these terms and are not responsible for the service or its support.
• Feedback. If you send us ideas or suggestions, we may use them without owing you anything.

Availability and changes to the service

We work to keep the service running and your cards online, but we cannot promise it will always be available or free of errors. We sometimes need to interrupt it for maintenance or to fix problems.

Parts of the service depend on others: Apple and Google for the apps, purchases and notifications, Apple for the App Clip, App Clip cards and Apple Wallet, Stripe for team billing, DigitalOcean for hosting, and the services a team connects. We choose these providers with care. If you use the service for your business, we are not liable for their outages or decisions that we could not reasonably prevent or work around.

We improve the service and may change or remove features for a valid reason, such as a change in technology, in the law or in what our providers offer, at no extra cost to you. If we remove or reduce a feature that a paid plan includes, it stays available until the end of the period you have already paid for. We tell you by email at least 30 days before the renewal from which the change applies, so you can cancel before it.

If we stop offering the service, we tell you at least 60 days before. A team gets back, through Stripe, the part of the period already paid that is left. Personal and Pro stop renewing, and Apple or Google handle any refund.

Warranty and liability

If you are a consumer, you keep every right that mandatory consumer law gives you, including the legal guarantee that the service conforms to the contract (Decreto-Lei n.º 84/2021). Nothing in these terms limits those rights or our liability to you under the law.

Nothing in these terms excludes or limits our liability for damage we cause intentionally or through gross negligence, whether ourselves or through the people and providers we work with, for death, personal injury or damage to health, for damage to property outside the contract, or for anything else the law does not allow us to exclude or limit.

If you use the service for your business, then, apart from that and as far as the law allows:

• we are not liable for indirect loss, such as lost profits or lost business, or for loss of data you could have kept by exporting it;
• our total liability in any 12 months is limited to the higher of what you paid for the service in those 12 months and EUR 100.

If you use the service for your business and someone makes a claim against us because of what is on your cards, or how you collected or used the contacts on them, you cover our reasonable costs of that claim, as far as you are responsible for it.

Changes to these terms

We may change these terms for a valid reason: a change to the service, to the law or to a decision of a court or authority, or to protect users or the service. If a change reduces your rights or raises what you pay, we email every account holder at least 30 days before it applies. You can then cancel your subscription or delete your account before the change applies, and a team gets back, through Stripe, the part of the period already paid that is left. Other changes apply from the date at the top of this page.

Governing law and disputes

These terms are governed by Portuguese law. If you are a consumer living in another country, you also keep the protection of the mandatory laws of that country.

If a dispute arises, write to us first: most problems can be solved that way. Courts in Coimbra, Portugal, decide disputes with business customers. If you are a consumer, you can also go to the courts where you live.

If you are a consumer, you can also bring a dispute with us to a consumer arbitration centre. For disputes up to EUR 5,000, we must take part if you choose this path. The centres competent for us are:

• Centro de Arbitragem de Conflitos de Consumo do Distrito de Coimbra (CACCDC), www.centrodearbitragemdecoimbra.com;
• Centro Nacional de Informação e Arbitragem de Conflitos de Consumo (CNIACC), www.cniacc.pt.

The Direção-Geral do Consumidor lists all consumer arbitration centres at consumidor.gov.pt. You can also file a complaint in the electronic complaints book, the Livro de Reclamações.

Other terms

• If a court finds part of these terms invalid, the rest stays in force.
• If we do not enforce a right straight away, we do not give it up.
• We transfer this agreement to a company that takes over the service only if you agree. We ask you by email, name the company, and give you at least 30 days to answer. If you do not agree, we may end the agreement at the end of that time, and a team gets back the part of the period already paid that is left.
• For business customers, these terms, the data processing agreement and any separate agreement with us are the whole agreement about the service. Our privacy policy explains how we handle personal data. It is information, not part of this agreement.

Contact

Model withdrawal form

Complete and return this form only if you wish to withdraw from the contract.