Privacy Policy
Transparency by design. Learn how Doppl collects, protects, and handles your personal information across physical NFC cards, Living Profiles, and team workspaces.
October 12, 2026
Doppl Inc.
Lahore, Pakistan
Welcome to Doppl ("Your Digital Double")
Doppl operates a modern professional identity and contactless networking platform combining physical Near-Field Communication (NFC) hardware products with dynamic, cloud-hosted digital profile web pages and team management workspaces (collectively, the "Services").
Introduction and Scope
This Privacy Policy describes how Doppl collects, uses, discloses, protects, and retains personal data when you:
- Visit our website at
doppl.digitalor related landing pages; - Purchase physical Doppl NFC cards (such as our Classic Black, Classic White, Ocean Blue, Metallic Silver, Rose Gold, Midnight Navy, Carbon Fiber, and Limited Edition finishes);
- Create, customize, and manage a Living Professional Profile or company workspace (Free, Pro, or Business tiers);
- Tap or scan a Doppl physical card or QR code to view a public Living Profile (
doppl.digital/username); or - Submit your contact details to a cardholder via our "Share Back" two-way lead capture form.
Please read this Privacy Policy carefully. By using any part of the Services or purchasing our hardware, you acknowledge the collection and processing of your personal information as set forth herein. If you do not agree, please do not use the Services.
The Dual-Role Framework: Data Controller vs. Data Processor
In alignment with international data protection benchmarks (including the EU and UK General Data Protection Regulation, the California Consumer Privacy Act / CPRA, and related global privacy standards), Doppl operates in two distinct legal capacities:
Doppl as Data Controller
Doppl acts as a Data Controller with respect to:
- Personal data collected directly from individuals when registering for a Doppl account, configuring personal profiles, or interacting with our websites;
- Billing, transactional, and order fulfillment records gathered during the purchase of physical NFC cards and recurring subscriptions; and
- Server logs, aggregated card tap counts, device telemetry, and product analytics collected from visitors to our public domains.
Doppl as Data Processor
When enterprise organizations, corporate teams, or individual subscribers use Doppl's Services to capture, collect, import, or manage contact information from prospective clients:
- The Customer (Cardholder or Organization) is the Data Controller of those prospective contact records.
- Doppl acts solely as a Data Processor, processing that prospect data on the Customer's behalf and strictly pursuant to their instructions.
- Governed by our Data Privacy Addendum (DPA) incorporated into all business accounts.
Information We Collect
3.1 Information You Directly Provide to Us
Account & Profile Credentials: Full name, business email address, password, profile photo/avatar, current job title, company name, professional biography, accredited credentials, and social media handles (LinkedIn, X/Twitter, GitHub, etc.).
Portfolio & Career Content: Uploaded resume files (PDF), design case studies, portfolio image assets, external booking links (e.g., Calendly), and verified skill endorsements.
E-Commerce & Shipping Information: Recipient name, physical mailing/delivery address, city, postal code, phone number, and special delivery instructions required to manufacture, laser-engrave, and courier physical NFC cards.
Corporate & Team Data: Corporate domain names, single sign-on (SSO) credentials, department structures, employee email rosters, and organizational seat assignments.
Communications & Support: Messages, feedback, inquiries, or bug reports submitted to our customer care team via email or support channels.
3.2 When Interacting With Public Profiles (Card Taps & QR Scans)
Zero App Requirement- Reciprocal "Share Back" Lead Capture: If the recipient elects to exchange contact information using the mobile "Share Back" feature, we collect their name, email address, phone number, company, job title, and any custom notes they enter. This information is instantly routed to the cardholder and stored securely in their account.
- One-Tap vCard Downloads: When a recipient downloads a cardholder's
.vcfcontact file into Apple Contacts or Google Contacts, the transaction is logged as an interaction metric. - Zero App Requirement: Profile visitors do not need to download an application or create an account to view public profile pages or download vCards.
3.3 Information Collected Automatically (Telemetry & Analytics)
Hardware & Browser Specs: Device operating system (iOS, Android, macOS, Windows), mobile browser version, screen dimensions, and referral source.
Tap & Interaction Metrics: Total card tap occurrences, unique profile visitors, link click-throughs on portfolio links, and timestamp of the encounter.
Coarse Geolocation: We derive approximate, coarse geographic location (city and country level only) from the connecting IP address to provide cardholders with networking reach insights. Doppl does NOT track or store precise GPS coordinates or real-time location trails.
How We Use Your Information
Doppl uses collected personal information for specific, lawful purposes:
1. Providing & Operating the Services
To generate your Living Profile, link physical NFC chips to your dynamic URL (doppl.digital/...), deliver reciprocal contact exchanges, and allow one-tap vCard downloads.
2. Manufacturing & Fulfilling Physical Cards
To print, laser-engrave, verify, package, and ship physical NFC cards through trusted courier partners.
3. Managing Subscriptions & Payments
To authenticate subscription statuses (Free, Pro at $6.99/mo, Business at $24/mo) and process transactions via certified third-party payment gateways.
4. Delivering Interaction Analytics
To provide users and enterprise admins with analytics dashboards detailing profile views, tap counts, and networking channel breakdowns.
5. Security, Fraud Prevention & Integrity
To prevent unauthorized card cloning, deter phishing, block malicious links, and protect against fraudulent card orders.
6. Customer Support & Service Notices
To send critical order updates, delivery tracking numbers, technical notices, billing receipts, security alerts, and administrative messages.
Organization Workspaces & Team Administrator Authority
If your Doppl user profile is created under an enterprise or team workspace (such as through our Doppl Business Tier):
Administrator Access & Supervision: Any personal information, work history, business credentials, and captured leads collected via cards assigned by that Organization will be accessible to authorized account administrators ("Admins").
Profile Management Powers: Company Admins have the legal authority to assign, modify, restrict, reassign, or delete employee profile seats, deactivate departing employee cards, and export teamwide networking leads to corporate CRM systems.
Corporate Ownership: Company-assigned email handles, custom corporate subdomains, and leads gathered while acting as an organizational representative belong to the subscribing organization.
How and With Whom We Share Personal Data
6.1 Authorized Third-Party Sub-processors
We engage vetted third-party service providers to support our platform infrastructure. Each operates under strict contractual obligations of confidentiality and data security:
| Category | Representative Providers | Primary Processing Function | Location |
|---|---|---|---|
| Cloud Hosting & Infrastructure | Vercel Inc., Amazon Web Services (AWS), Google Cloud | Web hosting, serverless computing, API routing, edge delivery | United States / Global |
| Payment Gateways | Stripe Inc., Local Regional Gateways | PCI-DSS tokenized payment and recurring subscription billing | United States / Global |
| Transactional Email & Messaging | Twilio SendGrid, Resend, Loops | Sending order receipts, tracking numbers, security codes, lead alerts | United States |
| Product & Tap Telemetry | PostHog Inc., In-House Telemetry | Aggregated card tap analytics, feature usage, link click counts | United States / EU |
| Physical Courier Partners | DHL, FedEx, TCS, National Postal | Physical card delivery and doorstep tracking | Global / Regional |
Note: All credit/debit card transactions are processed through tokenized, PCI-DSS Level 1 certified processors. Doppl never stores, handles, or retains raw credit card numbers or security CVV codes.
6.2 Organization Admins: Member profiles registered under an organizational workspace are visible to organizational account administrators.
6.3 Business Transfers: If Doppl Inc. undergoes a merger, acquisition, corporate restructuring, sale of company assets, or insolvency proceeding, customer records and profile data may be transferred to the acquiring entity, subject to continued adherence to this Privacy Policy.
6.4 Legal Compliance and Public Safety: We may disclose personal data if required by applicable law, court order, regulatory warrant, or governmental subpoena, or where disclosure is reasonably necessary to protect the legal rights, safety, or physical security of Doppl, our users, or the general public.
Cookies and Tracking Technologies
7.1 Public Profile Pages (NFC Taps & QR Scans)
We believe in a frictionless, privacy-first networking experience. When someone taps your physical NFC card or scans your backup QR code in person, Doppl places zero third-party advertising cookies or cross-site tracking scripts on their device. The profile opens instantly in their native mobile browser without intrusive cookie pop-ups or cross-site tracking pixels.
7.2 Authenticated Account Dashboard Cookies: For registered users accessing the Doppl web app and dashboard:
- Essential Cookies: Strictly necessary cookies used to manage active login sessions, maintain authentication tokens, protect against Cross-Site Request Forgery (CSRF), and remember interface preferences (e.g., dark mode).
- Local Storage: We utilize browser localStorage to preserve temporary form drafts and interface state.
7.3 Do Not Track (DNT) Signals: Because Doppl does not track its users over time across third-party websites or engage in behavioral target advertising, our platform does not alter its behavior upon receiving browser "Do Not Track" signals.
Physical NFC Hardware Privacy & Security
Battery-Free Contactless
Doppl physical cards utilize passive NFC chips that contain no battery and transmit no power or wireless signal until brought within millimeters of an active NFC-enabled smartphone.
Dynamic Cloud Linking
The physical card does not store your full personal dossier in unencrypted chip memory. Instead, the chip points securely to your unique encrypted URL string.
Remote Deactivation
If your physical card is lost or stolen, you can instantly decouple or freeze the card directly from your Doppl dashboard. The card URL will immediately stop serving your details.
Data Retention and Account Erasure
9.1 Account Deletion Timeline
You maintain full control over your digital identity. If you request account closure or initiate account deletion:
- Immediate Invalidation: Your public profile URL (
doppl.digital/username) is instantly deactivated and returns an HTTP 404 (Not Found) status. All paired physical NFC cards cease to resolve. - 30-Day Permanent Purge: Within thirty (30) days following deletion, all associated personal information, uploaded resumes, portfolio images, and captured contact records are permanently erased from our production servers and active databases.
- Residual Backups: Encrypted database disaster-recovery backups are purged in the normal rotation cycle (not to exceed 60 days).
9.2 Hardware Order Records
Records of physical card shipments (name, shipping address, and proof of dispatch) are retained for a period of up to one (1) year following purchase to honor our 1-Year NFC Hardware Warranty and verify replacement eligibility, as well as to comply with tax and commercial reporting statutes.
International Data Transfers
Doppl operates globally, with core cloud infrastructure located primarily in the United States and global edge nodes. If you access our Services from the European Economic Area (EEA), the United Kingdom, Switzerland, or other jurisdictions with data transfer restrictions:
- You acknowledge and authorize the transfer, hosting, and processing of your personal information in jurisdictions outside your home country.
- To safeguard cross-border transfers of European and UK personal data, Doppl relies on the European Commission’s Standard Contractual Clauses (SCCs) (Commission Implementing Decision (EU) 2021/914, Module Two: Controller-to-Processor and Module One: Controller-to-Controller) and the UK International Data Transfer Addendum, ensuring an equivalent standard of data protection.
Your Global Privacy Rights (GDPR / Global Standards)
Regardless of your geographic location, Doppl grants users comprehensive privacy rights over their personal information:
Right of Access / Know
Request a complete copy of the personal information Doppl maintains about you.
Right to Rectification
Correct, edit, or update incomplete or inaccurate information directly through your dashboard.
Right to Erasure ("Be Forgotten")
Request the permanent deletion of your account and personal data across our systems.
Right to Restriction
Pause or limit the processing of your personal information in certain statutory circumstances.
Right to Data Portability
Request your data in portable, machine-readable formats (.vcf vCard and .csv exports).
Right to Withdraw Consent & Complain
Withdraw consent at any time or lodge an inquiry with your national supervisory authority.
To exercise any of these rights, contact us at privacy@doppl.digital. We verify identity prior to fulfilling sensitive requests and respond within statutory deadlines (typically 30 calendar days).
California Privacy Rights Addendum (CCPA / CPRA)
This section applies exclusively to California residents pursuant to the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 ("CCPA/CPRA").
12.1 Categories of Personal Information Collected
In the preceding twelve (12) months, Doppl has collected the following statutory categories:
- Identifiers: Legal name, email address, postal shipping address, telephone number, IP address, and unique Doppl handle.
- Customer Records: Name, business contact information, payment status, and physical shipping details.
- Commercial Information: Records of physical card styles ordered, subscription tier purchases, and transaction histories.
- Internet or Network Activity: Browser type, device operating system, referral domain, card tap timestamps, and link interaction counts.
- Geolocation Data: Coarse, IP-derived city and country location (no precise GPS).
- Professional or Employment Information: Job title, company affiliation, verified credentials, and uploaded resume details.
12.2 Strict "Do Not Sell or Share" Guarantee
- We DO NOT sell your personal information.
- We DO NOT share your personal information for cross-context behavioral advertising.
- In the preceding twelve (12) months, Doppl has neither sold nor shared the personal information of California consumers of any age.
12.3 Use of Sensitive Personal Information: Doppl collects only the minimum sensitive personal information required to authenticate account logins (e.g., account password hashes). We do not use or disclose sensitive personal information to infer consumer characteristics or for any purpose beyond providing requested Services.
12.4 How to Exercise Your California Rights: California residents may submit a verifiable consumer request to know, access, correct, or delete personal data by emailing privacy@doppl.digital with the subject line "California Privacy Rights Request". You may also designate an authorized agent. We will never discriminate against you for exercising your CCPA rights.
Children's Privacy
The Services are designed strictly for adult professionals, corporate employees, and young adults seeking professional networking tools. Our Services are not directed to individuals under the age of 13 (or under 16 in certain EU member states). We do not knowingly collect personal data from children under 13. If we discover that a child under 13 has submitted personal information, we will immediately delete that information from our systems.
Data Security Architecture
Doppl implements robust technical and organizational security measures to safeguard your personal data:
Encryption in Transit
Strictly enforced TLS 1.2 and TLS 1.3 encryption across all web traffic and API routes.
Encryption at Rest
Advanced Encryption Standard (AES-256) on sensitive database fields and stored files.
Access Control (RBAC & MFA)
Strict role-based access controls, multi-factor authentication, and least-privilege principles.
Continuous Monitoring
Continuous automated vulnerability assessments and threat detection protocols.
Please note that no method of transmission over the Internet or electronic storage is 100% impenetrable. We encourage you to use a strong, unique password and safeguard your account credentials.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect modifications in our technology, product offerings, or applicable legal standards. When we publish changes, we will update the "Last Updated" date at the top of this document. For material modifications, we will provide prominent notice via email or a notification banner within your Doppl dashboard prior to the changes taking effect.
Contact Us
If you have questions, feedback, or concerns regarding this Privacy Policy or Doppl's data protection practices, please contact our Privacy Team:
Doppl Inc.
Lahore, Pakistan
© 2026 Doppl Inc. All rights reserved.