Who is responsible

HeyBadge is run by Mayas Ötegen, an individual in Dubai, United Arab Emirates. Mayas decides how your data is used (the "controller"). Questions, requests and complaints: .

The laws we follow

We handle personal data under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). For people in the European Union, the European Economic Area and the United Kingdom, we also follow the GDPR and the UK GDPR, and for people in California, the CCPA as amended by the CPRA.

What's public

Everything you put on your badge: your name, title, company, location, photo, logo, skills, links, any phone number or email you add, and event details. Anyone with your link can see it, and chat apps show a preview picture of it when the link is shared. Your photo and logo are stored as public files: anyone who has the exact file address can open them.

What's private

• Your sign-in email. Used only to send your sign-in codes and, if ever needed, to contact you about your account.
• Your stats. Daily counts of views, link taps and scans of a printed badge. Stats keep only numbers: no names and no internet addresses.
• Swapped details. The names, phone numbers, emails and messages visitors leave for you, plus your own notes on them. Only you can see them.
• Credit. How many badges were made from yours. You see the number, not who made them.
• Reports. When someone reports a badge: the reason, an optional note and, if the reporter is signed in, their account number. Only the site owner reads reports.
• Site totals. The site owner sees site-wide counts (badges, sign-ups, views, taps) and which badges are viewed most. They don't see sign-in emails or swapped details. To review a report, the site owner can open a hidden badge.

If you're visiting a badge

Your browser keeps a small note so each visit counts once a day (see Cookies). There's no advertising, no analytics and no tracking.

If you swap details, your name, phone number and/or email and message go to that badge's owner only, and your browser remembers them so your next swap is quicker. To stop spam, each swap also keeps two codes: one made from a random number your browser keeps, and one made from your internet address. Both are mixed with a secret value before being stored, so the stored codes can't be turned back into your address. They are still pseudonymous personal data, not anonymous: they could be matched to the same browser or address later. They're used only to limit how many swaps one sender can make and to let an owner block someone. The owner never sees them, and they're wiped after 30 days.

A bot check (Cloudflare Turnstile) may run when you swap or sign in.

To have your swapped details deleted, ask the badge's owner (they can delete them in one tap), or email us at with the badge's link and the details you sent. We'll delete them.

Why we use it (legal bases)

We don't sell or share your personal data, use it for advertising, build profiles, or make automated decisions about you.

Things that run only on your device

• Photo background removal. If you tick "Remove the background", your photo is processed in your browser. It isn't sent anywhere for this; only the finished picture is uploaded when you publish.
• Pair your badge. The event badge PDF you choose is read in your browser and never uploaded. Your browser lets go of the file once it's read, or when you choose another file. The PDF you download is made on your device too.

Who handles it for us (processors)

• Supabase: database, photo storage and sign-in. Your data is stored in Supabase's Europe region.
• Cloudflare: hosts the site and its server functions (link previews, contact cards, Wallet passes, swaps) and runs the Turnstile bot check. Cloudflare's network sees internet addresses to deliver pages.
• Resend: sends the sign-in code emails.
• Google: when someone adds a badge to Google Wallet, the pass content (name, title, company, link and QR code) is sent to Google to make the pass.
• Apple: when someone adds a badge to Apple Wallet, the pass file goes to their Apple device and is kept by Apple Wallet under Apple's terms (for example, synced with iCloud).

Fonts and code libraries are hosted on HeyBadge itself, so your browser doesn't contact other sites to show the page. If you use a share button (WhatsApp, X, LinkedIn, Facebook, Threads or Telegram), that app or site receives the link you share under its own privacy policy.

International transfers

HeyBadge is run from the UAE. The database is stored in Supabase's Europe region, and Cloudflare, Resend, Apple and Google may handle data in other countries, including the United States. Where data leaves the UAE, the EEA or the UK, we rely on our providers' data processing agreements, which include the European Commission's Standard Contractual Clauses (and the UK addendum), and on equivalent safeguards under UAE law.

How long we keep it

A cleanup runs every night to remove anything past its period. When you delete your account, your badge, photos, stats, swapped details and credits are removed straight away. Our current Supabase plan doesn't keep backups, so deleted data isn't kept in a backup. If that changes, this page will say how long backups are kept.

Your rights

Depending on where you live, you can ask to see your data, correct it, delete it, get a copy to take elsewhere (portability), object to or restrict how we use it, and withdraw consent at any time (this doesn't affect what was done before).

Most of this you can do yourself. Sign in on the maker and open Your data to:

• download everything you've put on the site,
• take your badge offline, and put it back when you like,
• delete your account, which removes your badge, photos, stats and swapped details straight away.

For anything else, email . We reply within 30 days and may ask you to confirm it's you. It's free.

You can also complain to a data protection authority: in the UAE, the UAE Data Office; in the EU or EEA, the authority where you live or work; in the UK, the Information Commissioner's Office (ICO).

California residents: we don't sell or share personal information, and we don't use sensitive personal information to infer things about you. You have the right to know, delete and correct, and we won't treat you differently for using any of these rights.

Children

HeyBadge isn't for anyone under 16. Please don't make a badge or swap details if you're under 16. If we learn that a badge belongs to someone under 16, we'll delete it.

Security

The site only works over HTTPS. Database rules let each person read and change only their own data; visitors can open one badge at a time but can't download everyone's details. Swapped details are visible only to the badge owner. Access to the site's admin tools is limited to the site owner. If a breach puts your data at risk, we'll tell you and the authorities as the law requires.

Changes

If this policy changes, we'll update this page and the date at the top. If a change matters, we'll say so on the site before it takes effect.