Effective [10/15/2026] · Applies to xintcard.com
XintCard is built on one idea: a payment card should give criminals nothing to steal. We apply the same principle to this website. We collect as little as we can, we explain exactly what we collect and why, and we never ask you for card numbers, PINs, passwords or one-time codes.
No card numbers, PINs, passwords or one-time codes are ever requested or stored by this website.
No advertising, analytics or social-media tracking scripts, pixels or cookies.
We do not sell your personal information or share it for targeted advertising.
Ask us at any time to see, correct or delete your information, or to stop sending updates.
Who we are
This website is operated by XintCard Inc. ("XintCard", "we", "us"). XintCard is responsible for the personal information collected through this website and decides how it is used. In the language of data protection law, we are the controller of that information.
- Email: hello@xintcard.com
- Postal address: 3455 S 344th Way, Federal Way, WA 98001, USA
Scope of this policy
This policy covers the public XintCard website, including the home page, the contact page, the early-access page and our blog (Transmissions).
Information we collect
We only collect information that you choose to send us, plus a small amount of technical information that every website receives when you load a page.
| Source | What we collect | Why |
|---|---|---|
| Contact form/contact | Your name, email address, organization (optional), the topic you choose and your message. With it we record your IP address, browser details and the page you sent it from. | To read and reply to your message, and to detect spam and abuse. |
| Early-access list/access | Your name, email address, region and the card type you are interested in, and the date and time you agreed to receive updates. With it we record your IP address, browser details and the page you sent it from. | To keep your place on the early-access list, send you launch and issuance updates, and invite you when cards become available in your region. |
| Visit and security logevery page request | Your IP address, the page and query requested, the response code, the referring page, your browser's user-agent string (from which we derive browser, operating system and device type, and whether the request came from a bot) and the response time. | To protect the website against attacks, block abusive traffic, diagnose errors and understand overall traffic. |
| Verification codecontact form | A one-way, scrambled version of the six-character code shown in the signal decoder, held only in your browsing session. | To check that a person, not a bot, is sending the message. It is single-use and expires after 30 minutes. |
What we never collect
- Card numbers, security codes (CVV), PINs, passwords or one-time codes. If anyone claiming to be XintCard asks you for these, it is a scam.
- Government identity numbers or documents.
- Precise location. The region you select on the early-access page is chosen by you and is not derived from your device.
- Information from advertising networks, data brokers or social-media trackers.
How and why we use information
We use personal information only for the purposes described in this policy:
- Answering you. We use contact-form details to read and reply to your message and to keep a record of the conversation.
- Running the early-access list. We use your details to keep your place in the queue for your region and to email you launch and issuance updates.
- Keeping the website secure. We use visit and security logs to detect and block attacks such as automated scanning, injection attempts and spam, and to fix errors.
- Understanding demand. We look at overall, aggregated numbers, such as how many people joined the early-access list from each region, to plan our launch.
- Meeting legal obligations. We may use or keep information where the law requires it.
We do not use your information for automated decisions that have legal or similarly significant effects on you, and we do not build advertising profiles.
Legal bases (EU, EEA and UK)
If you are in the European Economic Area or the United Kingdom, we rely on these legal bases:
| Purpose | Legal basis |
|---|---|
| Replying to contact messages | Our legitimate interest in responding to people who contact us. Where your message is about becoming a customer, taking steps at your request before entering into a contract. |
| Early-access updates | Your consent, which you give by ticking the box on the early-access page. You can withdraw it at any time. |
| Security and visit logs | Our legitimate interest in keeping the website and its visitors safe and the service running. |
| Legal requirements | Compliance with a legal obligation. |
Cookies and similar technology
This website uses only the cookies it needs to work securely. We do not use advertising or analytics cookies, so we do not show a cookie consent banner for them.
| Name | Purpose | Duration |
|---|---|---|
xintcard-session |
Keeps your browsing session, including the verification code for the contact form and messages shown after you submit a form. | 2 hours of inactivity |
XSRF-TOKEN |
Protects forms against cross-site request forgery, a type of attack in which another website tries to submit a form on your behalf. | 2 hours of inactivity |
Both cookies are strictly necessary. They contain no advertising identifiers and are not shared with other companies. You can block or delete cookies in your browser settings, but the contact and early-access forms will not work without them.
Who we share information with
We do not sell your personal information, and we do not share it with anyone for their own marketing. We share it only in these situations:
- Service providers who help us run the website, such as our hosting provider and our email delivery provider (for example, when a new message is forwarded to our team inbox). They may only process the information on our instructions and must protect it.
- Legal reasons, where we are required to by law, court order or a valid request from a public authority, or where it is necessary to protect the rights, property or safety of XintCard, our users or others, for example to investigate fraud.
- Business changes. If XintCard is involved in a merger, acquisition or sale of assets, personal information may be transferred as part of that transaction. It will remain protected by this policy or a notice that is at least as protective.
Links to our social-media profiles take you to other companies' websites, which have their own privacy policies. We do not load their content or trackers on our pages.
International transfers
Our service providers may store or process information in countries other than your own, including the United States. Where we transfer personal information out of the EEA or the UK, we use safeguards recognized by law, such as the European Commission's Standard Contractual Clauses, or rely on an adequacy decision.
How long we keep information
| Information | Kept for |
|---|---|
| Visit log | 90 days, then deleted automatically. |
| Security events and sign-in records | 180 days, then deleted automatically. |
| Blocked addresses | Until the block expires or is lifted. |
| Contact messages | As long as needed to handle your enquiry and any follow-up, then deleted. You can ask us to delete them sooner. |
| Early-access list | Until you ask to be removed, withdraw consent, or the early-access program ends, whichever comes first. |
| Verification codes | Single-use, expiring after 30 minutes. Never kept after your session ends. |
How we protect information
Security is our product, so we hold this website to the same standard:
- Pages and forms are served over encrypted connections (HTTPS).
- Verification codes are stored only as one-way scrambled values and are never kept in readable form.
- Access to messages and the early-access list is limited to authorized XintCard staff, through a private dashboard with strong-password rules and sign-in monitoring.
- Every request is checked for known attack patterns, and abusive addresses are blocked automatically.
No system is perfectly secure. If we learn of a breach that affects your personal information, we will notify you and the relevant authorities as the law requires.
Your rights and choices
Depending on where you live, you may have the right to:
- Access the personal information we hold about you and get a copy of it.
- Correct information that is inaccurate or incomplete.
- Delete your information.
- Object to or restrict how we use it.
- Receive your information in a portable format.
- Withdraw consent to early-access updates at any time. This does not affect anything we did before you withdrew it.
- Complain to your local data protection authority. In the UK this is the Information Commissioner's Office (ICO). In the EU it is the authority in the country where you live or work.
To use any of these rights, email hello@xintcard.com from the address you used with us, or tell us which address it was. We may ask you to confirm your identity before acting on a request. We reply within one month, or sooner where the law requires.
US state privacy rights
If you live in a US state with a consumer privacy law, such as California, you can ask what personal information we have collected about you, ask us to delete or correct it, and opt out of its sale or sharing. We do not sell personal information or share it for cross-context behavioral advertising, and we have not done so in the past 12 months. We will not discriminate against you for using your rights. You may use an authorized agent to make a request on your behalf.
Children
This website is not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has sent us personal information, contact us and we will delete it.
Changes to this policy
We may update this policy as our website and services change. The revision date at the top of this page shows when it last changed. If we make a significant change, we will make it clear on this page and, where appropriate, tell people on the early-access list by email.
Contact us
For any question about this policy or your personal information, email hello@xintcard.com, use our contact page, or write to XintCard Inc., 3455 S 344th Way, Federal Way, WA 98001, USA.