Security
What we store, what we never send anywhere, and how you take everything back. Where something is not built yet, we say planned.
Checked against the product on 27 October 2026
What we store
- The email address you sign in with, so we can send you a sign-in code. It is not shown on your card unless you add it as a detail.
- The card details you type: name, role, organisation, phone numbers, emails and links, and a photo and link buttons if you add them. Each detail has its own setting for who can see it. Only if you switch it on, we also keep your directory listing (category and town).
- Your connections (who is connected to whom) and the requests between people.
- One word about how you found Cincio, chosen from a short fixed list. We only count these together.
Who sees your details
Only your name, role and organisation start public. Phone numbers, emails and every other detail start visible to your accepted connections only. A photo and link buttons start as Only me. You change each one yourself. One rule engine decides every detail shown on your card page, in the saved contact file and in the app, and it shows nothing by default.
What we never share
Cincio uses no advertising network, and card contents are kept out of our logs. Product analytics, when switched on, never receives card contents. The directory's Ask box sends your question and the public listed details of matching entries to Cloudflare Workers AI to write an overview; Cincio does not store the question, and Cloudflare says it keeps no inputs or outputs and does not train on them. The public card page loads nothing from any other website.
Signing in
There are no passwords. We email you a six-digit code that works once, lasts ten minutes and stops after five wrong tries. We keep only a scrambled form of it, never the code itself.
Export or delete everything
In your account you can download everything we hold about you in an open format, or delete your account, which erases it. Deleting asks for a code we email you, so nobody else can do it for you.
If an organisation listed you, the link it gave you lets you remove the card with a code sent to your email, no account needed. Anyone can also report a card from its page. How removal works
Reporting a problem
Anyone can report a card from its page. Several reports of phishing or pretending to be someone hold a card out of view until a person has looked at it, and we aim to act on a report within 24 hours.
Where your data sits
The service runs on Cloudflare, and the database is in Frankfurt. Sign-in emails are sent from a company Google account without a written processing agreement; moving to a sender with one is planned.
Planned A sender with a written processing agreement for sign-in emails.
The law
Cincio is the responsible party under South Africa's POPIA. We have not yet registered an Information Officer with the Information Regulator, and we will say so here when it is done. Read the privacy policy and the terms.