How cards and data are protected: EU database (Frankfurt), row-level security, guest cards without personal data, logged stamps, export and deletion.