Privacy Policy

1. Who we are

CAARD UG (haftungsbeschränkt), Bauerngasse 103, 97421 Schweinfurt, Germany (“CAARD”, “we”). Email: dhairya@caard.net.

We are the controller for data about your own CAARD account and how you use CAARD. Our full company details are in our Legal Notice: https://dash.caard.net/en/legal/impressum.

2. Whose data this policy covers

Users: people who sign in to CAARD, usually employees of a company that has a CAARD workspace.

Contacts: people whose details a user captures, for example by scanning their business card or event badge.

Contact data in a company workspace is processed on behalf of that company. The company decides what its team captures and is the controller of that data; we act as its processor under a data processing agreement (Art. 28 GDPR). If you use CAARD without a company workspace, you decide which contacts you capture and are responsible for doing so lawfully.

3. Data about your account

Your name, email address, username and profile photo.

Sign-in details: your password, which our sign-in provider stores only as a secure hash, or the account you sign in with, such as Sign in with Apple.

Your workspaces, roles and team memberships.

Your settings, such as language, theme, time zone, currency, default lead tag and notification preferences.

If you connect a mailbox, CRM, calendar or Slack: the access tokens that connection needs, stored encrypted, and the name or email address of the connected account.

For company workspaces that pay for CAARD: the billing contact’s name and email address. Card details are entered directly with our payment provider, Stripe, and never reach us.

Messages you send us, such as support tickets and feature requests, including attachments.

4. Data you capture about contacts

Photos of business cards and event badges, and the LinkedIn QR codes you scan. The card photo is stored with the lead.

Contact details read from the card or typed in by you: name, job title, company, email address, phone numbers, address, website and LinkedIn profile.

Notes, tags, custom fields, events, follow-up tasks, and emails you send to a contact from CAARD.

Voice notes: when you record a note, the audio is turned into text. Audio recorded while you are online is used only for that and is not stored. Audio recorded while you are offline is stored with the lead so you can play it back, until you or your workspace delete it.

Where you met, if you turn it on: the app saves your precise location once, at the moment you save a lead, and stores it with that lead. You can turn this off at any time in Settings.

Enrichment, if turned on: we search publicly available web sources for professional information about a contact or their company, such as role, company details, public profiles and a profile photo, and add it to the lead.

Lead scoring, if your workspace uses it: leads are scored against an ideal customer profile the workspace defines. Scores help the team decide whom to follow up with first. They do not lead to decisions with legal or similarly significant effects on anyone.

Lead Finder and event research, on the web dashboard: users can search public web sources for companies and people that match criteria they set, for example the exhibitors of a trade fair.

5. Permissions on your phone

Camera: to scan cards, badges and QR codes, only while the scanner is open.

Photos: to import a card photo or choose a profile photo. The app reads only the photos you pick.

Microphone and speech recognition: to turn your voice notes into text, only while you record.

Location: only while you use the app, only if you turn it on, and only when you save a lead. CAARD never tracks your location in the background.

Notifications: local reminders, for example when leads you saved offline still need to sync. The app does not use push notifications.

Face ID or fingerprint: if you use biometric sign-in, your device checks it. We never receive biometric data.

You can change these permissions at any time in your phone’s settings.

6. Usage and technical data

Mobile apps: the iPhone and Android apps contain no analytics, advertising or tracking SDKs. Our servers receive the technical data any connection involves, such as your IP address.

Web dashboard, analytics: we use PostHog, hosted in the EU, to understand which features are used. Events are linked to your account ID, name, email address and workspace. Automatic click capture and session recording are turned off, and contact data is never sent to analytics.

Web dashboard, error monitoring: we use Sentry, hosted in the EU, to find and fix errors. Sentry receives technical details such as your IP address, browser, the page you were on and the error. For a sample of sessions, and for sessions in which an error occurs, Sentry records a replay of the page with all text and images masked.

Product demo: on demo.caard.net we use PostHog to understand how visitors use the demo, including recordings of demo sessions, and link the visit to details you enter, such as your email address and company. Where the law requires it, we ask for your consent first.

Cookies and device storage: the web dashboard uses cookies that sign-in needs and browser storage for your preferences and analytics. The mobile apps keep your sign-in session in the phone’s secure storage, and your preferences and any leads waiting to sync on the phone.

7. How we use your data and on what legal basis

To provide CAARD: run your account, read and store the contacts you capture, transcribe voice notes, sync with the tools you connect and send the emails you ask us to send (Art. 6(1)(b) GDPR, performance of a contract with you or your employer). For contact data in a company workspace we act on the workspace’s instructions.

To run the AI features you use, such as reading cards, transcription, email drafts, enrichment, lead scoring and the in-app assistant (Art. 6(1)(b) GDPR, and for enrichment and scoring the workspace’s legitimate interest in following up with its contacts, Art. 6(1)(f) GDPR).

To keep CAARD working and secure: error monitoring, preventing abuse and understanding which features are used (Art. 6(1)(f) GDPR, our legitimate interest in a reliable and secure product, or your consent under Art. 6(1)(a) GDPR where the law requires it).

To communicate with you: service messages, invitations and replies to support requests (Art. 6(1)(b) GDPR).

To meet legal obligations, such as tax and accounting rules (Art. 6(1)(c) GDPR).

We do not sell personal data, we do not use it for advertising, and we do not track you across other companies’ apps or websites.

8. AI processing

To complete a task, we send AI providers the data that task needs: card photos, voice recordings and the relevant lead details. OpenAI reads cards and badges, transcribes recordings, drafts emails and powers enrichment, lead scoring and the in-app assistant. ElevenLabs transcribes your voice while you dictate. On iPhone, if live transcription is unavailable, Apple’s speech recognition is used, on the device where possible.

These providers process the data on our behalf. AI output can be wrong, so check details read from a card before you rely on them.

9. Who we share data with

We use these service providers to run CAARD. They process data only on our behalf and under our instructions:

Clerk (USA): sign-in and account management.

Convex (USA): database, file storage and backend.

Vercel (USA): hosting of the web dashboard, mobile web app and demo.

OpenAI (USA) and ElevenLabs (USA): AI processing, see above. Apple: speech recognition on iPhone, see above.

Exa (USA) and Firecrawl (USA): web search, used to open LinkedIn QR codes and for enrichment, Lead Finder and event research.

unavatar.io: finds public profile photos for contacts from their LinkedIn profile. Your device may load these photos directly.

Google: the app loads company logos from Google’s favicon service, and our servers use Google Public DNS to check company domains.

OpenStreetMap Nominatim: turns a location into a place name and searches places. Maps are shown with Apple Maps on iPhone and OpenFreeMap on Android; the web dashboard uses map tiles from CARTO and OpenStreetMap and place search from Photon by komoot.

PostHog (EU) and Sentry (EU): analytics and error monitoring for the web dashboard, see above.

Stripe: payments and invoices for company workspaces.

Resend (USA): sends the emails on our demo site.

Integrations you connect: if you or your workspace connect Gmail, Microsoft Outlook, HubSpot, Salesforce, Zoho, Attio, Pipedrive, Microsoft Dynamics 365, monday.com, Slack, Calendly, Cal.com, HubSpot Meetings or Chili Piper, we send that service the data you choose to sync. It processes the data under its own terms and privacy policy.

Authorities, when the law requires us to.

10. Transfers outside the EU

Some of our providers are based in the USA. Where a provider is certified under the EU–US Data Privacy Framework, we rely on the European Commission’s adequacy decision. Otherwise we use the Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR).

11. How long we keep data

Account data: for as long as your account exists. When you delete your account, we delete it as described in the next section.

Contacts: for as long as the workspace keeps them. Deleted leads go to the trash and are permanently deleted after 90 days, including card photos and voice recordings, or sooner if someone empties the trash.

Activity history on leads: 60 days.

Voice notes recorded online: not stored after transcription.

Analytics and error data: deleted automatically by PostHog and Sentry at the end of the retention period of our plan.

Billing records: as long as German commercial and tax law requires, up to 10 years.

Deleted data can remain in backups for a limited time until those backups are overwritten.

12. Deleting your account

You can delete your account at any time: in the iPhone or Android app under My account → Delete Account, in the mobile web app under My account, or on the web dashboard under Settings → General → Danger zone. You can also email dhairya@caard.net from the address you sign in with.

We delete your sign-in account immediately. Usually within minutes, we also delete your profile; your personal workspace with all its leads, card photos, voice recordings and notes; your connected mailboxes; your assistant conversations, notifications, personal tasks, templates and saved searches; your support tickets; and your roles and memberships in company workspaces.

Leads you captured in a company workspace belong to that company and stay in its workspace. To have them removed, ask your workspace admin.

We keep only what we have to: billing records the law requires, AI usage counts without content, and security logs of administrative actions. Notifications your teammates already received can still mention your name.

Step-by-step instructions: https://dash.caard.net/en/legal/delete-account.

13. Your rights

Under the GDPR you have the right to access your data (Art. 15), to have it corrected (Art. 16) or deleted (Art. 17), to restrict its processing (Art. 18), to receive it in a portable format (Art. 20) and to object to processing based on legitimate interests (Art. 21).

Where we rely on your consent, you can withdraw it at any time. This does not affect processing that took place before.

To use any of these rights, email dhairya@caard.net. We reply within one month. To get a copy of your data, ask us by email; workspace admins can also export leads as a CSV file from the web dashboard.

You also have the right to complain to a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

14. If a CAARD user captured your details

If someone scanned your business card or entered your details in CAARD, the company they work for decides what happens to your data and is responsible for it. Usually they keep your details to follow up on your conversation, and they may add them to their CRM.

To see, correct or delete your data, or to object, contact that company. If you don’t know who they are or can’t reach them, email dhairya@caard.net and we will help.

15. Children

CAARD is a business tool and is not meant for children. We do not knowingly collect data from anyone under 16.

16. Security

All connections to CAARD are encrypted with TLS. Credentials for connected mailboxes and integrations are stored encrypted. Only staff who need it to run and support CAARD can access production data, and administrative actions are logged.

No system is completely secure. If a breach affects your data, we will inform you and the authorities as the law requires.

17. Changes to this policy

We update this policy when CAARD or the law changes. The date at the top shows the current version. If a change significantly affects how we use your data, we will tell you in the app or by email before it takes effect.

18. Contact

Questions about this policy or your data:

CAARD UG (haftungsbeschränkt), Bauerngasse 103, 97421 Schweinfurt, Germany

Email: dhairya@caard.net