Privacy Policy

1. Who We Are

CardScan is operated by Nörtti Paikalle Oy, Finland. We are the data controller for personal data collected about our users (account and billing data). For personal data contained in business card images you upload, you are the data controller and we act as your data processor.

2. What We Collect

We collect the minimum data necessary to operate the service:

• Account data — username, hashed password, and email address, stored securely in our database.
• Billing data — your payment method and billing history are held by Stripe. We store only your Stripe customer ID and subscription status.
• Usage data — a count of scans per day, used solely for billing.

3. Images You Upload

Business card images are transmitted to the Anthropic API for processing and are not stored on our servers. Anthropic's data handling is governed by their privacy policy. Extracted contact data is returned to your browser only — we do not log or store it.

4. Legal Basis for Processing

We process your account and billing data on the basis of contractual necessity (to provide the service you have signed up for). We do not process your personal data for any purpose beyond operating the service.

5. How We Use Your Data

We use your data only to provide and bill for the service, and to send password reset emails when requested. We do not sell, share, or use your data for advertising or profiling.

6. Cookies & Sessions

We use a single session cookie to keep you logged in. No third-party tracking cookies are used.

7. Data Retention

Account data is retained until you request deletion. You may request full deletion by contacting us, after which your account and all associated data will be removed within 30 days.

8. Your Rights

Under the GDPR and applicable data protection law you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — ask us to delete your account and associated data.
• Portability — request your data in a portable format.
• Objection — object to processing where we rely on legitimate interests.

To exercise any of these rights, contact us at the support address in your profile. You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi) if you believe we have handled your data unlawfully.

9. Changes

We may update this policy at any time. The date at the top of this page reflects the most recent revision.