Our policies

Read these before you sign up or pay. Each one says when it was last changed.

  • Privacy policy

    What personal data we collect, including the business cards you scan, who processes it, how long we keep it and your rights.

    Updated Read the privacy policy

  • Terms & conditions

    The rules for using Contact Convoy: Card Credits and monthly limits, fair use, billing, AI accuracy and liability.

    Updated Read the terms and conditions

Your data at a glance

The short answers to the questions we are asked most, taken from our Privacy policy.

Where it is hosted

Our API servers run on Google Cloud in Mumbai (asia-south1). Account, company, card and billing records are in a MongoDB Atlas database, and card images are kept in private Google Cloud Storage.

Some processors are outside India: OpenAI and Groq process requests in the United States, and Google Gemini requests may be processed outside India.

International transfers (§10)
Who processes it

Google Cloud and MongoDB Atlas (hosting), Google Gemini with Groq and OpenAI as fallbacks (AI clean-up and company intel), Cloudinary (older card images), Firebase (push notifications and crash reports), OpenStreetMap (maps), Gmail (emails), Razorpay and Google Play (payments).

We don't sell personal data, and we don't use it for advertising.

Sharing & processors (§9)
How to delete it

Delete your account in the app (Delete Account, which asks for your password) or follow the steps on our Delete account & data page. When the company owner deletes the account, the company's cards, card images, team accounts and activity are deleted. Billing records are kept.

Deleting the account does not cancel a Google Play subscription: cancel it in Google Play.

Deleting your account (§19)
How it is protected

HTTPS on every endpoint, passwords stored only as a bcrypt hash, card images in private storage shown through short-lived signed links, and role-based access: admins and co-admins see all company cards, employees see only their own. Every new company is reviewed by hand.

Security measures (§13)
Cookies and tracking

No analytics, advertising or tracking cookies. The website uses your browser's local storage only to keep you signed in. Razorpay's checkout may set its own cookies when you pay.

Cookies & browser storage (§11)
Your rights

Ask for a copy of your data, a correction or erasure by emailing grievance@contactconvoy.in. We respond within 30 days and don't charge a fee. If your card was scanned by one of our customers, start with that company.

Your rights (§15)

Grievance officer

Pursuant to the IT Rules 2021 and the DPDP Act, our Grievance Officer is:

Grievances will be acknowledged within 24 hours and resolved within 15 days, in line with applicable law.

Report a security issue

If you think you have found a vulnerability in the app, website or API, email support@contactconvoy.in with the subject Security report, or call +91 98989 96496.

  • Tell us what you found and the steps to reproduce it.
  • Report responsibly: don't test on production customer data, and don't access or change data that isn't yours.

Our contacts for researchers are also published in security.txt.

Contact Convoy is operated by A R ENTERPRISE (Proprietorship), GSTIN 24GETPP7285F1ZQ, Ahmedabad, Gujarat. For anything else, see Contact us.