Privacy policy

1.Introduction & scope Link to section 1#

This Privacy Policy ("Policy") is issued by Contact Convoy ("we", "us", or "our"), the SaaS brand operated in India by A R ENTERPRISE (GSTIN 24GETPP7285F1ZQ), a proprietorship of Patel Ayush Bharatkumar, Gujarat. We own and operate the Contact Convoy Android application, website, web dashboard, super-admin portal, APIs, and all related services (collectively, the "Service").

This Policy describes how we collect, use, store, disclose, transfer, and protect personal data of users of the Service. It is published in compliance with:

• The Digital Personal Data Protection Act, 2023 ("DPDP Act") and rules framed thereunder;
• The Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules");
• The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021;
• Any other applicable Indian law and, where applicable to non-resident users, the General Data Protection Regulation (EU) 2016/679 ("GDPR") and similar foreign data-protection frameworks.

2.Acceptance of this policy Link to section 2#

By registering for, accessing, downloading, installing, or using the Service in any manner (including by clicking "I Accept", creating an account, scanning a card, or making payment) you confirm that you have read, understood, and unconditionally agree to this Policy and to our Terms & Conditions. If you do not agree, you must immediately stop using the Service and uninstall the application.

If you are accepting on behalf of a company, partnership, LLP, or other entity ("Customer Organisation"), you represent that you are duly authorised to bind such entity and that the entity shall be jointly and severally responsible for all use of the Service under its account.

3.Definitions Link to section 3#

• "Personal Data" means any data about an individual who is identifiable by or in relation to such data, as defined under §2(t) of the DPDP Act.
• "Data Principal" means the individual to whom Personal Data relates.
• "Data Fiduciary" means the entity that determines the purpose and means of processing Personal Data.
• "Data Processor" means a person who processes Personal Data on behalf of a Data Fiduciary.
• "Customer" or "You" means the individual or Customer Organisation that registers for and uses the Service.
• "Card Subject" means an individual whose business card or contact details are scanned, uploaded, or stored on the Service by a Customer.
• "Card Credit" has the meaning given in our Terms §2.

4.Data we collect Link to section 4#

We collect only the categories of data necessary to operate, secure and bill for the Service. We hold two kinds of password: your account password, which we store only as a one-way hash, and, if your admin sets up company email sending, your company's SMTP password, which we store so we can send email through your mail server. Apart from these, we do not collect "Sensitive Personal Data" within the meaning of the SPDI Rules (such as financial account details, biometrics, medical records, or sexual orientation), and you must not upload such data to the Service.

4.1 Account data (you and your team)

• Name, work email, mobile number (optional), password (stored hashed), role (admin, co-admin or employee) and app permissions;
• Company details: company name, registered email domain, website, city, state, industry, company size, GSTIN (if provided for invoicing), and a record of when you accepted our Terms and this Policy;
• Company email settings, if your admin configures them (SMTP host, user name, password and sender name);
• One-time codes (OTPs) for email verification and password reset, and sign-in session tokens.

4.2 Scanned card data (about third parties)

• Card images (front, back and company logo) and the text read from them on your phone;
• The Card Subject's name, job title, company, phone numbers, email addresses, postal address, website, industry, products and any custom fields;
• What your team adds: follow-up status (Hot, Warm, Cold, Done), exhibition and stall tags, notes, meeting history, trips, and whether a thank-you email was sent;
• Derived data: a map location (latitude and longitude) worked out from the card's business address, and AI-generated company information (Pro plan).

4.3 Device, login and diagnostic data

• For each sign-in: IP address, browser or app user agent, device model, operating system and version, app version, an app installation ID, and the time. Your company's admins and co-admins can see this login history for their team;
• Push-notification token (Firebase Cloud Messaging);
• Crash logs from the Android app: stack traces, device model, operating system, app version and a Crashlytics installation ID;
• Usage counters needed to enforce plan limits: cards saved, AI clean-ups, company-intel lookups and thank-you emails sent each month;
• Server logs of requests and errors.

We do not access your device's location, contacts (address book), microphone or advertising ID.

4.4 Billing & purchase history

• Plan, billing period, purchase history, invoices, GST details, Razorpay order and payment IDs, and Google Play order IDs and purchase tokens;
• We do not store full card numbers, CVV, or UPI PINs. Payment details are handled directly by Razorpay (website purchases) and Google Play (in-app purchases).

4.5 Communications

• Emails, support requests, grievances and any feedback you send us.

5.How we collect data Link to section 5#

• Directly from you: when you register, configure your account, add team members, scan or edit cards, buy a plan, or contact us;
• From your device: through permissions you grant: the camera and photo picker (to capture cards) and notifications. Text is read from card images on your phone before anything is uploaded;
• From third parties: payment confirmations from Razorpay and Google Play, and Google Sign-In, which is used only if you turn on Google Drive backup (see §9);
• Automatically: via sign-in records, crash reports, server logs, and the browser storage described in §11.

6.Purposes & legal basis Link to section 6#

We process Personal Data only for the following specified, lawful, and clearly stated purposes, with the legal basis indicated:

7.Scanned contacts (card subjects) Link to section 7#

This means:

• You are solely responsible for obtaining all necessary consents, notices, and legal bases from each Card Subject before scanning, uploading, exporting, or otherwise processing their data on the Service;
• You are solely responsible for the lawfulness, accuracy, and quality of the card data you submit;
• You are solely responsible for any marketing, outreach, or further use of the card data, including compliance with the DPDP Act, the Telecom Commercial Communications Customer Preference Regulations, 2018 (TRAI DND), the CAN-SPAM Act, GDPR, or any other applicable law;
• Contact Convoy will process such card data only to provide the Service, will not use it to build a marketing database, and will not sell or rent it;
• Contact Convoy bears no liability to any Card Subject for any claim arising from your use of the Service, and you shall indemnify Contact Convoy in full against any such claim (see §22).

7.1 If your business card was scanned

If you gave your business card to a company that uses Contact Convoy, that company may have scanned it into its account. In that case:

• Whose data it is: the details on your card are about you. The company that scanned it decides how they are used and is the Data Fiduciary. We store and process them on that company's behalf as its Data Processor;
• What we hold: the card image and the details listed in §4.2, plus anything the company's team adds, such as notes and follow-up status;
• Where it goes: to the processors listed in §9, including AI providers that clean up the scanned text;
• How to ask for access, correction or deletion: contact the company that scanned your card first, because it controls the record. If you can't reach it, or don't know which company it was, write to our Grievance Officer at grievance@contactconvoy.com with your name, the email or phone number on the card, and the company's name if you know it. We will pass your request to that company, help it respond, and tell you what was done.

7.2 Thank-you emails

Users on paid plans can send a thank-you email to a scanned contact, one card at a time. Nothing is sent automatically. The email goes out through the company's own mail server, if its admin has set one up, or otherwise from Contact Convoy's email address on the company's behalf.

• The sender is responsible: the sending company chooses whom to email and what to say, and is responsible for having a lawful basis to contact the recipient and for complying with anti-spam law;
• Unsubscribing: these emails do not yet include an automatic unsubscribe link. A recipient who does not want further emails can reply to the email or write to support@contactconvoy.com. We will pass the request to the sending company, which must stop emailing that person;
• We keep only a record that an email was sent and when, not its content.

8.AI & automated processing Link to section 8#

Text is first read from card images on your phone. The Service then uses third-party large language models to correct and structure that text and to generate company information. We use Google Gemini (through Google Cloud Vertex AI or the Gemini API) first, and fall back to Groq and OpenAI when Gemini is busy or unavailable.

• AI clean-up of a scan: the card images and the text read from them are sent to the AI provider;
• Company intel (Pro plan): the Card Subject's name, job title, company, emails, phone numbers, address and website, together with text from the company's public website, are sent to the AI provider;
• Data is sent only to produce the output you asked for. We do not use it to train our own models;
• Provider training: whether a provider may use content sent through its API to improve its own models depends on its terms and on the type of account we use. If a free (unpaid) tier of a provider's API is used, that provider's terms may allow it to use the content to improve its products, which can include human review;
• Automated extraction may contain errors. You are responsible for verifying accuracy before relying on extracted data for any commercial decision;
• No fully automated decision producing legal or similarly significant effects is made about any Data Principal by Contact Convoy.

9.Sharing & processors Link to section 9#

We do not sell, rent, or trade Personal Data. We share data only with the following recipients, under agreements or terms requiring confidentiality and security:

We may also disclose data to:

• Professional advisers (lawyers, auditors, accountants), for legal, audit and tax compliance;
• Government or law enforcement (Indian courts, regulators), where compelled by valid legal process;
• A successor entity in a merger, asset sale or restructuring, for business continuity.

Within your company, admins and co-admins can see all of the company's cards and the team's login history. Employees see only the cards they scanned. Our own support staff can access company data when needed to operate or support the Service.

10.International transfers Link to section 10#

Our API servers run in Google Cloud's Mumbai region, but some of our processors operate servers outside India. In particular:

• OpenAI and Groq process requests in the United States;
• Google Gemini requests may be processed outside India;
• The OpenStreetMap Foundation is based in the United Kingdom;
• Firebase Crashlytics, Cloudinary and Google Drive may store data outside India.

Where Personal Data is transferred outside India, we rely on (i) the recipient country not being restricted by the Central Government under §16 of the DPDP Act, (ii) contractual safeguards (such as Standard Contractual Clauses or equivalent), and (iii) the principle that the level of protection remains substantially equivalent to that under Indian law. By using the Service you consent to such transfers.

11.Cookies & browser storage Link to section 11#

Our website uses your browser's local storage to keep you signed in (sign-in tokens and your name, email and role). We do not use analytics, advertising or tracking cookies, and our fonts are served from our own website. When you pay on the website, Razorpay's checkout (loaded from Razorpay) may set its own cookies under Razorpay's policies. You can clear site data in your browser at any time; you will then need to sign in again.

12.Data retention Link to section 12#

• Account and company data: kept while the account exists, and deleted when the account is deleted (see §19);
• Card data and card images: kept while your company's account is active. When a card is deleted, its images and meeting history are deleted too. You can delete individual cards at any time from within the app;
• Login history: kept while the user's account exists, and deleted with it;
• One-time codes: expire automatically after a short time;
• Billing and tax records (invoices, payments and purchase records): kept after account deletion for as long as Indian tax and accounting law requires;
• Server logs: kept for a limited period for security and troubleshooting;
• Backups: deleted data may remain in database backups until those backups expire;
• Crash logs: kept by Firebase Crashlytics under its own retention settings;
• Google Drive copies: if you turned on Drive backup, the copies in your Drive stay there until you delete them.

13.Security measures Link to section 13#

We implement reasonable security practices and procedures within the meaning of §43A of the IT Act and the SPDI Rules, including:

• HTTPS (TLS) encryption in transit on all endpoints;
• Card images kept in private cloud storage and shown through short-lived signed links;
• Password hashing using an industry-standard algorithm (bcrypt), and sign-in tokens kept in secure storage on the phone;
• Role-based access: admins and co-admins see all company cards, employees see only their own;
• Work-email sign-up, email OTP verification, and manual review of every new company;
• Periodic vulnerability scanning, dependency updates, and code review;
• Logging, monitoring, and rate-limiting of suspicious activity.

14.Breach notification Link to section 14#

In the event of a Personal Data breach that is likely to result in risk to Data Principals, we will notify the Data Protection Board of India and affected Data Principals without undue delay, in the manner and within the time prescribed under the DPDP Act and rules. Where the breach concerns Card-Subject data of which you are the Data Fiduciary, you remain primarily responsible for notifying the Data Principals and authorities; we will inform you, cooperate, and provide reasonable assistance.

15.Your rights as a Data Principal Link to section 15#

Subject to applicable law and verification of your identity, you may:

• Access & confirmation: request a summary of the Personal Data we hold about you;
• Correction & updation: have inaccurate or incomplete data corrected;
• Erasure: request deletion of your data, subject to legal retention obligations. You can also delete your account yourself (see §19);
• Withdraw consent: where processing is consent-based, withdraw consent at any time;
• Nominate: nominate another individual to exercise your rights in case of death or incapacity;
• Grievance redressal: file a complaint with our Grievance Officer (§16) or, if unresolved, with the Data Protection Board of India.

To make a request, email grievance@contactconvoy.com. There is no in-app data download yet, so we will send you a copy on request. We will respond to verified requests within the timelines prescribed by law (and in any case within 30 days). We do not charge a fee for these requests. Frivolous, vexatious, or repetitive requests may be refused, and we will tell you why.

If your data is on a card that a company scanned, see §7.1.

16.Grievance officer Link to section 16#

Pursuant to the IT Rules 2021 and the DPDP Act, our Grievance Officer is:

• Name: Khushi Ayushkumar Patel
• Designation: Grievance Officer, A R ENTERPRISE (Contact Convoy)
• Email: grievance@contactconvoy.com
• Support: support@contactconvoy.com
• Phone: +91 87808 74674 (Mon–Fri, 10:00–18:00 IST)

Grievances will be acknowledged within 24 hours and resolved within 15 days, in line with applicable law.

17.Children's data Link to section 17#

The Service is intended exclusively for business users aged 18 years and above. We do not knowingly collect Personal Data from children (under §2(f) of the DPDP Act). If we learn that we have inadvertently collected children's data, we will delete it promptly. Parents or guardians who believe their child has provided data should contact our Grievance Officer.

18.Third-party links Link to section 18#

The Service may contain links to third-party websites or services (for example Razorpay checkout, Google Play's subscription page, or Google Maps to open the address on a scanned card). We are not responsible for the privacy practices, content, or accuracy of any such third party. Your interaction with third parties is governed by their own policies.

19.Deleting your account Link to section 19#

You can delete your account in the app (Delete Account, which asks for your password) or by following the steps on our Delete account & data page. Deletion is permanent and takes effect immediately:

• If you are the company owner (the admin who registered the company): we delete the company and everything in it: all cards and their images, exhibitions, stall visits, trips, meeting history, every team member's account, login history, sessions, one-time codes and usage counters. Card images are removed from storage shortly afterwards. Billing records are kept (see §12);
• If you are any other admin, co-admin or employee: we delete your own account, login history and sessions. The cards you scanned belong to your company and stay in its account. Ask your company admin if you want them deleted or transferred;
• Subscriptions: deleting the account does not cancel a Google Play subscription. Cancel it in Google Play to stop future charges. If your company has an older automatically renewing website subscription, we try to cancel it when the owner deletes the account;
• Google Drive copies are in your own Google account and are not deleted by us.

We may suspend or terminate accounts that violate our Terms, abuse the Service, or pose security/legal risk; in such cases data may be retained for evidence and legal-defence purposes.

20.Disclaimers Link to section 20#

Without limiting the above, we do not warrant that: (i) the Service will meet your specific business requirements; (ii) extracted text from cards will be 100% accurate; (iii) the Service will be available without downtime; (iv) defects will be corrected within any particular time; (v) any data will be permanently retrievable in case of force majeure or hardware failure beyond our reasonable backup procedures.

21.Limitation of liability Link to section 21#

Our aggregate cumulative liability to you for all claims of any kind, whether in contract, tort (including negligence), strict liability, or otherwise, arising out of or related to the Service or this Policy, shall not exceed the total fees actually paid by you to Contact Convoy in the three (3) months immediately preceding the event giving rise to the claim, or INR 5,000, whichever is lower.

You agree that the limitations in this section are a fundamental basis of the bargain between you and Contact Convoy, and that the Service would not be provided to you without these limitations.

22.Indemnification Link to section 22#

You agree to defend, indemnify, and hold harmless Contact Convoy, its founders, directors, officers, employees, contractors, agents, affiliates, and licensors from and against any and all claims, demands, suits, proceedings, losses, damages, liabilities, costs, and expenses (including reasonable legal fees) arising out of or in connection with:

• Your access to or use of the Service;
• Your violation of this Policy, our Terms, or any applicable law;
• Your upload, processing, or onward use of any Card-Subject data, including any claim by a Card Subject regarding consent, accuracy, marketing, or any other ground;
• Any infringement of intellectual-property, privacy, publicity, or other rights of any third party caused by your acts or omissions;
• Any tax, regulatory, or government claim arising from your business activity;
• Any content you submit, transmit, or display via the Service.

We reserve the right, at our own expense, to assume exclusive defence and control of any matter subject to indemnification by you, in which case you agree to cooperate fully.

23.Governing law & jurisdiction Link to section 23#

This Policy is governed by and construed in accordance with the laws of the Republic of India, without regard to its conflict-of-laws principles. Subject to §24, the courts at Ahmedabad, Gujarat shall have exclusive jurisdiction over all disputes arising out of or in connection with this Policy.

24.Dispute resolution Link to section 24#

Before initiating any litigation, the parties shall attempt in good faith to resolve any dispute through informal negotiation by writing to legal@contactconvoy.com. If the dispute is not resolved within 30 days, it shall be referred to and finally resolved by arbitration under the Arbitration and Conciliation Act, 1996, by a sole arbitrator appointed by mutual agreement of the parties or, failing such agreement within 30 days, in accordance with that Act. The seat of arbitration shall be Ahmedabad, the language shall be English, and the award shall be final and binding.

25.Changes to this policy Link to section 25#

We may revise this Policy from time to time to reflect changes in law, technology, or our practices. Material changes will be communicated by email and/or in-app notice at least 7 days before they take effect. The "Last updated" date at the top will always reflect the latest version. Continued use of the Service after the effective date constitutes acceptance of the revised Policy.

26.Contact us Link to section 26#

For any questions, concerns, complaints, or requests regarding this Policy or your Personal Data:

General support

support@contactconvoy.com

Grievance officer

grievance@contactconvoy.com

Legal & disputes

legal@contactconvoy.com

Phone

+91 87808 74674
Mon–Fri, 10:00–18:00 IST