Privacy Policy

1 Introduction & Scope

This Privacy Policy ("Policy") is issued by Contact Convoy ("we", "us", or "our"), the SaaS brand operated in India by A R ENTERPRISE (GSTIN 24GETPP7285F1ZQ), a proprietorship of Patel Ayush Bharatkumar, Gujarat. We own and operate the Contact Convoy mobile application, web dashboard, super-admin portal, APIs, and all related services (collectively, the "Service").

This Policy describes how we collect, use, store, disclose, transfer, and protect personal data of users of the Service. It is published in compliance with:

• The Digital Personal Data Protection Act, 2023 ("DPDP Act") and rules framed thereunder;
• The Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules");
• The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021;
• Any other applicable Indian law and, where applicable to non-resident users, the General Data Protection Regulation (EU) 2016/679 ("GDPR") and similar foreign data-protection frameworks.

2 Acceptance of this Policy

By registering for, accessing, downloading, installing, or using the Service in any manner — including by clicking "I Accept", creating an account, scanning a card, or making payment — you confirm that you have read, understood, and unconditionally agree to this Policy and to our Terms & Conditions. If you do not agree, you must immediately stop using the Service and uninstall the application.

If you are accepting on behalf of a company, partnership, LLP, or other entity ("Customer Organisation"), you represent that you are duly authorised to bind such entity and that the entity shall be jointly and severally responsible for all use of the Service under its account.

3 Definitions

• "Personal Data" means any data about an individual who is identifiable by or in relation to such data, as defined under §2(t) of the DPDP Act.
• "Data Principal" means the individual to whom Personal Data relates.
• "Data Fiduciary" means the entity that determines the purpose and means of processing Personal Data.
• "Data Processor" means a person who processes Personal Data on behalf of a Data Fiduciary.
• "Customer" or "You" means the individual or Customer Organisation that registers for and uses the Service.
• "Card Subject" means an individual whose business card or contact details are scanned, uploaded, or stored on the Service by a Customer.
• "Card Credit" has the meaning given in our Terms §2.

4 Data We Collect

We collect only the categories of data necessary to operate, secure, improve, and bill for the Service. We do not collect any "Sensitive Personal Data" within the meaning of the SPDI Rules (such as financial account passwords, biometrics, medical records, or sexual orientation) and you must not upload such data to the Service.

4.1 Account & Identity Data

• Full name, work email, mobile number, password (stored hashed), company name, registered domain, role/designation;
• Profile photograph (optional);
• GSTIN or other tax identifiers (if provided for invoicing);
• Authentication tokens, OTPs, login timestamps, device IDs.

4.2 Card & Contact Data (uploaded by you)

• Names, phone numbers, email addresses, postal addresses, job titles, company names, websites, social handles, and card images of Card Subjects;
• Notes, tags, follow-up reminders, voice memos, or attachments you choose to associate with a card.

4.3 Usage & Technical Data

• Card Credit consumption, scan counts, active-user counts, feature usage, click events;
• IP address, device model, operating system, app version, language, time zone, carrier;
• Crash reports, error logs, performance metrics, push-notification tokens (Firebase Cloud Messaging);
• Approximate geolocation (city/region) — only where you grant permission and only for visit-tracking or analytics features.

4.4 Billing & Transaction Data

• Plan tier, billing cycle, invoice history, GST details, payment-gateway transaction IDs;
• We do not store full card numbers, CVV, or UPI PINs — payment data is handled directly by Razorpay, Google Play Billing, Apple App Store, or equivalent PCI-DSS compliant processors.

4.5 Communications

• Support tickets, emails, in-app chats, and any feedback you send us;
• Recordings or transcripts of demo/onboarding calls (only with your prior consent).

5 How We Collect Data

• Directly from you: when you register, configure your account, scan cards, or contact support;
• From your device: through SDKs and APIs you have authorised (camera, contacts, notifications, storage);
• From third parties: identity providers (Google Sign-In), payment gateways (Razorpay), play-billing platforms, and analytics providers;
• Automatically: via server logs, cookies, and similar technologies described in §11.

6 Purposes & Legal Basis

We process Personal Data only for the following specified, lawful, and clearly stated purposes, with the legal basis indicated:

7 Card-Holder Data (B2B Notice)

This means:

• You are solely responsible for obtaining all necessary consents, notices, and legal bases from each Card Subject before scanning, uploading, exporting, or otherwise processing their data on the Service;
• You are solely responsible for the lawfulness, accuracy, and quality of the Card data you submit;
• You are solely responsible for any marketing, outreach, or further use of the Card data, including compliance with the DPDP Act, the Telecom Commercial Communications Customer Preference Regulations, 2018 (TRAI DND), the CAN-SPAM Act, GDPR, or any other applicable law;
• Contact Convoy will process such Card data only to provide the Service, will not use it to build a marketing database, and will not sell or rent it;
• Contact Convoy bears no liability to any Card Subject for any claim arising from your use of the Service, and you shall indemnify Contact Convoy in full against any such claim (see §22).

8 AI & Automated Processing

The Service uses machine-learning models (including third-party LLMs and OCR engines such as Google Cloud Vision, Groq, OpenAI, or equivalent) to extract text from card images, structure contact data, and provide suggestions.

• Card images and extracted text may be transmitted to such providers strictly for the purpose of producing the requested output;
• We configure our integrations to disable training on customer data wherever the provider offers such a setting;
• Automated extraction may contain errors. You are responsible for verifying accuracy before relying on extracted data for any commercial decision;
• No fully automated decision producing legal or similarly significant effects is made about any Data Principal by Contact Convoy.

9 Sharing & Processors

We do not sell, rent, or trade Personal Data. We share data only with the following categories of recipients, under written agreements requiring confidentiality and security at least as strict as this Policy:

10 International Transfers

Some of our processors operate servers outside India. Where Personal Data is transferred outside India, we rely on (i) the recipient country not being restricted by the Central Government under §16 of the DPDP Act, (ii) contractual safeguards (such as Standard Contractual Clauses or equivalent), and (iii) the principle that the level of protection remains substantially equivalent to that under Indian law. By using the Service you consent to such transfers.

11 Cookies & Tracking

Our website and dashboard use a minimal set of cookies and local-storage items for: (a) keeping you signed in, (b) remembering your preferences, (c) basic analytics. We do not use third-party advertising cookies. You can disable cookies in your browser, but parts of the Service may stop working.

12 Data Retention

• Account data: retained for the duration of your account plus up to 180 days after closure, then deleted or anonymised, unless retention is required by law (e.g. GST, IT Act, anti-money-laundering records);
• Card data: retained while your account is active. You may delete individual cards at any time from within the app;
• Billing & tax records: retained for a minimum of 8 years as required under Indian tax and corporate law;
• Server logs & security logs: retained for up to 12 months;
• Backups: deleted within a further 90 days as backup-rotation cycles overwrite.

13 Security Measures

We implement reasonable security practices and procedures within the meaning of §43A of the IT Act and the SPDI Rules, including:

• TLS 1.2+ encryption in transit on all endpoints;
• Encrypted-at-rest storage on managed cloud databases;
• Password hashing using industry-standard algorithms (e.g. bcrypt);
• Role-based access control with admin approval for new joiners;
• Company-domain login enforcement, OTP/2FA on sensitive flows;
• Periodic vulnerability scanning, dependency updates, and code review;
• Logging, monitoring, and rate-limiting of suspicious activity.

14 Breach Notification

In the event of a Personal Data breach that is likely to result in risk to Data Principals, we will notify the Data Protection Board of India and affected Data Principals without undue delay, in the manner and within the time prescribed under the DPDP Act and rules. Where the breach concerns Card-Subject data of which you are the Data Fiduciary, you remain primarily responsible for notifying the Data Principals and authorities; we will cooperate and provide reasonable assistance.

15 Your Rights as a Data Principal

Subject to applicable law and verification of your identity, you may:

• Access & confirmation: request a summary of the Personal Data we hold about you;
• Correction & updation: have inaccurate or incomplete data corrected;
• Erasure: request deletion of your data, subject to legal retention obligations;
• Withdraw consent: where processing is consent-based, withdraw consent at any time;
• Nominate: nominate another individual to exercise your rights in case of death or incapacity;
• Grievance redressal: file a complaint with our Grievance Officer (§16) or, if unresolved, with the Data Protection Board of India.

We will respond to verified requests within the timelines prescribed by law (and in any case within 30 days). Frivolous, vexatious, or repetitive requests may be refused or charged a reasonable fee in accordance with §15 of the DPDP Act.

16 Grievance Officer

Pursuant to the IT Rules 2021 and the DPDP Act, our Grievance Officer is:

• Name: Patel Ayush Bharatkumar
• Designation: Proprietor & Grievance Officer, A R ENTERPRISE (Contact Convoy)
• Email: grievance@contactconvoy.in
• Support: support@contactconvoy.in
• Phone: +91 98989 96496 (Mon–Fri, 10:00–18:00 IST)

Grievances will be acknowledged within 72 hours and resolved within 15 days, in line with applicable law.

17 Children's Data

The Service is intended exclusively for business users aged 18 years and above. We do not knowingly collect Personal Data from children (under §2(f) of the DPDP Act). If we learn that we have inadvertently collected children's data, we will delete it promptly. Parents or guardians who believe their child has provided data should contact our Grievance Officer.

18 Third-Party Links

The Service may contain links to third-party websites or services (e.g. Razorpay checkout, Google Maps for office locations on scanned cards). We are not responsible for the privacy practices, content, or accuracy of any such third party. Your interaction with third parties is governed by their own policies.

19 Account Termination

You may close your account at any time using the steps on our Delete account & data page (in-app Delete Account or email to support), or by writing to support. Once closure is confirmed, your account becomes inactive and data is retained in accordance with §12. We may suspend or terminate accounts that violate our Terms, abuse the Service, or pose security/legal risk; in such cases data may be retained for evidence and legal-defence purposes.

20 Disclaimers

Without limiting the above, we do not warrant that: (i) the Service will meet your specific business requirements; (ii) extracted text from cards will be 100% accurate; (iii) the Service will be available without downtime; (iv) defects will be corrected within any particular time; (v) any data will be permanently retrievable in case of force majeure or hardware failure beyond our reasonable backup procedures.

21 Limitation of Liability

Our aggregate cumulative liability to you for all claims of any kind, whether in contract, tort (including negligence), strict liability, or otherwise, arising out of or related to the Service or this Policy, shall not exceed the total fees actually paid by you to Contact Convoy in the three (3) months immediately preceding the event giving rise to the claim, or INR 5,000, whichever is lower.

You agree that the limitations in this section are a fundamental basis of the bargain between you and Contact Convoy, and that the Service would not be provided to you without these limitations.

22 Indemnification

You agree to defend, indemnify, and hold harmless Contact Convoy, its founders, directors, officers, employees, contractors, agents, affiliates, and licensors from and against any and all claims, demands, suits, proceedings, losses, damages, liabilities, costs, and expenses (including reasonable legal fees) arising out of or in connection with:

• Your access to or use of the Service;
• Your violation of this Policy, our Terms, or any applicable law;
• Your upload, processing, or onward use of any Card-Subject data — including any claim by a Card Subject regarding consent, accuracy, marketing, or any other ground;
• Any infringement of intellectual-property, privacy, publicity, or other rights of any third party caused by your acts or omissions;
• Any tax, regulatory, or government claim arising from your business activity;
• Any content you submit, transmit, or display via the Service.

We reserve the right, at our own expense, to assume exclusive defence and control of any matter subject to indemnification by you, in which case you agree to cooperate fully.

23 Governing Law & Jurisdiction

This Policy is governed by and construed in accordance with the laws of the Republic of India, without regard to its conflict-of-laws principles. Subject to §24, the courts at Ahmedabad, Gujarat shall have exclusive jurisdiction over all disputes arising out of or in connection with this Policy.

24 Dispute Resolution

Before initiating any litigation, the parties shall attempt in good faith to resolve any dispute through informal negotiation by writing to legal@contactconvoy.in. If the dispute is not resolved within 30 days, it shall be referred to and finally resolved by arbitration under the Arbitration and Conciliation Act, 1996, by a sole arbitrator appointed by Contact Convoy. The seat of arbitration shall be Ahmedabad, the language shall be English, and the award shall be final and binding.

25 Changes to this Policy

We may revise this Policy from time to time to reflect changes in law, technology, or our practices. Material changes will be communicated by email and/or in-app notice at least 7 days before they take effect. The "Last updated" date at the top will always reflect the latest version. Continued use of the Service after the effective date constitutes acceptance of the revised Policy.