Your privacy

Privacy policy

CardLink scans visiting cards into digital contacts. This page describes exactly what is stored, where, who else processes it, and how to remove it.

Scanning a card

When you choose Scan, the card images you selected are sent through this website's server to a vision model for one-time extraction. Scanning alone stores nothing: the images and the extracted result are discarded once the response reaches your browser. The model provider processes the request under its own data terms.

Contacts you save

Where a saved contact lives depends on whether you are signed in.

Signed out: contacts are stored only in your own browser, using IndexedDB. They never reach our servers. Clearing your browser data deletes them permanently and we cannot recover them.

Signed in: contacts are stored in our database, hosted in Mumbai, India. Contact photos, and a compressed copy of the scanned card images belonging to a contact you chose to save, are stored in private object storage and served only through short-lived signed links. A copy is also kept in your browser so the app keeps working without a connection. Deleting a contact deletes its card images with it.

Contact details about other people

A visiting card contains someone else's personal information — usually a person who has never used this service. We treat that data as belonging to them. It is never sold, never used for advertising, never used to train models, and never shared with anyone beyond the processors listed below. Row-level security in the database restricts every contact to the account that saved it.

Your account

Signing in creates an account holding your email address and, if you use Google sign-in, the name and profile picture Google provides. That is all we store about you.

Who else processes your data

Supabase — database, authentication and file storage, hosted in Mumbai, India.
Groq — the vision model that reads card images during a scan.
Vercel — application hosting and content delivery.
Hostinger — the legacy extraction endpoint, while it remains in use.

Technical logs

Our hosting providers process routine technical logs such as IP address, browser type, request time and error identifiers, in order to run and secure the service. Card images and contact values are not intentionally written to application logs. To limit scanning abuse we record a daily counter against a salted, irreversible hash — never a readable IP address.

How long we keep things

Saved contacts are kept until you delete them or delete your account. A deleted contact is retained briefly in a recoverable state so an accidental deletion can be undone, then removed. Card images from a scan you did not save are not retained at all; card images belonging to a saved contact are kept with that contact and deleted with it.

Deleting your data

You can delete any individual contact from the Saved Contacts list at any time. Deleting your account removes your contacts and their photos along with it. Contacts held only in your browser are removed by clearing your browser data for this site.

Your rights

You can export everything you have saved at any time using the Excel download on the Saved Contacts list, and the VCF download for individual contacts. If you want a copy of your data in another form, or want it corrected or erased, contact us and we will act on it.

Changes

This policy is updated as the service changes. The current version always appears on this page.

Last updated: August 20, 2026