Privacy Policy

1. Data controller

Reverdin Solutions di Marc-André Reverdin, sole proprietorship (entreprise individuelle), Corso Vittorio Emanuele II 154, 00186 Rome, Italy, VAT number (Partita IVA) IT17458801002. Contact: privacy@getcardscan.com.

2. Data we collect

We collect the following data:

• Account data: email address, hashed password, account creation date.
• Connection data: IP address, date and time of connections, session identifier.
• Contact data: information extracted from scanned business cards (name, company, email, phone, address, etc.).
• Business card images: photos submitted for OCR processing.

We also measure how the service is used, with PostHog and Umami: see section 7, “Audience measurement and cookies”.

3. Legal basis for processing

• Performance of a contract (Art. 6.1.b GDPR): account management, image processing, contact storage.
• Legitimate interest (Art. 6.1.f GDPR): service security, abuse prevention, access logs, anonymous audience measurement.
• Consent (Art. 6.1.a GDPR): detailed audience measurement and session recording (PostHog, after “Accept” in the banner), any marketing communications (can be disabled at any time).

4. Retention period

• Account and contact data: retained for as long as the account is active, then deleted within 30 days of closure.
• Connection logs: 12 months.
• Business card images: deleted after data extraction.
• Audience measurement events: 25 months at most.
• Session recordings (only after consent): 30 days.

5. Your rights

In accordance with the GDPR, you have the following rights over your personal data:

• Right of access: obtain a copy of your data.
• Right of rectification: correct inaccurate data.
• Right to erasure: request the deletion of your data ("right to be forgotten").
• Right to portability: receive your data in a structured, interoperable format.
• Right to object: object to certain processing based on legitimate interest.

To exercise these rights: privacy@getcardscan.com. We will respond within 30 days. In the event of a dispute, you may contact the French data protection authority, the CNIL (cnil.fr), or your local supervisory authority.

6. Sub-processors

We use the following sub-processors, each limited to the purpose stated:

• Hetzner Online GmbH (Germany) — server and data hosting.
• Anthropic, via a self-hosted gateway — AI extraction of contact information; images are never used to train a model.
• Stripe — payment processing (EU/US, governed by Standard Contractual Clauses).
• Umami, self-hosted: anonymous audience measurement, without cookies.
• PostHog Inc.: audience measurement and session recording, hosted in the European Union (Frankfurt), any transfers covered by the Data Privacy Framework and the standard contractual clauses.
• Self-hosted mail server — sending transactional emails (confirmation, password reset, etc.).
• GlitchTip, self-hosted — technical error tracking, with no personal content.
• Nextcloud / CardDAV — contact synchronization, only if you enable this integration.
• Google Contacts — contact synchronization, only if you connect this account.
• Microsoft Contacts — contact synchronization, only if you connect this account.
• Agora — contact synchronization to your Agora instance, only if you connect this service.

7. Audience measurement and cookies

We measure traffic on the platform with two tools.

Without your consent: Umami, an open-source tool we host ourselves on our servers in the European Union. No cookies, nothing stored on your device. Umami computes a visit identifier on the server from the IP address and the browser, with a salt renewed every month; the IP address is not kept, only the country and city derived from it. We count page views (without the address parameters), referrer, device type and a few steps (sign-up, sign-in, creating an item, subscription), without linking them to a person or an account. This data is deleted after 25 months. This measurement is exempt from consent (article 82 of the French Data Protection Act, CNIL guidelines). To object, turn on your browser's Do Not Track or Global Privacy Control setting: the platform then does not load Umami.

With your consent (“Accept” in the banner): PostHog (PostHog Inc., data hosted in the European Union) also sets a cookie on this site only, for 6 months, to follow your journey, link it to your account by its internal identifier (never your email address or name) and to your organisation, and record your sessions, with inputs and text masked. Session recordings are deleted after 30 days. Other PostHog data is deleted no later than 25 months after your last visit. Without your consent, PostHog is not loaded.

Legal bases: legitimate interest for measurement without an account (Umami), consent for PostHog measurement. Transfers: Umami data stays on our servers. PostHog Inc. is a US company; data is hosted in the European Union and any access from the United States is covered by the Data Privacy Framework and the European Commission's standard contractual clauses. Retention: measurement without an account, 25 months; PostHog measurement, no more than 25 months after the last visit; session recordings, 30 days.

Cookies set by Cards (no advertising cookies):

• cardscan.session_token: strictly necessary, keeps you signed in.
• NEXT_LOCALE: until the browser is closed, necessary, keeps the display language.
• py_consent (necessary, 6 months): keeps your choice in the banner.
• ph_<key>_posthog (6 months, only after “Accept”): PostHog audience measurement.

Your choice is kept for 6 months in the py_consent cookie. You can change it at any time:

Manage cookies

If you withdraw your consent, the PostHog cookie is erased from your browser.