Privacy Policy
Last updated: 7 October 2026
Cardixs is a mobile app that photographs business cards and turns the information on them into digital contact records. This policy explains what data is collected when you use the app, where it goes, how long it is kept, and how you can have it deleted.
Data controller: MEGAVİZYON AYDINLATMA ELEKTRİK SANAYİ VE TİCARET LİMİTED ŞİRKETİ, Piyalepaşa Mah. Nükhet Sk. Üzüm Apt. No: 10 A, Beyoğlu / İstanbul, Türkiye. For any question or request: info@cardixs.com.
1. The most important point first: the data you scan is not yours
The data side of this app is unusual and we want to say so plainly. When you scan a business card, the information processed belongs not to you, but to the person who gave you the card: their name, job title, employer, phone number, email address and address.
That person does not know we exist and has not given us consent directly. Because of this:
- We process business card data only to provide the service to you. We do not use it for advertising, we do not sell it, and we do not share it with anyone for marketing.
- The person whose card was scanned also has the right to access their data and ask for it to be deleted. Writing to info@cardixs.com is enough; we complete such requests within 30 days at the latest.
- As the user who scans the card, you are also responsible for processing that person's data for your own purposes.
2. What data we collect
| Data | Why | Required |
|---|---|---|
| Your email address | Creating an account, signing in, resetting your password | Yes |
| Your password | Sign-in security — stored as an encrypted hash; we never hold the plain text | Yes |
| The business card photo | Reading the text and extracting the fields | Core function of the app |
| Information extracted from the card | Building the contact record (name, job title, company, phone, email, address, website) | Core function of the app |
| QR code content printed on the card | Saving the link printed on the card (e.g. a WhatsApp or WeChat profile) | If present |
| Usage counter | Tracking your free scan allowance | Yes |
| Subscription status | Whether your subscription is currently valid | If you subscribe |
| Random installation number | Delivering app updates to your phone — not used for advertising or tracking | Yes |
What we do not collect
We write these out explicitly, because most apps do collect them: we do not take your location, we do not read your advertising identifier, the app contains no advertising network and no analytics tool, we do not record your voice, and we do not read your contacts.
About contacts, a distinction that runs both ways: the app can write to your phone's contacts — but only when you tap “Add to contacts” on a card, and only that one record. It does not read your contacts: your existing contacts are never sent to a server, never stored anywhere, and never even held in the app's memory.
3. Where your data goes
In order to read the card, we send the photo and the text it contains to two AI services. This is required for the app to work:
| Service | What is sent | What for | Region |
|---|---|---|---|
| Google Cloud Vision | The business card photo | Reading the text in the image (OCR) | European Union |
| OpenAI | The text that was read (not the photo itself) | Sorting the text into fields such as name, phone and email | ⚠️ Region not guaranteed |
Your data is not used to train AI models. Data submitted through OpenAI's developer interface (API) is not used for model training by default.
Your photos and records are also stored on servers so that the service can work; our server and file storage infrastructure is inside the European Union. ⚠️ We cannot guarantee the region for the text analysis step (OpenAI): the text read from the photo may be processed on servers outside the European Union. These transfers constitute transfers of data abroad and are made on the basis of standard contractual clauses.
We also use two service providers for two functions of the app. No business card data is sent to them:
| Service | What is sent | What for | Region |
|---|---|---|---|
| RevenueCat | A random number linked to your account (not your email address), your purchase record, device type and operating system | Checking whether your subscription is active | ⚠️ USA |
| Expo | A random number specific to this installation, operating system and app version | Downloading the latest version of the app to your phone | ⚠️ USA |
The payment itself is made through Google Play or the App Store; your card details never reach us or RevenueCat. Data for these two services is processed in the USA, which constitutes a transfer of data abroad.
Apart from these, we do not share your data with anyone — except where we are legally obliged to (such as a court order).
4. How long we keep it
| Data | Period |
|---|---|
| Business card photo | 90 days |
| Extracted business card information | Until you delete it — permanently, the moment you do |
| Raw text read from the card | Deleted the moment you confirm the card; at most 30 days on a draft you never confirm |
| Access logs (with the last part of the IP address removed; no personal information) | 30 days |
| Your account and all your data | The moment you delete your account — see below |
5. Deleting your account
You can delete your account at any time, from inside the app: Profile → Account → Delete account. You enter your password to confirm.
Deletion happens immediately; there is no waiting period and no “freeze” window. Your account, your cards, your card photos, your groups, your tags, your usage counter and your sessions are all deleted.
You do not have to delete your account to delete a single card. When you delete a card in the app, its name, contact details, the raw text read from it and its photo are deleted immediately and permanently — there is no trash and no undo window. Only a trace with no personal information (the record's ID and the time it was deleted) remains, so that your other devices learn that it was deleted.
This cannot be undone. We are unable to recover deleted data — including restoring it from a backup.
Deleting your account does not cancel your subscription. Subscriptions are managed through the App Store or Google Play; you have to cancel in your store account settings. Otherwise you will continue to be charged.
The one exception — retained payment records
When your account is deleted, the record of payment events is not deleted. These records are kept to stop the store from delivering the same notification twice and to detect fraud. They contain no information that identifies you — not your name, not your email address; only the store's event number, the event type and a timestamp. When the account is deleted, the link between those records and you is permanently severed.
If you cannot use the app, or cannot complete the deletion from inside it, you can also submit a request from the account deletion page.
6. Your rights
In relation to your personal data, you have the right to learn whether your data is being processed, to request a copy of it, to have it corrected if it is wrong or completed if it is incomplete, to have it deleted, to object to the processing, and to complain to a supervisory authority if you believe our processing is unlawful.
Sending your request to info@cardixs.com is enough; we respond within 30 days at the latest. These rights cover not only account holders but also the third parties whose business cards have been scanned (see section 1).
7. Children
Cardixs is an app for working life and is not directed at children under 13. If we become aware that we have collected data belonging to a user below this age, we delete the record.
8. Security
All traffic between the app and the server is encrypted (HTTPS). Your password is stored as an irreversible hash. Each account's data is held in a separate workspace, and the server verifies on every request that the data really belongs to that user.
Even so, no system is 100% secure. If a breach affecting your data occurs, we will inform you and the relevant supervisory authority within the period required by law.
9. If this policy changes
If we update the policy, we change the “Last updated” date on this page. If there is a significant change, we will also notify you in the app or by email.
10. Contact
MEGAVİZYON AYDINLATMA ELEKTRİK SANAYİ VE TİCARET LİMİTED ŞİRKETİ
Piyalepaşa Mah. Nükhet Sk. Üzüm Apt. No: 10 A, Beyoğlu / İstanbul, Türkiye
info@cardixs.com