Privacy Policy

1. Introduction

Cardly ("we," "our," or "us") is an exhibition and trade-show lead management application developed and operated by Soud ETS. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our mobile application (Android) and associated web services.

By downloading, installing, or using Cardly, you consent to the practices described in this policy. If you do not agree with any part of this policy, please uninstall the application and discontinue use.

2. Quick Data Summary

Here is a brief overview of our data practices:

3. App Permissions

Cardly requests the following device permissions. Each is used only for the stated purpose and only when you explicitly trigger the feature:

Permission	Purpose	When Used
Camera	Capture business card images for OCR scanning	Only when you tap "Scan" to photograph a card
Internet (FULL_NETWORK_ACCESS)	Sync leads, upload card images, communicate with your server	Whenever the app is open and syncing data
Contacts (READ/WRITE)	Save a lead's contact info to your device phonebook	Only when you tap the "Save to Contacts" button
Storage / Media	Temporarily store captured card images before upload	Only during the scan flow

Permissions we do NOT request:

• Location (GPS / Network)
• Microphone
• Phone (call log, phone state)
• SMS
• Background location
• Bluetooth

4. Data We Collect

We only collect data that you explicitly provide through your use of the app:

4.1 Account Data (required for login)

• Full name
• Email address
• Password (stored hashed — we cannot read your password)

4.2 Business Card Data (when you scan a card)

• Card images (front and optionally back)
• Extracted text via OCR
• Parsed fields: person name, company name, job title, phone numbers, email addresses, website, physical address
• Tags and notes you manually add during the scan

4.3 Lead & Contact Data

• Lead status, notes, and team assignments
• Form submission answers (if you use custom forms for visitor registration)
• Interaction history (status changes, team notes)

4.4 Data We Do NOT Collect

• Device identifiers (IMEI, Android ID, advertising ID)
• IP address or geolocation
• Browsing history or app usage outside Cardly
• Contacts list contents (we only WRITE to contacts, never read your address book)
• SMS or call log data
• Financial or payment information
• Health or biometric data

5. How We Use Your Data

All data collected is used exclusively to provide and improve the Cardly service:

Data Type	Purpose
Account credentials	Authenticate you and secure your data
Business card images	Extract contact information via OCR on our server
Lead contact details	Display leads, enable WhatsApp/SMS outreach, save to phone
Notes & tags	Organize and filter your leads within the app
Form submissions	Generate leads from visitor check-in forms you create

We do NOT use your data for:

• Targeted advertising or ad personalization
• Selling or renting to data brokers
• Training AI models accessible to other companies
• Profiling or behavioral tracking
• Marketing communications (we will never email your leads)

6. Third-Party Sharing

We do not share your personal data with any third party. Specifically:

• We do NOT use any advertising SDK (no AdMob, Facebook Ads, Unity Ads, etc.).
• We do NOT embed any third-party analytics (no Google Analytics, Firebase, Mixpanel, Amplitude, etc.).
• We do NOT share data with social media platforms.
• We do NOT sell or license user data to anyone.

6.1 WhatsApp Integration

When you tap "WhatsApp" or "Message" in the app, we open the WhatsApp application on your device using a standard URL scheme (https://wa.me/...). The phone number and optional message template are passed to your local WhatsApp app. No data is sent to WhatsApp's servers by Cardly. The communication happens entirely through your device's native WhatsApp client.

6.2 Within Your Organization

Leads and business cards are visible to other team members within your organization based on role permissions set by your administrator. This is a core feature of the team collaboration system and is controlled by your organization.

6.3 Legal Requirements

We may disclose your information if required by law, subpoena, court order, or governmental authority.

7. Data Storage & Security

We take the security of your data seriously and implement multiple layers of protection:

• Encryption in transit: All communication between the app and our servers uses HTTPS/TLS 1.2+ encryption.
• Password security: Passwords are hashed using bcrypt — we never store plain-text passwords.
• Token-based authentication: API access uses secure tokens with automatic expiration.
• Role-based access control: Employees only see leads and data assigned to them or their team.
• Server security: Our servers are hosted on secure infrastructure with regular security updates.

Your data is stored on servers located in the hosting region you select. Business card images and lead data are retained for as long as your account is active.

8. Data Retention & Deletion

8.1 How Long We Keep Your Data

We retain your personal data only for as long as your account is active and you use our services.

8.2 Account Deletion

You may request complete deletion of your account and all associated data at any time by:

1. Sending an email to privacy@soudelec.net with the subject "Account Deletion Request"
2. Including your registered email address and name in the body

Upon receiving your request, we will permanently delete the following within 30 days:

• Your account and login credentials
• All business card images and extracted data
• All leads, notes, tags, and form submissions
• All team activity history associated with your account

This action is irreversible. Once deleted, your data cannot be recovered.

9. Your Rights

You have the following rights regarding your personal data:

• Right to Access: Request a copy of all personal data we hold about you.
• Right to Correction: Request correction of inaccurate or incomplete data.
• Right to Deletion: Request permanent deletion of your account and data (see Section 8.2).
• Right to Data Portability: Export your leads and business card data.
• Right to Withdraw Consent: Revoke camera, contacts, or storage permissions at any time through your device's Settings > Apps > Cardly > Permissions.
• Right to Object: Object to any processing of your data that you believe is unlawful.

To exercise any of these rights, contact us at privacy@soudelec.net.

10. Children's Privacy

Cardly is designed for business professionals and is not intended for use by individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we discover that a child under 16 has provided us with personal information, we will delete it immediately. If you believe a child has provided us with their data, please contact us at privacy@soudelec.net.

11. Google Play Data Safety Disclosure

In accordance with Google Play's Data Safety requirements, here is a structured summary:

Question	Answer
Does the app collect data?	Yes — Account info and user-entered business data
Does the app share data with third parties?	No
Is data encrypted in transit?	Yes — HTTPS/TLS
Can users request data deletion?	Yes — Email privacy@soudelec.net
Does the app use advertising?	No
Does the app collect location?	No
Does the app collect device identifiers?	No
Does the app have account creation?	Yes — Required for use

Data types collected (per Play Store categories):

Category	Data Type	Collected?	Shared?	Purpose
Personal info	Name, Email	Yes	No	Account & authentication
Contacts	Contacts (write-only)	No	No	Save lead to phonebook
Photos & videos	Photos (camera capture)	Yes	No	Business card scanning
App activity	In-app actions	No	No	—
Device info	Device ID, hardware	No	No	—
Location	Precise / approximate	No	No	—
Financial info	Payment data	No	No	—

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the "Last Updated" date at the top of this page. For significant changes, we will notify you through the app or via email. Your continued use of the app after any changes constitutes acceptance of the revised policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

• Email: privacy@soudelec.net
• Developer: Soud ETS
• App Name: Cardly — Exhibition Lead Management
• Package Name: com.cardly.soudelec.com

We aim to respond to all privacy-related inquiries within 7 business days.