Privacy Policy for AI Business Card Scanner

Effective date: 13 September 2026

This Privacy Policy explains what happens to your information when you use the Android app AI Business Card Scanner ("the App"). In short: the contacts you scan stay on your phone. The App is free and shows ads from Google, and those ads are the only reason it connects to the internet.

2. Information That Stays on Your Phone

We have no servers and no user accounts. We never receive the contacts you scan.

  • Photos of business cards: taken with your camera, read on your phone by Google ML Kit, and kept in the App's private storage so you can compare the fields with the original card.

  • Contact details: names, job titles, companies, phone numbers, email addresses, websites and addresses are extracted on your phone and saved in a database inside the App.

  • Notes, tags, favourites and reminders: saved inside the App.

  • NFC tags and QR codes: read on your phone to create a contact.

  • App lock (optional): fingerprint or face unlock is handled entirely by Android. The App only learns whether unlocking succeeded.

This information leaves your phone only when you choose to send it, for example by exporting a file (vCard, CSV, JSON, Excel, PDF or HTML) and sharing it with another app.

Android backup: if you have turned on Android's backup to your Google account, Android may include the App's data in that backup. That backup is controlled by you and Google, not by us.

Deleting your data: Settings → privacy & data → delete all my data removes every contact, note and tag. Uninstalling the App removes everything it stored.

3. Information Collected by Google

The App includes two Google components that send limited technical data to Google. Neither of them receives your scanned contacts or card photos. We do not receive this data ourselves.

3.1 Advertising (Google AdMob)

The App shows ads through the Google Mobile Ads SDK. When ads load, Google collects:

  • your device's IP address, which can be used to estimate your general location;

  • your device's advertising ID and app set ID;

  • interactions with ads and the App, such as app launches, taps and video views;

  • diagnostic information, such as app launch time and SDK performance.

Google uses this data to show and measure ads and to prevent fraud. The data is encrypted in transit.

Your choice (EU, EEA, UK and Switzerland): when you first open the App, a Google consent form asks whether Google may use your data for personalised ads and whether information may be stored on or read from your device. If you decline, Google may still show non-personalised or limited ads, which process less data. You can change your choice at any time in Settings → ad privacy choices. You can also reset or delete your advertising ID in your phone's settings under Privacy → Ads.

Legal basis: your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG). Where you have not consented, the limited processing needed to deliver ads and prevent fraud is based on our legitimate interest in offering the App for free (Art. 6(1)(f) GDPR).

More information: How Google uses information from sites or apps that use its services and the Google Privacy Policy.

3.2 Text and QR Code Recognition (Google ML Kit)

Card photos and QR codes are read on your phone by Google ML Kit. The images and the text in them are not sent to Google. To keep ML Kit working, it sends Google diagnostic information: device model and OS version, app package name and version, a per-installation identifier that does not identify you, performance figures, feature settings and error codes. Google uses this for diagnostics and usage analytics and does not share it with third parties. It is encrypted in transit.

Legal basis: our legitimate interest in reliable scanning (Art. 6(1)(f) GDPR).

3.3 Transfers Outside the EU

Google LLC is based in the United States. These transfers rely on the EU–US Data Privacy Framework and on the European Commission's standard contractual clauses.

4. Permissions

The App requests the following permissions:

  • Camera: to photograph business cards and scan QR codes.

  • NFC: to read contact details from NFC tags.

  • Notifications: to remind you to follow up with a contact.

  • Biometrics: for the optional app lock.

  • Internet and advertising ID: to load ads (see section 3.1).

The App does not ask for access to your phone's address book. When you save a contact to your phone, Android's own contacts app receives it.

5. How Long Data Is Kept

  • Data in the App: until you delete it in the App or uninstall the App.

  • Data collected by Google: according to Google's own retention periods, described in the Google Privacy Policy.

6. Your Rights

Under the GDPR you have the right to access, correct and delete your personal data, to restrict its processing, to data portability, to object to processing based on legitimate interests, and to withdraw your consent at any time without affecting processing that took place before.

Because we do not receive your scanned data, you can exercise most of these rights directly in the App: view and edit contacts, export them, delete them, and change your ad choices in Settings. For data collected by Google, see the Google links in section 3.1. For anything else, email us at dhi@tuta.io.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or where we are based.

7. Children's Privacy

The App is not directed at children under 16, and we do not knowingly process personal data of children.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the new version on this page and update the effective date above.

9. Contact Us

If you have any questions about this Privacy Policy, please contact us at:

Email: dhi@tuta.io