Legal Information

Privacy Policy

Privacy Policy for ContactScanner AI according to GDPR

Effective from: August 16, 2025

Data Controller:

Baudis Plus UG (haftungsbeschränkt)
Paul-Zobel-Straße 8d, 10367 Berlin, Germany

Email: support@contactscanner.ai

Product: "ContactScanner AI" iOS App

1. What Data Does the App Process?

1.1 Content You Actively Process

  • Images/photos (e.g., cards, email signatures, badges, posters, screens, whiteboards) that you use in the app to extract contact data.
  • Recognized/extracted contact data according to schema (e.g., first/last name, company, job title, phone/fax/mobile, email, website, street, postal code, city, country).

1.2 App Technology & Pseudonymous Identifiers

  • Device ID (provided by the device) and Client ID (locally generated, persistent key in the keychain).
  • These are sent as headers to the proxy to prevent abuse (rate limiting/quotas).
  • Subscription status (as "X-Sub" flag) for enforcing free quotas.

1.3 No Additional Systems

No analytics/tracking SDK, no crash backend, no push notifications.

2. Where Are Data Stored/Processed?

2.1 On Your Device (Local)

  • Pending Scans: JPEG + thumbnail, Base64 in JSON are stored locally when no internet is available.
  • History: Fully processed images (original + edited version) are stored locally in the documents area.
  • Protection: iOS NSFileProtection is enabled (files are device-dependently protected).
  • Local Deletion: There is a setting in the app to delete the scan history.

2.2 Processing via Our Infrastructure

(without permanent server storage of your images)

  • The app sends image data to our edge proxy (Vercel), which forwards the request directly to the OpenAI API and streams the response.
  • We do not permanently store images or result JSONs on the proxy.
  • For abuse protection/quotas, we use Upstash KV (see retention periods).

2.3 External Recipients/Data Processing

  • OpenAI (API, Vision Model): receives the image data you send exclusively for the purpose of extracting contact data. API calls are made with parameter store: false (no training use commissioned by us).
  • Vercel (Edge Proxy): forwards the request/response stream.
  • Upstash (KV): stores only counters/keys for rate limiting/quotas (see 4.).

Note on Data Transfers to Third Countries:
Depending on the location of the respective providers/regions, a transfer to countries outside the EEA (e.g., USA) may take place. Please refer to the respective providers for details on their own data processing.

3. What Do We Use the Data For? (Purposes)

  • Providing Core Functionality: Reading contact data from your images and displaying the result in the app; optional saving to Apple Contacts.
  • Abuse/Fraud Protection & Quotas: Enforcing rate limiting/quotas (IP-minute, device-month, daily/monthly caps, free quota per client ID).
  • Offline Usage: Temporary local buffering (pending queue) until internet is available again.

(No use for marketing/tracking purposes.)

4. Retention Periods

4.1 Locally on Device

  • History: remains on your device until you delete it in the app (or uninstall the app).
  • Pending Queue: remains local until upload is successful (no automatic expiration time).

4.2 Upstash KV (Counters/Keys Only)

  • rl:<ip>:<minute>: 60 seconds
  • cap:<YYYY-MM> (month): 40 days
  • cap:<YYYY-MM-DD> (day): 2 days
  • dev:<device>:<YYYY-MM>: 40 days
  • free:<client>: no automatic deletion (unlimited), until we delete on request.

No images/result JSONs are permanently stored on the proxy itself.

5. Recipients/Categories

  • OpenAI – API processing of images you send for text recognition/extraction.
  • Vercel – Edge proxy that forwards the request to OpenAI and returns the response to the app.
  • Upstash – Key-value store for rate limiting/quota counters.

6. Security

  • Transport encryption (TLS) for all connections.
  • NSFileProtection for locally stored files.
  • Minimization: No image/result data is persisted server-side; only technical counters/keys are maintained.

7. Apple Contacts

  • You can save recognized contact data to Apple Contacts.
  • We do not read your entire address book; when opening a saved contact, it is specifically loaded from the CNContactStore.

8. Your Rights (GDPR, where applicable)

  • Access, rectification, erasure, restriction, data portability, objection.
  • You have the right to complain to a supervisory authority.
  • For deletion/access requests (including deletion of Upstash keys for your client/device ID) contact us: support@contactscanner.ai.

9. Minors

  • The app has no age verification and is aimed at general users. Please observe local legal requirements for minors.
  • Parents/guardians can contact us at any time with questions.

10. Changes

We may update this privacy policy from time to time when features, legal situation, or providers change. The validity stated above is decisive. Material changes will be announced within the app.

11. Contact

Baudis Plus UG (haftungsbeschränkt)

Paul-Zobel-Straße 8d, 10367 Berlin, Germany

Email: support@contactscanner.ai