Privacy Policy

This Privacy Policy describes how Smart&Business collects, uses and protects the personal data of Quick Contact users.

1. Data Controller

2. Data Collected and Purposes

Business card images
Photos are processed first locally on the device. Only if local recognition does not reach sufficient reliability, a third-party cloud OCR service is called for text extraction. Images are not stored on any server beyond the time needed for processing.

Extracted contact data
Fields extracted from business cards are saved, exclusively on the user's explicit request, to Google Contacts via the cloud provider's contacts API.

Google credentials (OAuth 2.0)
Quick Contact requests the following OAuth scopes:

• contacts.readonly — to read and display the user's existing Google Contacts within the app
• contacts — to create, update, or delete Google Contacts on explicit user action only

These scopes are used exclusively for the features described above. Google Contacts data is never processed, stored, or transmitted beyond what is necessary to fulfill these functions.

OAuth access tokens are stored securely in the device's SecureStore (iOS Keychain / Android Keystore) and are never transmitted to third parties. Tokens are deleted from the device when the user disconnects their Google account within the app.

Purchase data
Payments are managed by a subscription provider, Google Play and App Store. We do not collect credit card data.

Usage data
We do not collect usage statistics, location data, biometric data, cookies or advertising tracking technologies.

Anonymous contribution (optional)
If you have enabled the "Improve recognition" feature in Settings, the app can send only anonymous statistical indicators to our server when you correct a wrong field. No personal data is transmitted, only numerical statistical values. No plain text, text data or images are ever sent, actual contact content or personally identifiable information. You can opt out at any time in Settings → Contribute.

3. Legal Basis for Processing

• Contract performance (Art. 6(1)(b) GDPR)
• Consent (Art. 6(1)(a) GDPR)
• Legitimate interest (Art. 6(1)(f) GDPR)

4. Data Sharing with Third Parties

• Cloud OCR service — text extraction from images
• Cloud provider's contacts API — contact storage
• Subscription provider — payment management
• Server infrastructure — secure API proxy
• CRM — optional, user-initiated

We never sell or transfer personal data to third parties for commercial purposes.

5. International Transfers

Some service providers operate in the USA. Transfers are governed by Standard Contractual Clauses approved by the European Commission.

6a. Data Retention

• OCR images are not retained on servers after processing
• OAuth tokens are deleted when the account is disconnected
• Local data remains on the device until the App is uninstalled

6b. Google Data Retention & Deletion

Quick Contact does not store Google Contacts data on its servers. All Google user data remains on the user's device and within their own Google account.

• OAuth tokens are deleted from the device when the user disconnects their Google account in app settings
• Contact data saved to Google Contacts can be deleted at any time directly from the app or from Google Contacts
• To request disconnection or raise any data concern, contact us — we respond within 30 days

7. User Rights (GDPR)

You have the right to access, rectify, erase, restrict, port and object to the processing of your data. To exercise these rights write an email. We will respond within 30 days.

8. Security

We implement appropriate technical and organizational measures: HTTPS transmission, SecureStore for tokens, API access via proxy.

9. Children

The App is not intended for users under 13. We do not knowingly collect data from minors.

10. Changes to This Policy

We reserve the right to update this Policy. Material changes will be communicated via in-app notification.

11. Group data and notifications

Teams and collaboration
If you use team features, some information is stored on our servers to ensure the service functions properly.

Personal tasks
Tasks that are not part of a team are saved only on your device and do not pass through our servers.

Data access
The data controller may access data exclusively for technical reasons. This data is not used for purposes other than the intended technical ones and is not shared with third parties.

Retention
Data is retained only as long as the user uses the team features. Once tasks are completed, data is completely deleted from the server within 7 days. To delete your data, simply remove it directly in the app.

12. Use of Artificial Intelligence

Quick Contact uses third-party AI services for text recognition from business card images. To maximize user privacy, images are processed first on the device: only if automatic recognition does not achieve sufficient reliability (at least 85%), the image is sent to external servers for complete text processing. Images are never stored by providers after processing.

The App also offers optional AI features, including voice dictation of contacts and activities and generation of professional biographies. Users can choose freely whether to use them.

AI data sent for processing is not used to train models and is not stored by providers beyond the time needed for processing each request.

For professional biography generation, explicit user consent is required before each processing via a dedicated in-app notice.