Privacy Policy

Last Updated: 19 August 2026

Welcome to CardVault. We are committed to protecting the personal information and contacts data you manage within our application. This Privacy Policy details how we handle, store, and safeguard your data.

1. Data Collection & Isolation

CardVault is structured as a private multi-user CRM. All information you create, import, or upload is exclusively associated with your unique account identifier. Other users of the system have no technical access to browse, search, or view your records under any circumstances.

2. Personal Contact Information

We store the contact files you scan or manually enter, including names, company, email addresses, phone numbers, location data, relationship status, custom tags, and personal call notes. This data is strictly stored for your private networking CRM purposes.

3. Secure Image Storage

When you scan a business card, the image file is uploaded to a secure directory on our servers. To safeguard your documents:

• The original file names are discarded and replaced with cryptographically secure, unpredictable filenames.
• Direct web execution of scripts within the uploads folder is strictly blocked via directory access controls.
• Card images are served exclusively via an authorized media gateway that verifies session ownership before outputting image content.

4. Browser-Based Processing

OCR text extraction is executed completely in your local web browser using Tesseract.js. No external OCR servers or cloud-based machine learning endpoints process your images, meaning your card data never leaves the secure flow between your browser and your private database.

5. Your Rights: Right to be Forgotten

You retain full ownership of your data:

• You may modify or delete individual contacts, notes, and tags at any time.
• You have the right to completely purge your account. Deleting your account in Settings will instantly erase all your profile data, CRM records, and business card files from the storage disks.

6. Security Measures

We employ standard enterprise security practices to defend your data, including SQL injection mitigation via PDO prepared statements, Cross-Site Scripting (XSS) escaping, session timeouts, and Cross-Site Request Forgery (CSRF) tokens on all mutating operations.

← Back to Sign In