Privacy Policy

1. Scope and controller

This policy applies to personal data processed by eContact as a controller, such as account, billing, security and analytics data. When users or Organizations collect Contact Data or attendee data through the Services, they are the controller and eContact processes that data on their behalf as a processor. If your information was collected by an eContact user or Organization, please refer to their privacy notice and direct requests to them first.

This policy does not apply to third-party websites, mini apps or services linked from the Services.

2. Personal data we collect

Information you provide

• Account: name, email address, password (stored hashed), phone number, profile photo, language, time zone and preferences.
• Card and profile content: job title, company, department, bio, addresses, social media links, websites, photos, videos, documents, projects, testimonials and other information you publish.
• Contacts and relationships: people you save, scan, import or exchange details with, plus notes, voice memories, tags, stages, reminders, tasks and meeting history you record.
• Event data: registrations, ticket types, answers to registration questions, uploaded files, dietary or accessibility needs you choose to share, session picks, meetings, chat messages, posts, photos, stories, poll votes, questions and survey responses.
• Organization data: organization name, branding, members, roles, domains and integration settings.
• Purchases: billing name, billing and shipping address, VAT ID, order details. Payment card details are collected directly by Stripe.
• Communications: messages to support, feedback, survey answers and newsletter sign-ups.

Information collected automatically

• Usage data: pages and cards viewed, links clicked, QR scans, NFC taps, searches, features used and timestamps.
• Device and log data: IP address, browser type, operating system, device identifiers, referring URLs and crash data.
• Approximate location: country and city inferred from IP address.
• Precise location: only when you enable Event Mode, nearby people, live presence or zone check-in, and only while active.
• Visitor identifiers: random identifiers stored in your browser to count unique card visitors and measure engagement.
• Cookies and local storage: see Section 12.

Information from third parties

• Sign-in providers (Google, Microsoft, Apple, Facebook): name, email and profile picture.
• Integrations you connect (Google Contacts, calendars, HubSpot, Salesforce, Mailchimp, Zapier): the data you authorize.
• Organizations and event Organizers who add you as a member, speaker, sponsor or invitee.
• Payment processors: payment status and fraud signals.
• Other users who save your public card or exchange contact details with you.

3. How we use personal data

• To create and manage your Account and authenticate you.
• To display and share your Cards, pages and profile as you direct.
• To provide contact management, lead capture, follow-up reminders and relationship insights.
• To run events: registration, ticketing, check-in, badges, networking, matchmaking, meetings, messaging and analytics.
• To operate organization workspaces and enforce plan limits.
• To process payments, fulfill orders and ship physical products.
• To provide AI features such as business-card scanning, summaries, drafts and recommendations.
• To send transactional messages (receipts, security alerts, event reminders, reminders you schedule).
• To send marketing communications where you have consented or where permitted by law.
• To analyze usage, fix bugs and improve and develop the Services.
• To detect, prevent and investigate fraud, abuse, spam, security incidents and violations of our Terms.
• To comply with legal obligations and respond to lawful requests.

4. Legal bases for processing

Where GDPR or similar laws apply, we rely on:

• Performance of a contract to provide the Services you request.
• Legitimate interests in securing, analyzing and improving the Services, preventing fraud, and communicating with business contacts, balanced against your rights.
• Consent for marketing emails, precise location, nearby discovery, optional cookies, and sharing your networking profile with attendees. You may withdraw consent at any time without affecting prior processing.
• Legal obligation for tax, accounting and regulatory requirements.
• Vital interests in rare emergencies at events.

5. AI and automated processing

Some features use AI models, including those of third-party providers, to process content you submit (such as a photo of a business card or notes). Providers process this data on our behalf and are contractually prohibited from using it to train their general models. Networking matches and scores are suggestions only; we do not make decisions that produce legal or similarly significant effects about you solely by automated means.

6. How we share personal data

We do not sell personal data and do not share it for cross-context behavioral advertising. We disclose personal data only as follows:

• With people you choose: anyone you share your Card with, contacts you exchange details with, and other attendees according to your event sharing settings.
• With Event Organizers: registration details, answers, check-ins and aggregated engagement for events you join, plus sponsors or exhibitors whose booth you allow to scan your badge.
• With your Organization: if your Account belongs to an Organization workspace.
• With service providers: cloud hosting and databases (Base44, Supabase), payments (Stripe), email delivery, maps and geolocation, AI model providers, bot protection (Cloudflare), analytics and customer support, all bound by data processing agreements.
• With integrations you connect such as CRMs and calendars.
• For legal reasons: to comply with law, regulation, legal process or government requests, or to protect the rights, property and safety of eContact, our users or the public.
• Business transfers: in connection with a merger, acquisition, financing or sale of assets, subject to this policy.
• With your consent in any other case.

7. Events, networking and location

• Your networking profile is visible to other attendees only if you enable it, and you control which fields are shown.
• Connections, meetings and saved contacts are visible to the other person involved.
• Precise location is collected only while Event Mode or nearby features are active and is used to show nearby people and zone check-ins. It is not used to track you outside events.
• Organizers may set a data retention period after which attendee data is anonymized.
• Badge scans by exhibitors are only possible when you present your badge or QR code.

8. International data transfers

We and our service providers may process personal data in countries other than your own, including the United States, the European Economic Area and the GCC. Where required, we protect transfers using the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, adequacy decisions, or other lawful mechanisms recognized under Qatari, Saudi and UAE law.

9. Data retention

• Account and Card data: kept while your Account is active. When you delete your Account, data is deleted or anonymized within 30 days, and removed from backups within 90 days.
• Contacts and leads: kept until you or your Organization delete them.
• Event attendee data: kept according to the Organizer's retention setting, then anonymized.
• Live location: only the latest position is stored and it is cleared after the event.
• Billing records: kept as long as tax and accounting laws require, typically 5 to 10 years.
• Security logs: kept up to 12 months.
• Analytics: aggregated or pseudonymized data may be kept longer.

10. Security

We use administrative, technical and physical safeguards, including TLS encryption in transit, encryption at rest, hashed passwords, optional two-factor authentication, role-based and row-level access controls, rate limiting, bot protection, audit logging and regular security reviews. No method of transmission or storage is 100% secure. If a personal data breach is likely to result in risk to you, we will notify you and the relevant authorities as required by law.

11. Your privacy rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten").
• Restrict processing in certain circumstances.
• Data portability: receive your data in a structured, machine-readable format.
• Object to processing based on legitimate interests or for direct marketing.
• Withdraw consent at any time.
• Opt out of sale or sharing of personal data and limit use of sensitive data (California). We do not sell or share personal data.
• Non-discrimination for exercising your rights.
• Appeal a decision about your request, where state law provides.
• Complain to a supervisory authority, such as your local EU data protection authority, the UK ICO, Qatar's National Cyber Security Agency, or the Saudi Data & AI Authority (SDAIA).

You can view, edit, export and delete most data in your account settings. To make a request, contact us. We will verify your identity and respond within 30 days, or as required by law. Authorized agents may submit requests on your behalf with proof of authorization.

12. Cookies and similar technologies

• Strictly necessary: sign-in sessions, security, load balancing and remembering preferences such as theme.
• Performance and analytics: measuring card views, link clicks and feature usage to improve the Services.
• Functional: caching content locally for faster loading and offline event check-in.

We do not use third-party advertising or cross-site tracking cookies. You can block or delete cookies in your browser settings, but some features may not work. Where required, we ask for consent before setting non-essential cookies. We honor Global Privacy Control signals where required by law.

13. Communications and marketing

We send transactional emails about your account, security, purchases and events you join. Marketing emails and product updates are sent only with your consent or where permitted, and every marketing email contains an unsubscribe link. Email and push notification preferences can be managed in settings.

14. Children's privacy

The Services are not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided personal data, contact us and we will delete it promptly.

15. California privacy notice

In the past 12 months we have collected the categories described in Section 2, including identifiers, commercial information, internet activity, geolocation (when enabled), professional information and inferences, for the purposes in Section 3. We disclose them to the categories of recipients in Section 6 for business purposes. We do not sell or share personal information or use sensitive personal information beyond what is permitted.

16. Third-party links and services

Cards, pages and events may contain links to third-party websites, social networks, mini apps and services. We are not responsible for their privacy practices, and we encourage you to read their policies.

17. Changes to this policy

We may update this Privacy Policy from time to time. If changes are material, we will notify you by email or in-app notice before they take effect. The "Last updated" date at the top shows when this policy was last revised.

18. Contact us

For questions, concerns or to exercise your rights, contact our privacy team:

eContact
Doha, State of Qatar
Contact form: e.contact/contact