catchcard.ai ("we", "the app") is a digital business card holder operated by Leopold McAllister. This policy explains what personal data we process, on what legal basis, and how you can exercise your rights under the EU General Data Protection Regulation (GDPR).
Legal seller and data controller
The seller's legal name is Leopold McAllister, trading as catchcard.ai. Leopold McAllister is the data controller for your account data. For the contact details you capture about other people, you act as the controller and we act as your processor. Contact: privacy@catchcard.ai.
What we process
Account data — email address, authentication identifiers, sign-in timestamps.
Your own card — the name, role, company, contact details and photo you publish on your shareable card.
Captured contacts — images of business cards, email signatures and screenshots you upload, plus the name, email, phone, address, social links, tags and notes extracted from them.
AI background briefs — summaries generated from public web sources about a contact, including clearly labelled inferred (unconfirmed) information.
Usage — your credit balance and credit usage history.
Why we process it (legal basis)
Contract — to run your account, store your cards and deliver scanning, research and sharing.
Legitimate interest — security, abuse and rate-limit logging, and basic service reliability.
Consent — AI background briefs run only when you leave the research toggle on for that contact. You can switch it off before saving.
AI processing
Images and text you submit for scanning are sent to third-party AI model providers through the Lovable AI Gateway solely to extract contact fields or generate a brief. They are not used to train those models by us. Briefs may include inferred statements that are not verified — treat them as hints, not facts, and do not use them for automated decisions about a person.
Sharing
Nothing is public unless you make it so. Your personal card is public only while you enable sharing. Contact share links show only a minimal teaser to anyone with the link; the full profile is released only to a signed-in recipient, and links expire, have a claim limit, and can be revoked or rotated by you at any time.
We share personal data with the following categories of recipient:
Paddle and payment data — Paddle.com Market Ltd acts as our reseller and Merchant of Record for all purchases. When you buy a Pro plan or a credit pack, Paddle receives and processes your payment and billing data (name, email address, billing address, country, payment method details, VAT/tax identifiers and transaction history) in order to take payment, calculate and remit tax, issue invoices, manage your subscription and handle refunds. Paddle acts as an independent controller for that data under its own privacy notice. We never see or store your full card details; we receive only the subscription status, plan, billing period and a customer reference needed to unlock your paid features.
Service providers — our managed cloud hosting and database provider, and the AI model providers described above, acting as processors on our instructions.
Professional advisers and authorities — legal or accounting advisers, and public authorities where we are legally required to disclose.
Storage, retention and security
Data is stored in our managed cloud backend (Supabase, EU-hosted infrastructure) with row-level security so only your account can read your rows. Card images live in private storage buckets. We keep your data until you delete an item or your account; deleting your account erases all of it immediately. Rate-limit logs are pruned after 24 hours.
Your rights
Access and portability — download a complete JSON export of your data from Settings.
Erasure — delete your account and all associated data from Settings. This is immediate and irreversible.
Rectification — edit any contact, your own card or your notes at any time.
Objection and complaint — write to privacy@catchcard.ai, and you may lodge a complaint with your national data protection authority.
Contacts you capture
You are responsible for having a lawful basis to store details about the people you capture, for keeping notes accurate and proportionate, and for honouring their requests. If someone asks to be removed from your holder, delete their contact — that erases the card, its images and its brief.
Cookies
Essential cookies and local storage keep you signed in and secure — these cannot be turned off because the app cannot work without them. Any analytics or marketing cookies are optional, are never set before you agree, and can be refused or withdrawn at any time.