Privacy Policy

1. Who we are

Patrascan (the “app”) and patrascan websites are provided by TANTRIJA ENTERPRISES (“we”, “us”), a business registered in India. Patrascan is available to people in many countries. For the account data described below, we are the “Data Fiduciary” under India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and the “controller” under the EU General Data Protection Regulation (GDPR) and the UK GDPR. Postal address: 760, BK Kaul Nagar, near Hanuman Vihar, Ajmer, Rajasthan 305001, India.

Our representatives in the European Union and the United Kingdom are listed in section 14.

2. What this policy covers

This policy covers the Patrascan app for Android and iPhone, this website and the support channels linked from it, wherever you use them. It explains what personal data we process, why, where it goes and the choices you have. Section 11 sets out the extra rights you have under the laws of India, the European Economic Area (EEA), the UK, US states such as California, and other countries.

3. Data we process

3.1 Account data (only if you sign in)

• Identity: your email address, the name you enter, and how you signed in (email code, Google or Apple). For Google and Apple we receive a verified email and an account identifier; we never receive your Google or Apple password.
• Plan and usage: your plan (Free or Pro), subscription status and expiry, and how many cards you have scanned (a number, not the cards).
• Device: platform (Android or iOS), app version, operating system version, phone model, a push notification token, and when the app was last used.
• Security: IP address and request details in server logs, used to prevent abuse (for example, limiting how often sign-in codes can be requested).

You can use Patrascan without signing in (“Skip for now”). Then none of the account data above is created on our servers.

3.2 Business cards you scan

When you scan a card, the camera image is processed on your phone by on-device text recognition, and the name, designation, company, phone numbers, email, website and address are filled in by rules that also run on your phone. You may add notes, tags, folders, reminders and the city where you met.

• Without cloud backup (Free, or Pro with backup off), all of this stays on your phone.
• With cloud backup (Pro), your saved contacts, folders, reminders and card images are copied to our servers so you can restore them on another phone.

We process this data only to provide the app to you, never for our own marketing, and we never contact the people on your cards. Section 4 explains your role for this data.

3.3 Purchases

Subscriptions are bought and billed through Google Play or the Apple App Store. We never see your bank card, UPI or other payment details. We receive the product, status and expiry of your subscription so we can unlock Pro.

3.4 Support and requests

If you send feedback from the app, contact support or submit an account-deletion request on this website, we keep the message, your email address and the details you give us so we can respond.

3.5 This website

This website does not use cookies, analytics or advertising trackers. Our web server keeps standard request logs (IP address, page, time, browser) for security and troubleshooting.

4. The people on your cards

Business cards contain personal data about other people. You decide which cards to scan, what to keep and how to use those contacts, as you would with a paper card. You are responsible for having a lawful reason to do so under the data protection law that applies to you.

• If you use Patrascan for your work or business, you decide why and how your contacts’ data is used. Under the GDPR and similar laws you are the controller of that data, and when you use cloud backup we store it on your behalf, only to provide Patrascan to you.
• If you use Patrascan only for personal or household purposes, many data protection laws (including the GDPR) do not apply to that use.

If your details are on a card someone scanned and you want them changed or removed, please ask the person who scanned it: only they can see and edit their cards. Our staff tools do not show the contents of users’ cards. You can also write to us (section 15) and we will help where we can.

5. App permissions

Permission	Why	When
Camera	To scan business cards	The first time you scan
Photos	To scan a card from a photo you choose	When you import from the gallery; only the photos you pick
Contacts	To add a card to your phone contacts when you tap Save to phone. Patrascan does not read or upload your address book.	The first time you tap Save to phone
Location (approximate)	Optional: to note the city where you met someone. Your phone’s built-in location service turns the position into a city name; only the city is saved with the card.	Only if you turn on the “City” switch when saving a card
Notifications	Follow-up reminders and important account messages	The first time you set a reminder
Fingerprint / face unlock	App lock (Pro). Your biometric data stays in your phone’s secure hardware; we never receive it.	When you turn on app lock

6. Why we use your data, and our legal bases

The table shows each purpose and, for people in the EEA and the UK, the legal basis under the GDPR and the UK GDPR.

Purpose	Legal basis (GDPR / UK GDPR)
Providing the app: sign-in, backup and sync, restoring on a new phone, reminders and Pro features	Contract: we need it to provide the service you asked for
Processing subscriptions and applying the free plan’s limits	Contract
Sending sign-in codes and essential service messages	Contract
Occasional product announcements as push notifications (at most one a week), which you can switch off in your phone’s notification settings	Consent, given when you allow notifications; you can withdraw it at any time
Saving the city where you met someone, if you turn it on	Consent, given with the “City” switch and the location permission
Keeping the service secure and preventing abuse (server logs, rate limits)	Legitimate interests: protecting our users and our service
Answering support requests and feedback	Contract, or legitimate interests in helping people who contact us
Handling deletion and privacy requests, keeping tax and accounting records, and responding to lawful requests from authorities	Legal obligation

Under India’s DPDP Act, we process account data with your consent, given when you sign in and accept this policy, and for the legitimate uses the Act allows, such as providing a service you asked for. Wherever you live, you can withdraw consent at any time, for example by switching off notifications or deleting your account (section 12). This does not affect processing that happened before.

We do not make decisions about you based only on automated processing that have legal or similarly significant effects on you.

7. Who we share data with

We do not sell or rent personal data and do not share it for advertising. We use these service providers (“Data Processors”) only to run Patrascan:

Provider	What they receive	Purpose
Our hosting provider (servers in India)	Account data, and backed-up cards if you use cloud backup	Hosting the Patrascan servers and database
Hostinger (email)	Your email address and the sign-in code	Sending sign-in emails from our mailbox
Expo (push notifications), Google Firebase Cloud Messaging, Apple Push Notification service	Push token and the notification text	Delivering notifications
Google and Apple	Your sign-in request (if you choose Sign in with Google or Apple); purchases you make in their stores	Sign-in and payments
RevenueCat	A random app user ID and your purchase receipts	Managing subscriptions

We only use providers that protect data with industry-standard security and only for the purposes above. We may also disclose data when required by law or to protect the rights and safety of users and the public.

8. International transfers

We are based in India and our servers are in India. If you use Patrascan from another country, your account data and any backed-up cards are transferred to and stored in India. Some of the providers in section 7 process data in other countries as well.

India does not have an “adequacy” decision from the European Commission or the UK government. For people in the EEA and the UK, where the law requires it, we rely on safeguards such as the European Commission’s Standard Contractual Clauses and, for the UK, the International Data Transfer Agreement or the UK Addendum to those clauses. You can ask us for more information about these safeguards (section 15).

9. How long we keep data

• Account and backed-up data: until you delete it or delete your account.
• Items you delete: removed from your phone right away; backed-up copies are permanently erased from our servers within 30 days.
• Sign-in codes: expire after 10 minutes and are stored only as a hash.
• Server logs: kept for up to 30 days.
• Records of deletion requests and support messages: kept as long as needed to show we handled them and to meet legal obligations.

10. Security

• All traffic between the app and our servers is encrypted with HTTPS.
• Your sign-in token is stored in the phone’s secure keychain or keystore.
• Card images in our storage are private and only reachable through short-lived signed links.
• Staff access needs two-factor authentication, is limited to support work and is logged. Staff tools show account details and counts, never the contents of your cards.

No system is perfectly secure. If a breach affects your personal data, we will inform you and the relevant authorities as the applicable law requires, for example the Data Protection Board of India or a data protection supervisory authority in the EEA or the UK.

11. Your rights

Wherever you live, you can:

• Access the personal data we hold about you and learn how we use it.
• Correct or update it: change your name in Settings, or ask us.
• Delete it: in the app go to Settings → Delete account; your account and backed-up data are deleted immediately. Without the app, use our account deletion page.
• Export your cards: Pro users can export them to Excel, CSV or vCard in the app, or ask us for a copy of your data.
• Withdraw consent or ask us to stop a use of your data.
• Complain to us, and to a data protection authority.

The laws of some places give you specific rights, set out below. We will never treat you differently for using any of them.

11.1 India

Under the DPDP Act you can:

• get a summary of the personal data we process about you, how we process it, and who we have shared it with;
• have it corrected, completed, updated or erased;
• withdraw your consent, for example by deleting your account;
• nominate a person to exercise these rights on your behalf in the event of death or incapacity;
• raise a grievance with our Grievance Officer (section 15) and, if you are not satisfied with our answer, complain to the Data Protection Board of India.

11.2 European Economic Area and United Kingdom

Under the GDPR and the UK GDPR you have the right to:

• access your personal data and get a copy of it;
• have inaccurate data corrected (rectification);
• have your data erased;
• restrict how we use your data in certain cases;
• receive the data you gave us in a structured, machine-readable format and have it sent to another service (portability);
• object to processing based on our legitimate interests;
• withdraw consent at any time, without affecting processing that happened before;
• complain to the data protection supervisory authority in the country where you live or work, or where you think an infringement happened. In the UK, that is the Information Commissioner’s Office (ICO). We would appreciate the chance to sort out your concern first.

11.3 California and other US states

If you live in California, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA), gives you the right to:

• know what personal information we collect, use and disclose, and get a copy of it;
• delete personal information we collected from you;
• correct inaccurate personal information;
• opt out of the sale or sharing of personal information. We do not sell personal information and do not share it for cross-context behavioural advertising, and we have not done so in the past 12 months;
• limit the use of sensitive personal information. We use sensitive personal information, such as your account sign-in, only to provide Patrascan to you, so there is nothing further to limit;
• not be discriminated against for using these rights: we will not deny you the service, charge a different price or give you a lower quality of service.

In the past 12 months we have collected these categories of personal information, for the purposes in section 6: identifiers (email address, name, account ID, IP address, push token); commercial information (your plan and subscription status); internet or network activity (server logs); approximate location (the city, only if you turn it on); and the contacts and card images you choose to back up. We collect them from you, your device, Google or Apple when you sign in with them, and the app stores and RevenueCat for purchases. We disclose them only to the service providers in section 7, for the business purposes described there. Section 9 explains how long we keep them.

Residents of other US states with privacy laws, such as Virginia, Colorado, Connecticut, Utah, Texas and Oregon, have similar rights to access, correct, delete and get a copy of their data, and to opt out of targeted advertising, sale and profiling. We do none of those three. If we decline your request, you can appeal by replying to our answer with “Appeal” in the subject; if you are still not satisfied, you can contact your state Attorney General.

You can use an authorised agent to make a request for you. We may ask the agent for proof that you authorised them and ask you to confirm your identity.

11.4 Other countries

Many other countries give you similar rights, for example Canada (PIPEDA), Australia (Privacy Act 1988), Brazil (LGPD), Singapore (PDPA) and others. Wherever you live, we honour equivalent rights to access, correct and delete your data, and you can complain to your local data protection authority.

12. How to use your rights

• In the app: change your name in Settings, export your cards (Pro), or delete everything in Settings → Delete account.
• By email: write to privacy@patrascan.com from the email address on your account, and tell us which right you want to use and where you live.
• On this website: request deletion on the account deletion page.

To protect your account, we may ask you to confirm a code sent to your account email before we act. Requests are free. We respond within 30 days (one month under the GDPR), and always within the time limits set by the law that applies to you. If a request is complex and the law allows more time, we will tell you why and when to expect an answer.

13. Children

Patrascan is a business tool for adults. It is not meant for anyone under 18, and we do not knowingly process children’s personal data. If we learn that we hold data about someone under 18, we will delete it.

14. Representatives in the EU and the UK

We are not established in the EU or the UK. People there can contact us directly (section 15) or through our representatives:

• EU representative (GDPR Article 27): [EU representative to be added]
• UK representative (UK GDPR Article 27): [UK representative to be added]

15. Grievance Officer and contact

For questions, requests or complaints about your personal data, wherever you live, contact our Grievance Officer (the role required by India’s DPDP Act):

• Name: Nitish Beejawat
• Email: grievance@patrascan.com
• Address: 760, BK Kaul Nagar, near Hanuman Vihar, Ajmer, Rajasthan 305001, India

More ways to reach us are on the Contact page.

16. Changes to this policy

We will update this page if our practices change and show the new date at the top. For significant changes we will also tell you in the app before they take effect.