Last updated: March 13, 2026
This privacy policy for CardMeet, Inc. ("CardMeet," "we," "us," or "our") describes how and why we collect, store, use, and share ("process") your information when you use our services ("Services"), including our mobile application (CardMeet.io), our website at cardmeet.io, and any related services. Questions? Contact us at privacy@cardmeet.io.
We collect your personal information in the following circumstances:
When you register for an account (via email/password or Sign in with Apple), we collect your name, email address, phone number, profile photo, company name, job title, industry, social media links, and website URLs.
We automatically collect information about how you interact with the Service, including features used, pages visited, device information (device type, OS version, app version), IP address, log data, and analytics. We use this to improve the Service and troubleshoot issues.
Contacts you add or sync to CardMeet, meeting notes, calendar events, and communication preferences. When you scan a QR code or NFC tag, the contact data encoded in that card is saved to your account.
If you purchase a subscription, payment is processed by Apple (via In-App Purchase) or RevenueCat. We do not collect, store, or have access to your credit card number or payment details. We receive only a transaction confirmation and subscription status.
When you use the AI Note Taker, speech is transcribed entirely on-device using iOS Speech Recognition in real-time. No audio file is ever created, stored, or transmitted to any server. Only the resulting plain-text transcript is saved to your account. If you choose to analyse the transcript with AI, only the text is sent — see Section 4 for full details.
We use the information we collect for the following purposes:
CardMeet does not sell your personal information. We do not rely on advertising. We may share information only in these circumstances:
For a complete list of our service providers including what data each processes and where they are located, see our Subprocessors page. All subprocessors are contractually bound to protect your data, use it only for the purposes we specify, and provide equal or greater data protection standards.
We are transparent about every AI technology we use, exactly what data is sent, who receives it, and how your consent is obtained.
Provider: Apple · iOS Speech Framework via expo-speech-recognition
Used for: Transcribing your voice during AI Note Taker sessions
How it works: Runs entirely on your device. No audio file is created, stored, or transmitted to any server.
Data sent: None. All processing happens locally.
✓ No data ever leaves your device
Provider: Anthropic, PBC · anthropic.com
Used for: Generating meeting summaries, action items, key takeaways, and sentiment analysis from your meeting note transcripts.
What data is sent: Plain-text transcript only. No audio, no contact lists, no personally identifiable information beyond the spoken words in the transcript.
How data is collected: Speech is first transcribed on-device using iOS Speech Recognition (no audio leaves your device). Only the resulting plain-text transcript is eligible for AI analysis. The text is sent server-to-server via a secure Supabase Edge Function over TLS — it never passes through a public endpoint.
Who it is sent to: Anthropic, PBC, a US-based AI safety company. The data is sent exclusively to Anthropic's API endpoint for processing.
🔒 Consent: The app displays a full-screen consent dialog the first time you use AI analysis. The dialog clearly explains what data will be sent and to whom. You must explicitly tap "Agree & Analyze" before any transcript data is transmitted. If you tap "Cancel," no data is sent and your note is saved without AI analysis. You may revoke consent at any time in Settings.
Retention: Anthropic does not retain, store, or use API-submitted data to train its models. Data is processed in memory and discarded immediately after generating the response. See Anthropic's Privacy Policy.
Equal protection: Anthropic maintains SOC 2 Type II certification, applies encryption at rest and in transit, enforces strict access controls, and operates under data handling policies that provide equal or greater protection to the standards described in this privacy policy.
Provider: Google LLC · cloud.google.com/vision
Used for: Extracting contact details from photos of physical business cards (OCR)
Data sent: Business card photo only. The image is processed transiently and not stored by Google beyond the API call per their API terms.
Consent: You initiate this action by tapping "Scan Card" and granting camera access.
We use reasonable physical, technical, and administrative security measures to protect your personal information. No method of data transmission or storage is 100% secure, but we implement industry best practices:
The Service may connect with third-party platforms you authorise. We are not responsible for the privacy practices of third-party services.
Request a copy of all data we hold about you, or export it in a portable format.
Update or correct inaccurate information at any time from the app Settings.
Request deletion of your account and all associated data. We will delete your data within 30 days of your request.
Unsubscribe from marketing, disable push notifications, or revoke consent for AI analysis at any time.
You may withdraw consent for data processing at any time by contacting us. If you do so, some features may become unavailable.
Request that we limit how we use your data while a complaint or dispute is being resolved.
To exercise these rights, visit Settings in the app or contact privacy@cardmeet.io. We will respond within 30 days.
We retain information for as long as reasonably necessary to deliver the Service or fulfil the purposes described in this policy:
| Data Type | Retention Period |
|---|---|
| Active account data | Retained while your account is active |
| Deleted accounts | All data deleted within 30 days of deletion request |
| Backup systems | Purged within 90 days of account deletion |
| AI transcripts sent to Anthropic | Not retained by Anthropic — processed and discarded immediately |
| Crash / error logs (Sentry) | Anonymised, retained for 90 days |
| Legal holds | Retained as required by applicable law |
We use minimal tracking technologies:
Used to maintain your session and remember preferences. These are strictly necessary for the Service to function and cannot be disabled.
We collect anonymised usage analytics to understand how the app is used and to improve it. We do not use analytics for advertising or cross-site tracking.
We do not use cookies for advertising. We do not use web beacons, pixel tags, or similar tracking for marketing purposes. We do not set any cookies outside of the cardmeet.io domain. You can control cookies through your browser settings.
CardMeet operates globally. Your information is processed in the United States, where our infrastructure (Supabase on AWS us-east-1) and third-party service providers are located.
Where we transfer personal information from the European Economic Area ("EEA"), the United Kingdom ("UK"), or Switzerland to countries that have not been deemed to provide an adequate level of data protection, we rely on appropriate safeguards including the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum.
By using our Service, you acknowledge and consent to the transfer of your information to the United States and other countries where our service providers operate.
We only collect and process personal information where we have a lawful basis. Our lawful bases include:
CardMeet is not directed to individuals under the age of 13. We do not knowingly collect personal information from children under 13. If a parent or guardian becomes aware that their child has provided us with personal information, they should contact us at privacy@cardmeet.io. If we become aware that a child under 13 has provided us with personal information, we will take steps to delete such information promptly.
We have not sold personal information in the preceding 12 months. We do not share personal information for cross-context behavioural advertising.
To exercise any of these rights, contact our Data Protection Officer: privacy@cardmeet.io. We will respond within 30 days (or 45 days for CCPA requests if an extension is needed).
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated policy with a new "Last Updated" date, sending an in-app notification, and/or emailing you at the address associated with your account. Your continued use of the Service after the changes take effect constitutes your acceptance of the revised policy. We encourage you to review this Privacy Policy periodically.
If you have questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us:
© 2026 CardMeet.io · All rights reserved