Privacy Policy

Last updated: July 2026

1. Introduction

CardTags is designed to help you capture, organize and maintain professional contact information while keeping you in control of your data.

This Privacy Policy explains what information CardTags processes, how it is used, and the choices available to you.

CardTags does not sell your personal information, display third-party advertising, or build advertising profiles.

2. Who We Are

CardTags is developed and operated by:

Rikard Gunzenheimer
Sole Proprietorship (Sweden)
Contact: cardtags@gunzen.se

3. Information We Process

Depending on how you use CardTags, the app may process:

• Names
• Job titles
• Company names
• Telephone numbers
• Email addresses
• Websites
• Postal addresses
• Notes
• Tags
• Business card images
• Contact photos
• QR codes
• Your own "My Card" information
• Optional location information attached to cards
• Metadata such as creation dates, modification dates and favorites

4. Legal Basis for Processing

CardTags processes personal information on the following legal bases under the General Data Protection Regulation (GDPR):

Contract (Article 6(1)(b))

Processing necessary to provide the features you use, including storing and synchronizing your contact information, delivering Send Updates emails, and processing purchases.

Legitimate Interests (Article 6(1)(f))

Processing necessary to maintain the security, stability and operation of CardTags, including error logging, fraud prevention and service monitoring, where these interests are not overridden by your rights and freedoms.

Consent (Article 6(1)(a))

Where an AI-powered feature requires your explicit action, only the information necessary to process that request is transmitted to the AI service provider.

5. How Your Information Is Stored

On Your Device

CardTags stores your information locally to provide fast performance and offline access.

This may include contacts, images, notes, tags, settings, search indexes and application metadata.

Cloud Synchronization

On iOS and macOS, CardTags uses Apple iCloud (CloudKit) to synchronize supported information between your own devices.

Apple processes synchronized data in accordance with Apple's own privacy policies.

Cloud synchronization depends on your iCloud account settings and service availability.

If synchronization is temporarily unavailable, your information remains stored locally on your device and synchronization automatically resumes when the service becomes available again.

CardTags does not have access to your iCloud credentials and cannot independently access your iCloud data outside of the app.

6. AI Features

CardTags includes AI features to improve the recognition and organization of business card information.

When an AI feature is used, only the information necessary to process the request is transmitted to Google.

CardTags currently uses Google Gemini to provide AI-powered features.

Google's processing of information transmitted to provide AI functionality is governed by Google's applicable privacy terms for the service.

AI features are only used when required by the feature you choose to use and are never used for advertising or profiling.

7. Communication Services

Some optional features require communication with CardTags operated services.

These services currently support:

• Send Updates
• Email delivery
• Bounce handling
• Spam reporting
• Unsubscribe management

CardTags operated services are hosted within the European Union where reasonably practical.

8. Send Updates and Recipient Privacy

When you use Send Updates, you provide recipient email addresses so CardTags can deliver your contact update.

You are responsible for ensuring you have an appropriate basis for contacting each recipient, such as a previous professional relationship or exchange of contact information.

Recipient email addresses are processed solely to deliver updates on your behalf, manage delivery, unsubscribe requests, abuse prevention, and related service operations. They are not used for advertising or marketing by CardTags.

Recipients may unsubscribe from future updates at any time using the unsubscribe link included in every Send Updates email.

9. App Permissions

Depending on the features you use, CardTags may request access to:

• Camera
• Photos
• Contacts
• Notifications
• Location (optional)

Permissions are only requested when required for the feature you choose to use.

10. Sharing and Export

CardTags allows you to share and export your information using supported features, including:

• QR codes
• vCard
• CardTags package files
• Spreadsheet exports
• Send Updates

Only the information necessary for the selected sharing or export method is included.

11. Purchases

Purchases are processed through the platform from which you downloaded the app.

CardTags does not receive or store payment card information.

12. What CardTags Does Not Collect

CardTags does not:

• Sell your personal information, including as defined under the California Consumer Privacy Act (CCPA) or any other applicable law.
• Build advertising profiles.
• Display third-party advertising.
• Continuously upload your contacts to CardTags operated servers.
• Process information using AI unless required by the feature you choose to use.

13. Security

CardTags uses appropriate technical and organizational measures to help protect your information. This includes secure communication with online services and reasonable safeguards designed to protect personal information during storage and transmission.

14. Data Retention

CardTags retains personal information for as long as necessary to provide the services you use or until you delete it where applicable.

• Information stored locally remains on your device until you delete it.
• Cloud-synchronized information is retained in accordance with Apple's iCloud (CloudKit) retention policies.
• Send Updates delivery records, unsubscribe information and related service data are retained only for as long as necessary to operate the service, comply with legal obligations, and no longer than three years after your last active use of the feature.

You may request deletion of personal information held by CardTags by contacting cardtags@gunzen.se.

15. International Processing

Where practical, CardTags operated services use infrastructure located within the European Union.

Some supporting service providers may process information in other jurisdictions in accordance with applicable laws and their own privacy policies.

16. Your Rights

Depending on your location and applicable law, including the General Data Protection Regulation (GDPR) within the European Economic Area (EEA) and the United Kingdom, and the Lei Geral de Proteção de Dados (LGPD) in Brazil, you may have the right to:

• Access your personal information.
• Correct inaccurate personal information.
• Export your personal information.
• Request deletion of your personal information where applicable.
• Object to or restrict certain processing where provided by law.
• Contact us with questions about how your personal information is processed.

If you wish to exercise any of these rights, please contact cardtags@gunzen.se.

If you believe your personal information has been processed in violation of applicable data protection laws, you may also have the right to lodge a complaint with your local data protection authority.

17. Children's Privacy

CardTags is not intended for use by persons under 16 years of age.

If you are between 13 and 15 years of age, you may only use CardTags with the consent of a parent or legal guardian.

CardTags does not knowingly collect personal information from children under 13 years of age. If you believe a child under 13 has provided personal information through CardTags, please contact cardtags@gunzen.se so the information can be deleted.

18. Changes to This Policy

This Privacy Policy may be updated from time to time.

The "Last updated" date at the top of this document identifies the current version.

19. Contact

For privacy-related questions, please contact:
cardtags@gunzen.se