Privacy policy

The short version

• We use your data to run Connections: your account, the contacts you choose to keep in the app, and your business card. We don't sell it, we don't show ads, and we don't track you across other apps or websites.
• Your contacts are encrypted before they're stored.
• Your business card is public to anyone you give its link or QR code to. Card pages aren't listed in search engines.
• You can delete your account and everything in it from the app at any time.

What we collect and why

Your account

Your name, email address and password. We store the password only as a one-way hash (bcrypt), never the password itself. If you link your own LinkedIn profile, we store its address. We use these to sign you in and to show your name on your card.

Your contacts

With your permission, the app reads the contacts on your phone: names, phone numbers, email addresses, company, job title and LinkedIn links. You can give access to all contacts or only some. The app also keeps what you add in it, such as work history and where you met someone. It backs all of this up to your account so it's there on a new phone. Each contact is encrypted with AES-256-GCM using a key that belongs to your account. A simplified form of each contact's company names is stored unencrypted, so the app can show who you know at each company. The app writes changes you make, such as a new job title, back to your phone's contacts.

LinkedIn matching

To find a contact's LinkedIn profile, we send their name and company to Serper, a web search service, which returns public LinkedIn profile links. To keep work history current, we send a profile link to Apify, which reads the public work history on that profile: job titles, companies and dates. We keep that public work history in a cache shared by everyone who uses Connections, without names, photos or who asked, so each profile is read once. Company names from LinkedIn are kept in a shared company directory. Connections is not affiliated with LinkedIn.

Your business card

What you put on your card (your name, title, company, phone number, and your email and LinkedIn if you show them) is shown on your card page, in link previews when you share it, and in Apple Wallet or Google Wallet passes. Its link is a random code, so it can't be found by guessing your name. Anyone you give the link or QR code to can see the card and save it to their contacts.

Card counts

We count how many times your card is opened and saved each day, so we can show you those numbers. We don't record who opened or saved it.

Wallet passes

When someone adds a card to Apple Wallet, their iPhone gives us a device identifier and a push token so we can update the pass when the card changes. These identify the pass on that device, not the person. When a card is saved to Google Wallet, Google stores the pass and we update it through Google.

Scanning business cards

Photos of paper business cards are read on your phone. They're never uploaded.

Server logs

Our servers record technical details of each request, such as IP address, time and the page or address asked for, to keep the service secure and fix problems. To stop people guessing passwords, we briefly keep failed sign-in attempts by IP address.

Permissions on your phone

• Contacts: to show and keep your contacts current, and to save new ones.
• Camera: to scan paper business cards. The photo stays on your phone.
• Photos: only if you choose a photo of a business card to read.

You can change these at any time in your phone's settings.

Who we share it with

We share data only with the services that run Connections for us, and only what each one needs:

• Google Cloud (servers, in Singapore) and MongoDB Atlas (database): store and process everything above.
• Serper: names and companies, to find public LinkedIn profiles.
• Apify: LinkedIn profile links, to read public work history.
• Apple and Google: your card's details when you or someone else adds it to Apple Wallet or Google Wallet, and push tokens to update those passes.

We'll also disclose data if the law requires it. If ESOFT Technologies (Private) Limited is ever merged or sold, this policy will continue to apply to your data. We never sell personal data or use it for advertising.

How long we keep it

• Your account, contacts backup, card and its counts: until you delete them or your account.
• Public LinkedIn work history in the shared cache: refreshed when it's more than 14 days old, and removed when someone asks.
• Wallet pass registrations: until the pass is removed from Wallet or the card is deleted.
• Server logs: up to 30 days.

Your choices and rights

• Delete your account: in the app, go to Settings and tap Delete account. This immediately deletes your account, your contacts backup and its encryption key, your card, its counts and its Wallet pass registrations, and your card link stops working. Contacts on your phone itself stay where they are. You can also ask us by email.
• Change your card: edit or hide your email and LinkedIn on your card at any time. Your phone number is always on it.
• See, correct or get a copy of your data: email support@datainsight.lk from the address you signed up with.

If you don't use Connections

Someone who uses Connections may have your details in their phone's contacts, or may have saved your card. Your public LinkedIn work history may be in our shared cache. To have your work history removed from the cache, or to ask about your data, email support@datainsight.lk with a link to your LinkedIn profile.

Children

Connections is for professionals and isn't meant for anyone under 16. We don't knowingly collect data from children. If you think a child has given us data, tell us and we'll delete it.

Security

Data is encrypted in transit (HTTPS) and contacts are encrypted at rest with keys held separately from the data. No system is perfectly secure, but we limit access to the people and services that need it.

Changes to this policy

If we change this policy, we'll update the date at the top. For significant changes, we'll tell you in the app before they apply.

Contact

ESOFT Technologies (Private) Limited. Email support@datainsight.lk.