Privacy Policy

Last updated: 23 July 2026

Karo ("we", "us") is a business-card scanning and lead-capture service operated at karohq.com. This policy explains what data we collect, why we collect it, and the choices you have. By using Karo you agree to this policy.

Data we collect

Account data: your name, email address, and a hashed password. We verify your email with a one-time code.

Captured content: business-card photos, voice notes, transcripts, and text notes you send to our Telegram or WhatsApp bots, plus the structured contact details extracted from them (names, job titles, companies, emails, phone numbers, websites, event names). This content typically contains personal data of the people whose cards you scan: you are responsible for having a lawful basis to collect it.

Channel identifiers: when you link Telegram or WhatsApp, we store your numeric Telegram ID, username and display name, or your WhatsApp phone number and profile name, so we can route your captures to your account.

Billing data: your plan purchases and scan usage. Payments are processed by Dodo Payments as merchant of record: we never see or store your card or UPI details.

How we use it

We use your data solely to provide the service: extracting contact details from card images, transcribing voice notes, storing your leads, exporting them as CSV at your request, metering plan usage, and sending transactional emails (such as verification codes). We do not sell your data or use it for advertising.

Processors we rely on

Card images and voice notes are processed by AI providers (DeepInfra) to extract text and transcripts. Messages flow through Telegram and the WhatsApp Business Platform (Meta). Emails are delivered by Resend. Payments are handled by Dodo Payments. Our servers and database are hosted on Railway. Each provider receives only what is necessary to perform its function.

Storage and security

Data is stored in our hosted database and encrypted file storage. Passwords are hashed with bcrypt; session tokens are stored hashed; file links are signed and time-limited; webhook traffic is cryptographically verified; all traffic uses HTTPS.

Retention and deletion

Your captures stay in your account until you delete them: you can delete any contact from the dashboard at any time, and unlink Telegram or WhatsApp whenever you like. To delete your entire account and all associated data, email us and we will complete the deletion within 30 days.

Your rights

You can access, correct, export (CSV), or delete your data from the dashboard, and you may request a full copy or erasure by email. If you are in a jurisdiction with data-protection laws (such as the GDPR or India's DPDP Act), you may have additional rights, which we honour.

Contact

Questions or requests: dj@karohq.com