Privacy Policy

This Privacy Policy explains how 4 Byte Solutions(“we”, “us”) collects, uses, shares, and protects personal data when you use Contact Forge(the “Service”). We process personal data in accordance with the Digital Personal Data Protection Act, 2023 (DPDP) and other applicable laws.

1. Who we are

4 Byte Solutions is the data fiduciary responsible for personal data processed through the Service. Our registered address is G-01, C-25, Jagdamba Nagar, Ajmer Road, Jaipur, Rajasthan - 302021. You can reach us at info.4bytesolutions@gmail.com.

2. Data we collect

• Account data — your name, email address, mobile number, password (stored hashed), and organisation details.
• Contact data you upload — business-card images and the contact details extracted from them (names, companies, designations, phone numbers, emails, addresses, and related notes).
• Payment data — when you subscribe to a paid plan, payment is processed by Razorpay. We receive transaction metadata and your billing details (legal name, GSTIN, billing address) but we do not store your full card or bank credentials.
• Usage & device data — log data, IP address, browser/device information, and actions taken in the Service, used for security and to operate the product.
• Cookies — we use essential cookies to keep you signed in and to remember your preferences (such as theme). We do not use advertising cookies.

3. Personal data of third parties

The core purpose of the Service is to help you digitise business cards. The contact details you upload often relate to other individuals. When you upload such data, you act as the data fiduciary for it and confirm that you have a lawful basis and any consents required to collect and process it. We process that data on your behalf to provide the Service.

4. How we use data

• to provide, maintain, and secure the Service;
• to perform OCR and, where you opt in, AI parsing of card images;
• to process subscriptions, payments, and issue receipts;
• to send service communications, one-time passwords, and follow-up reminders you configure;
• to comply with legal obligations and enforce our terms.

5. Legal basis & consent

We process personal data on the basis of your consent (given when you create an account and submit data), to perform our contract with you, and to comply with legal obligations. You may withdraw consent at any time by closing your account; withdrawal does not affect processing carried out before withdrawal.

6. Sharing & processors

We share personal data only with service providers that help us operate the Service:

• Supabase — database, authentication, and file storage (hosted in Mumbai, India (ap-south-1)).
• Google — Vision OCR for text extraction, and (only if you connect your account) Google Sheets / Contacts sync.
• Anthropic — AI parsing of card text, when you opt in to AI extraction.
• Razorpay — payment processing for subscriptions.
• WhatsApp messaging provider — delivery of one-time passwords.

We do not sell personal data. We may disclose data where required by law or to protect our rights and the safety of users.

7. Google user data & Limited Use

Connecting a Google account is optional. If you choose to connect it, Contact Forge requests access to Google Sheets and Google Contacts so it can sync the contacts you create in the app to your own Google tools. You enable this per account and can disconnect or revoke access at any time. We request the following Google account data and use it only as described:

• Google Sheets (.../auth/spreadsheets) — when you enable Sheets sync, we append the contacts you save in Contact Forge as new rows to a spreadsheet in your Google Drive, as a live backup/export. We do not read or modify your other spreadsheets.
• Google Contacts (.../auth/contacts) — when you enable Contacts sync, we add the contacts you save in Contact Forge to your Google Contacts. We use this access only to create those contacts; we do not read or alter your existing contacts.
• Basic profile & email (openid, email, profile) — to identify which Google account is connected.

We access this Google user data solely to provide the sync features you turn on. To maintain the connection we store an encrypted OAuth access/refresh token and the email address of the connected account; we keep no other copy of your Google data beyond the contacts you yourself sync. The sync is one-way (app → Google). We do not use Google user data for advertising, and we do not sell it. We do not use Google user data to develop, improve, or train generalised AI/ML models.

Contact Forge’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke Contact Forge’s access to your Google account at any time from your Google Account permissions or by disconnecting Google in the app’s settings; revoking stops any further syncing.

8. Data location & retention

Customer data is hosted in Mumbai, India (ap-south-1). We retain the structured contact details for as long as your account is active or as needed to provide the Service. The original card photos are kept only for a limited period after scanning (to let you verify and correct the extracted details) and are then automatically deleted; images from abandoned scans and deleted contacts are also purged. You can delete contacts at any time; on account closure we delete or anonymise your personal data within a reasonable period, except where retention is required by law.

9. Security

We use industry-standard measures including encryption in transit, row-level security, hashed passwords, and encrypted storage of integration secrets. No method of transmission or storage is completely secure, but we work to protect your data and to notify you of material breaches as required by law.

10. Your rights

Subject to applicable law, you have the right to:

• access the personal data we hold about you;
• correct or update inaccurate data;
• request erasure of your data;
• withdraw consent and close your account;
• nominate, in the event of death or incapacity, another person to exercise your rights.

To exercise these rights, contact us at info.4bytesolutions@gmail.com.

11. Grievance officer

In accordance with the DPDP Act, you may contact our Grievance Officer with any concerns about how your personal data is handled:

Utsav Chitlangiya
info.4bytesolutions@gmail.com

12. Children

The Service is not directed to children under 18, and we do not knowingly process their personal data without verifiable parental consent as required by law.

13. Changes

We may update this Policy from time to time. Material changes will be notified through the Service or by email. The “Last updated” date above reflects the latest revision.