Privacy Policy
Last updated: 2026-03-19
1. Introduction
CardInsight AI ("Service") is committed to protecting the privacy and personal data of all users and data subjects. This policy explains how we collect, use, store, and protect personal data in compliance with the General Data Protection Regulation (GDPR) and Taiwan Personal Data Protection Act (PDPA).
2. Data Controller
The data controller responsible for the processing of personal data is Hamster Intelligence Technologies. For privacy-related inquiries, please contact us through the system administrator.
3. Data We Collect
3.1 Business Card Data (Direct Collection)
When you scan a business card, we collect:
- Identification Data: Name, English name
- Professional Data: Job title, company, department
- Contact Data: Email, phone, mobile, fax, address
- Social Media: LinkedIn URL, Twitter/X handle
Legal basis: Legitimate interest (GDPR Art.6(1)(f)) / Consent (Taiwan PDPA Art.19)
3.2 AI Background Enrichment (Indirect Collection)
When you trigger AI background enrichment, we collect from public sources:
- Company Information: Overview, key figures, recent developments
- Professional Profile: Career trajectory, expertise, notable activities
- Related News: Industry news, press coverage
Legal basis: Consent (GDPR Art.6(1)(a)) / Taiwan PDPA Art.9 (indirect collection notice required)
3.3 Scan Context Data
Optionally collected during card scanning:
- Geolocation (latitude/longitude), event name, industry context
4. Purpose of Processing
| Purpose | Data Categories | Legal Basis |
|---|---|---|
| Contact management | Business card data | Legitimate interest / Consent |
| AI background research | Public information | Consent |
| News monitoring | Public news articles | Consent |
| Connection analysis | Professional data | Legitimate interest |
5. Your Rights
Under GDPR and Taiwan PDPA, you have the following rights:
Right of Access
Request a copy of your personal data (GDPR Art.15 / PDPA Art.3)
Right to Rectification
Request correction of inaccurate data (GDPR Art.16 / PDPA Art.3)
Right to Erasure
Request deletion of your data (GDPR Art.17 / PDPA Art.11)
Right to Data Portability
Receive your data in machine-readable format (GDPR Art.20)
Right to Withdraw Consent
Withdraw consent at any time (GDPR Art.7(3) / PDPA Art.3)
Right to Restriction
Request restriction of processing (GDPR Art.18)
To exercise these rights, use the Privacy & Compliance dashboard in the system, or contact the system administrator.
6. Data Retention
Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected. We implement the following retention practices:
- Contact data: Reviewed annually; data older than one year triggers a retention review
- AI enrichment results: Retained until the contact is deleted
- Processing logs: Retained for audit purposes (minimum 3 years per Taiwan PDPA Art.12)
- Consent records: Retained as evidence of compliance
Taiwan PDPA Art.11: Data shall be deleted when the specific purpose ceases to exist or the retention period expires.
7. Data Security
We implement the following security measures (GDPR Art.32 / PDPA Art.27):
- Encrypted data transmission (HTTPS/TLS)
- User authentication and access control
- PII masking capability for sensitive fields
- Data isolation per user (WHERE user_id = ?)
- Processing activity logging for audit trail
- Regular compliance audits
8. PII Sensitivity Classification
| Level | Fields | Protection |
|---|---|---|
| High | Email, phone, mobile, address, fax | Encryption, masking, access control |
| Medium | LinkedIn, Twitter, social media | Access control |
| Low | Name, title, company, department | Standard protection |
9. Third-Party Services
The following third-party services may process data:
- Anthropic Claude API: AI analysis (data processed but not stored by Anthropic)
- Google Custom Search API: Public information search
- Perplexity API: Research queries
All third-party processing is performed under appropriate data processing agreements.
10. International Data Transfers
When AI analysis is performed, data may be transferred to servers outside Taiwan/EU. We ensure adequate protection through standard contractual clauses (GDPR Art.46) and equivalent safeguards.
11. Taiwan PDPA Specific Provisions
- Art.5: Personal data collection respects the rights of the data subject
- Art.7: Written consent obtained with clear explanation of purpose
- Art.8: Data subjects notified at the time of collection
- Art.9: For indirectly collected data, subjects are notified before use
- Art.11: Data deleted when specific purpose ceases
- Art.12: Data breach notification within 72 hours
12. Changes to This Policy
We may update this privacy policy from time to time. Significant changes will be communicated through the system dashboard.