Privacy Policy

Card2Leads

Operated by BrillBrains Consultants Pvt. Ltd.

Last updated: 12 August 2026

BrillBrains Consultants Pvt. Ltd. (“BrillBrains”, “we”, “us” or “our”) operates Card2Leads, a business-card digitisation, contact-management and lead-organisation application.

This Privacy Policy applies specifically to Card2Leads and explains how information is collected, accessed, used, processed, stored, shared and deleted when you use the Card2Leads website, the Card2Leads mobile application for Android, and related features. References to “Card2Leads” or “the application” in this policy cover both the website and the mobile app.

About Card2Leads

Card2Leads helps businesses and professionals convert physical or digital business cards into organised digital contact records.

Depending on the features you choose to use, Card2Leads may allow you to:

• Scan or upload business cards;
• Extract information such as names, mobile numbers, email addresses, companies and designations;
• Review and correct extracted information;
• Organise contacts using labels, categories, events and notes;
• Add information through voice input;
• Export contact records to supported file formats;
• Save or synchronise selected contact information with Google Contacts; and
• Create or update Google Sheets containing contact information when requested by you.

Connecting a Google account is optional. Card2Leads requests access to Google services only when you choose to use a feature that requires such access and after you provide permission through Google's authorisation process.

Other products or services operated by BrillBrains Consultants Pvt. Ltd. may be governed by separate privacy policies.

1. Information We Collect

We may collect information you provide directly, information you upload for processing, information received through integrations you authorise, and limited technical information generated when you use Card2Leads.

1.1 Account and Profile Information

When you create or use a Card2Leads account, we may collect:

• Name;
• Email address;
• Mobile number;
• Company or organisation name;
• Account login and authentication information;
• Subscription, plan or usage information, where applicable;
• Preferences and account settings; and
• Communications sent to our support team.

Where Google Sign-In is used, we may receive basic profile information authorised by you, such as:

• Name;
• Email address;
• Profile image; and
• Google account identifier.

We do not receive or store your Google account password.

1.2 Business-Card Images and Uploaded Files

When you scan or upload a business card, Card2Leads may process:

• Images of the front or back of a business card;
• Photographs captured using your device camera;
• Images uploaded from your device;
• Bulk-uploaded business-card images; and
• Files containing business-card or contact information.

Business cards may contain information such as:

• Name;
• Company or organisation;
• Job title or designation;
• Mobile and telephone numbers;
• Email addresses;
• Business or postal addresses;
• Website addresses;
• Social-media or professional-profile information;
• QR-code information;
• Product, service or business category; and
• Other information appearing on the card.

1.3 Extracted and Structured Contact Information

Card2Leads may convert uploaded content into structured contact records containing information such as:

• Name;
• Mobile number;
• Telephone number;
• Email address;
• Company name;
• Designation;
• Address;
• Website;
• Notes;
• Labels and tags;
• Contact category or importance;
• Event or exhibition name;
• Event or exhibition date;
• Lead source;
• User-added comments; and
• Other custom fields entered or selected by the user.

Users can review, correct, add to or remove extracted information before exporting or synchronising it.

1.4 Voice Inputs and Recordings

When you voluntarily use a voice-enabled feature, Card2Leads may process:

• Audio captured through your microphone;
• Voice notes uploaded by you;
• Transcriptions generated from audio;
• Labels, notes, names, categories or contact details spoken by you; and
• Voice instructions associated with one or more contact records.

Microphone access is requested only when you choose to use a voice-enabled feature.

You should avoid including confidential, sensitive or unrelated personal information in voice inputs.

2. Google Account and Google API Information

Card2Leads may integrate with Google services to provide optional features requested by the user.

Google access is not required to scan business cards or use features that do not depend on Google services.

Google permissions are requested only when you choose to connect your Google account or use a relevant Google integration.

The exact information Card2Leads can access depends on the permissions displayed to you during Google's OAuth authorisation process.

2.1 Google Sign-In and Basic Account Information

When you choose to sign in using Google, Card2Leads may receive basic profile information authorised by Google and by you, including:

• Your name;
• Email address;
• Profile image; and
• Google account identifier.

This information is used to authenticate you, identify your Card2Leads account and provide account-related functionality.

Card2Leads does not receive your Google password.

2.2 Google Contacts Information

When you explicitly connect Google Contacts or request a Google Contacts synchronisation feature, Card2Leads may access Google Contacts information necessary to perform the operation requested by you.

Depending on the feature and permissions granted, this may include access necessary to:

• Create new Google Contacts;
• Save extracted business-card information into Google Contacts;
• Update contacts selected by you;
• Apply labels or relevant identifying information;
• Identify possible matching or duplicate contacts where this functionality is enabled; and
• Confirm whether a contact synchronisation operation succeeded.

Card2Leads accesses Google Contacts only after you authorise the relevant permissions.

Google Contacts data is not accessed for advertising, profiling or unrelated purposes.

2.3 Google Sheets Information

When you choose to export, create or synchronise information using Google Sheets, Card2Leads may access information necessary to complete the operation requested by you.

Depending on the permissions granted, this may include the ability to:

• Create a spreadsheet requested by you;
• Select or create a worksheet;
• Add rows containing contact information;
• Update information previously added through Card2Leads;
• Read relevant spreadsheet or worksheet identifiers;
• Read relevant rows when necessary to perform a user-requested synchronisation; and
• Detect possible duplicate records where this functionality is enabled.

Card2Leads uses such access only to perform functionality initiated, selected or authorised by the user.

2.4 Google Drive Access

Where a Google Sheets feature requires Google Drive-related permissions, Card2Leads uses such permissions only as necessary to create, locate, select or operate on files relevant to the feature requested by you and within the permissions granted through Google.

Card2Leads does not intentionally browse, collect or use unrelated files from your Google Drive for unrelated purposes.

Card2Leads does not use Google Drive information for advertising, behavioural profiling, data brokerage or unrelated analytics.

2.5 Google Services We Do Not Access Through These Integrations

Unless Card2Leads introduces a new feature in the future and separately requests your permission, Card2Leads does not use its current Google integration to access unrelated Google services such as:

• Gmail; or
• Google Calendar.

If the Google integrations offered by Card2Leads materially change, this Privacy Policy and the permissions displayed during the Google authorisation process will be updated as appropriate.

3. How We Use Google User Data

Information obtained through Google APIs is used only to provide or improve user-facing Card2Leads features requested or authorised by you.

Depending on the features you use, this may include:

• Authenticating your Card2Leads account;
• Creating Google Contacts;
• Updating Google Contacts;
• Adding authorised information or labels to contacts;
• Creating or selecting Google Sheets;
• Writing business-card or contact records to a Google Sheet;
• Updating records previously synchronised through Card2Leads;
• Identifying duplicate records where enabled;
• Showing the status or result of a synchronisation;
• Maintaining an integration that you have authorised; and
• Troubleshooting or securing the requested integration.

Google user data is not used for purposes unrelated to the functionality disclosed to you.

4. Google API Services User Data Policy and Limited Use

Card2Leads' use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular:

• We do not sell Google user data.
• We do not sell access to Google user data.
• We do not use Google user data for advertising.
• We do not use Google user data for retargeting.
• We do not use Google user data to create advertising profiles.
• We do not use Google user data for data-broker or information-reseller activities.
• We do not use Google user data for creditworthiness, lending or insurance eligibility decisions.
• We do not use Google user data for surveillance.
• We do not use Google user data for marketing.
• We do not use Google user data for analytics or profiling.
• We do not use Google user data to train general-purpose or publicly available artificial-intelligence or machine-learning models.

Google user data is used only to provide or improve user-facing features that are visible and relevant to the user and that the user has requested or authorised. Any access for security, fraud prevention, or legal compliance is an exception permitted by the Google API Services User Data Policy, not a separate use of your data.

4.1 Human Access to Google User Data

Access to Google user data by BrillBrains personnel is restricted.

Personnel will not manually access Google user data except where such access is reasonably necessary and permitted, for example:

• When you explicitly request support and provide appropriate permission;
• When necessary to investigate abuse, fraud or a security incident;
• When required to comply with applicable law or a lawful legal process; or
• Where information has been aggregated or de-identified so that it cannot reasonably identify an individual.

Access, where required, is limited to authorised personnel who require it for the relevant purpose.

4.2 Service Providers and Google User Data

Card2Leads may use infrastructure or service providers where necessary to operate the application.

Where such providers process Google user data on our behalf:

• Access is limited to what is necessary to provide the relevant service;
• Processing must relate to functionality requested or authorised by the user;
• Google user data must not be used for unrelated advertising or commercial profiling; and
• We take reasonable steps to ensure appropriate confidentiality, security and data-protection safeguards apply.

We do not permit service providers to sell Google user data obtained through Card2Leads.

4.3 Artificial Intelligence Processing and Google User Data

Google user data is never sent to any artificial-intelligence or machine-learning provider. Information Card2Leads obtains from Google APIs — including Google Contacts, Google Sheets and Google Drive file data — is used only to carry out the synchronisation you request, and is not submitted to any AI service, used to train any model, or used to improve any model.

Card2Leads uses AI only to process content you supply directly to the application:

• Business-card images that you photograph or upload from your own device, to extract the contact details printed on the card; and
• Voice notes that you choose to record in the application, to transcribe them and organise the follow-up details you dictate.

For these features Card2Leads uses the following third-party AI providers, on paid API service tiers under which submitted content is not used to train or improve their models:

• Google (Gemini API) — business-card extraction.
• OpenAI — business-card extraction and voice-note transcription.
• Google Cloud Speech-to-Text — voice-note transcription, where enabled.

These providers act as service providers processing content solely on Card2Leads' instructions. Card2Leads does not use aggregators, gateways or model hubs, and does not operate self-hosted models. Card2Leads does not sell this content, and does not use it for advertising or profiling.

5. How We Use Other Information

We may use non-Google information collected through Card2Leads for the following purposes.

5.1 Providing Card2Leads Features

• Processing uploaded business cards;
• Extracting and standardising contact information;
• Generating structured records;
• Converting voice input into text;
• Associating notes, labels and categories with contacts;
• Allowing users to review and correct extracted information;
• Generating supported export files;
• Synchronising information when requested by the user;
• Maintaining records within a user's Card2Leads workspace; and
• Identifying or reducing duplicate records where enabled.

5.2 Account Administration

• Creating and managing accounts;
• Authenticating users;
• Maintaining sessions;
• Providing customer support;
• Sending service-related communications; and
• Administering subscriptions and usage limits where applicable.

5.3 Security and Reliability

• Detecting and preventing fraud, misuse and unauthorised access;
• Investigating technical errors;
• Maintaining application availability and performance;
• Protecting our systems and users;
• Maintaining relevant security and access logs; and
• Responding to security incidents.

5.4 Improving Card2Leads

We may use aggregated or de-identified operational information to understand application performance and improve usability, reliability and extraction accuracy.

We do not use identifiable Google API data, business-card contact information, voice recordings or other identifiable user-uploaded content to train generalized or publicly available AI or machine-learning models.

5.5 Legal and Compliance Purposes

Information may be processed when reasonably necessary to:

• Comply with applicable laws;
• Respond to lawful government requests or legal proceedings;
• Enforce our terms and policies;
• Investigate misuse; or
• Establish, exercise or defend legal claims.

6. Information About Other Individuals

Business cards frequently contain personal or professional information relating to people other than the Card2Leads account holder.

When you upload a business card, contact list, voice recording or other information relating to another person, you are responsible for ensuring that you have an appropriate and lawful basis for processing that information.

You agree that:

• You obtained or received the information lawfully;
• You have a legitimate and lawful purpose for processing it;
• You will use it only for lawful purposes;
• You will respect applicable correction, deletion or opt-out requests; and
• You will comply with applicable privacy, direct-marketing, telecommunications and anti-spam requirements.

Possession or exchange of a business card does not necessarily constitute consent to receive unlimited promotional or marketing communications.

Users are responsible for obtaining any consent required before contacting an individual for marketing purposes.

Card2Leads must not be used for unlawful scraping, surveillance, harassment, spam, unauthorised profiling or other unlawful activities.

Depending on the circumstances, BrillBrains may act as:

• A Data Fiduciary or data controller for information relating to accounts, support, security and service administration; and
• A service provider or data processor for business-card and contact information processed on the instructions of a Card2Leads user.

Where Card2Leads processes information on behalf of a business or organisation, that organisation remains responsible for its relationship with individuals whose information it uploads or manages.

7. OCR, Voice and Artificial-Intelligence Processing

Card2Leads may use optical character recognition, transcription and artificial-intelligence technologies to provide features such as business-card extraction and voice transcription.

Uploaded business-card images, voice recordings and relevant instructions may be processed by infrastructure, OCR, transcription or AI service providers as necessary to generate the result requested by the user.

Processing may include:

• Reading printed text from images;
• Identifying likely names, phone numbers, companies and email addresses;
• Converting spoken information into text;
• Standardising contact formats;
• Mapping information into structured fields;
• Identifying possible incomplete or duplicate records; and
• Suggesting information for user review.

Automated extraction may occasionally be incomplete or inaccurate. Users should review information before exporting it, synchronising it or using it to contact another person.

Card2Leads does not guarantee that automated extraction or transcription will be error-free.

Google API user data and identifiable Card2Leads user content are not used by Card2Leads to train generalized or publicly available AI or machine-learning models.

8. How We Share Information

We do not sell personal information, Google user data or contact databases.

We do not share personal information with third parties for behavioural advertising.

Information may be shared only in circumstances such as those described below.

8.1 At Your Direction

Information may be transferred to:

• Your Google Contacts account;
• A Google Sheet selected or created by you;
• Files generated and downloaded by you;
• Systems or devices into which you import exported files; and
• Other authorised members of your Card2Leads account where team functionality is available.

8.2 Service Providers

We may use service providers for functions such as:

• Cloud hosting;
• Database or file storage;
• OCR processing;
• Artificial-intelligence processing;
• Voice transcription;
• Authentication;
• Email or service communications;
• Security monitoring;
• Error reporting;
• Customer support; and
• Payment processing where applicable.

Service providers are permitted to process information only to the extent necessary to provide the relevant service to Card2Leads and must be subject to appropriate security and confidentiality requirements.

8.3 Legal Requirements

We may disclose information where reasonably necessary to:

• Comply with applicable law or legal process;
• Respond to lawful requests by public authorities;
• Investigate fraud or security incidents;
• Protect the rights, property or safety of BrillBrains, our users or others; or
• Enforce applicable agreements.

8.4 Business Transfers

If BrillBrains undergoes a merger, acquisition, restructuring or sale of assets, information may be transferred as part of that transaction subject to applicable legal requirements.

Where additional notice or consent is required by applicable law, we will provide it.

9. Data Storage and Security

We use reasonable technical and organisational measures designed to protect personal information.

Depending on the information and system involved, these measures may include:

• HTTPS encryption for information transmitted between the user's browser and Card2Leads;
• Secure authentication and session-management practices;
• Restricted and role-based access;
• Protection of OAuth credentials and tokens;
• Server and database security controls;
• Logging and monitoring;
• Backup and recovery processes;
• Security incident response measures;
• Review and restriction of service-provider access; and
• Administrative confidentiality controls.

Access to business-card images, voice information, contact records and Google integration information is restricted to authorised systems and personnel where access is necessary for service delivery, security, support or legal compliance.

No electronic system can be guaranteed to be completely secure.

Where required by applicable law, we will notify affected users and relevant authorities of qualifying personal-data breaches.

10. Google OAuth Tokens

When you authorise a Google integration, Card2Leads may receive OAuth access tokens and, where permitted, refresh tokens.

These tokens allow Card2Leads to perform authorised Google operations without receiving your Google password.

OAuth tokens are used only for the Google functionality authorised by you.

We take reasonable measures designed to protect OAuth credentials and tokens against unauthorised access.

Tokens are retained only while necessary to maintain an authorised integration or as otherwise required for security or legal purposes.

When Google access is disconnected, revoked or the relevant Card2Leads account is deleted, stored OAuth tokens are deleted, revoked or otherwise rendered unusable within a reasonable period, subject to technical, security and backup requirements.

11. Data Retention

We retain personal information only for as long as reasonably necessary to provide Card2Leads, fulfil the purpose for which information was collected, comply with applicable law, resolve disputes and protect the service.

Unless a different period is required by law or communicated within the application, the following principles apply.

11.1 Temporary Business-Card Images and Voice Recordings

Temporary processing copies are generally removed after extraction and verification or within 30 days of processing.

If Card2Leads provides functionality allowing users to retain original images or audio in their workspace, such files may remain until deleted by the user or the relevant account is deleted.

11.2 Extracted Contact Records, Notes and Labels

Contact records, tables, notes, labels and related user-created information may be retained while the user's account remains active or until the user deletes them.

Following account deletion, active copies are generally removed within 30 days, subject to legal, security and backup requirements.

11.3 Google OAuth Tokens

OAuth credentials may be retained while the relevant Google integration remains connected.

They are deleted, revoked or rendered unusable after the user disconnects Google access, revokes permission or deletes the relevant Card2Leads account, subject to reasonable technical and backup periods.

11.4 Google API Data

Google API data is retained only where reasonably necessary to provide the functionality requested by the user.

Card2Leads does not retain Google API data indefinitely merely because access was previously granted.

Where Google data has been copied into a Card2Leads record at the user's request, that Card2Leads record may remain until it is deleted by the user or the user's Card2Leads account is deleted, subject to the retention provisions in this policy.

11.5 Generated Export Files

Files generated for export may be temporarily retained to facilitate delivery and are generally removed from our systems after delivery or within 30 days.

Copies downloaded to a user's device are controlled by that user.

11.6 Support Communications

Support records may be retained for up to three years or for another reasonable period necessary to resolve an issue, comply with legal obligations or establish or defend legal claims.

11.7 Security and Diagnostic Logs

Security and operational logs may be retained for up to 12 months or longer where reasonably required to investigate an incident or comply with applicable law.

11.8 Backups

Deleted information may remain temporarily within encrypted or access-restricted backup systems for up to 90 days before being overwritten or permanently removed through ordinary backup processes.

12. Disconnecting or Revoking Google Access

You control whether Card2Leads remains connected to your Google account.

Where supported, you may disconnect Google from within Card2Leads' account or integration settings.

You may also revoke Card2Leads' access through the third-party application or connection controls available within your Google Account.

After access is revoked:

• Card2Leads will no longer be able to perform new Google operations requiring the revoked permission;
• OAuth credentials associated with the disconnected integration will be deleted, revoked or rendered unusable within a reasonable period;
• Contacts already created within your Google Contacts account will remain there unless you delete them;
• Information already written to Google Sheets will remain within those spreadsheets unless you delete it; and
• Information separately stored within your Card2Leads account may remain until you delete the relevant records or request account deletion.

Revoking Google access does not automatically delete information already created in your Google account because that information is controlled through the relevant Google service.

13. Account and Data Deletion

You may request deletion of your Card2Leads account and associated personal information through an account-deletion feature, where available, or by contacting us using the details provided below.

We may need to verify your identity or authority over the relevant account before processing a deletion request.

Following an account-deletion request, personal information under our control will be deleted or de-identified within a reasonable period, subject to legitimate legal, security, fraud-prevention, dispute-resolution and backup requirements.

Deleting a Card2Leads account does not automatically delete:

• Contacts already created in Google Contacts;
• Information already written to Google Sheets;
• Files downloaded to your device;
• Copies shared with another person or system; or
• Information independently obtained and uploaded by another Card2Leads user.

Those copies must be managed through the relevant external system or service.

14. Your Rights and Choices

Subject to applicable law, you may have rights that include the ability to:

• Request access to personal information associated with your account;
• Correct inaccurate or incomplete account information;
• Edit or delete extracted contact records;
• Request deletion of your Card2Leads account;
• Withdraw consent for optional processing;
• Disconnect Google integrations;
• Revoke Google permissions;
• Request information about how your information is processed;
• Raise a grievance concerning the processing of your information; and
• Exercise other rights available under applicable data-protection law.

Certain requests may be limited where retention or processing is required by law, reasonably necessary for security, or necessary to establish, exercise or defend legal claims.

14.1 Requests From Individuals Whose Business Cards Were Uploaded

If your information was uploaded by a Card2Leads user, the individual or organisation that collected or uploaded your business card will generally be the appropriate first point of contact regarding use of that information.

You may also contact BrillBrains.

Where appropriate and after reasonable verification, we may:

• Direct a request to the relevant Card2Leads user;
• Help identify the relevant record;
• Assist the user with correction or deletion;
• Restrict processing where appropriate; or
• Remove information under our control where legally required.

15. Cookies and Technical Information

Card2Leads may use cookies or similar technologies that are necessary for functionality such as:

• Keeping users signed in;
• Maintaining secure sessions;
• Remembering necessary preferences;
• Detecting fraud or misuse; and
• Supporting security and application functionality.

Essential cookies may be required for Card2Leads to operate correctly.

We do not use cookies for third-party behavioural advertising.

If optional analytics or similar technologies are introduced, appropriate disclosure and consent controls will be provided where required by applicable law.

Card2Leads may also automatically receive limited technical information such as:

• IP address;
• Browser type;
• Device type;
• Operating system;
• Date and time of access;
• Session information;
• Feature usage;
• Error and diagnostic information;
• Synchronisation or extraction status; and
• Security-related information.

Such information may be used to operate, protect, troubleshoot and improve Card2Leads.

16. International Data Processing

Some infrastructure, hosting, OCR, AI, transcription, authentication, security or other service providers may process information using systems located outside India.

Where information is processed internationally, we take reasonable steps to ensure that such processing is connected to providing Card2Leads and subject to safeguards required by applicable law.

17. Children's Privacy

Card2Leads is intended for businesses, professionals and individuals who are at least 18 years old.

Card2Leads is not intended for children, and we do not knowingly permit children to create Card2Leads accounts.

Users should not intentionally upload personal information relating to children unless they have lawful authority and such processing is permitted under applicable law.

If we become aware that a child's information has been processed unlawfully, we may delete or restrict the relevant information.

18. Changes to This Privacy Policy

We may update this Privacy Policy to reflect:

• Changes to Card2Leads features;
• Changes to Google or other integrations;
• Changes to our service providers;
• Changes to legal or regulatory requirements;
• Changes to our information-handling practices; or
• Security and operational improvements.

The current version of this Privacy Policy will be published on the Card2Leads website with an updated effective date.

If a change materially affects how Google user data or other personal information is used, we will provide appropriate notice and obtain additional authorisation or consent where required before using the information for the new purpose.

19. Contact and Grievance Details

For questions, privacy requests, deletion requests, complaints or concerns regarding this Privacy Policy or Card2Leads' processing of personal information, contact:

BrillBrains Consultants Pvt. Ltd.

• Product: Card2Leads
• Email: tech@brillbrainsconsultants.com
• Phone: +91 9093400666 / 777

When contacting us, please provide enough information for us to identify the relevant Card2Leads account and understand your request.

Please do not send passwords, complete contact databases, unnecessary identity documents or other confidential information by email.

We may request reasonable verification before processing an access, correction, revocation or deletion request.

20. Google Integration Summary

For clarity:

• Application name: Card2Leads
• Application operator: BrillBrains Consultants Pvt. Ltd.
• Purpose of Google access: To provide optional, user-requested features involving Google Sign-In, Google Contacts and Google Sheets.
• Google access is optional: Yes.
• Google account password collected by Card2Leads: No.
• Google user data sold: No.
• Google user data used for advertising or retargeting: No.
• Google user data used for data-broker activities: No.
• Google user data used to train generalized AI models: No.
• Google access can be revoked by the user: Yes.
• Google data retained only as necessary for authorised functionality: Yes.

Card2Leads' use and transfer of information obtained from Google APIs will adhere to the Google API Services User Data Policy, including applicable Limited Use requirements.