CARDELO
Last updated: July 2026
This Privacy Policy explains how Cardelo ("Cardelo", "we", "us") handles information when you use the Cardelo app and website at cardelo.app (the "Service"). Cardelo is a tool for scanning business cards and managing professional contacts. Using Cardelo requires an account, and the contacts you save are stored on your device and synced to your account in the cloud so they are available on every device you sign in on.
To use Cardelo you create an account with your email address and a password. We send a 6 digit code to that address to confirm it belongs to you. Accounts are handled by Google Firebase Authentication, and the verification email is delivered by Resend. We store your email address, and we use it to identify your account, to link your subscription, and to send you service messages such as verification codes, password resets and team invitations. We do not send marketing email.
The contacts you create (names, companies, roles, phone numbers, emails, notes, card images, tasks, and tags) are stored on your device using your browser's storage (IndexedDB) and are also synced to your account in Google Cloud Firestore, so that you can sign in on another device and find your data there. This means the data is held on our infrastructure and is technically accessible to us. We do not sell it, we do not use it for advertising, and we do not use it to train AI models. Access is restricted by security rules so that only your account (and, if you join a team, your team) can read it. Voice notes are transcribed to text on your device as you speak; the audio recording itself is discarded and is never stored or uploaded. Only the resulting text is saved with the contact.
If you delete a contact, or use "Delete all data" in Settings, it is removed from your device and from your account.
If you are on a Business plan you can create an organization and invite colleagues by email. Within an organization, the contacts scanned by any member are visible to the other members, together with the name or email of the member who scanned each one. If you are invited, we email you at the address the administrator entered. Your organization's administrator can see each member's email address and scan counts, and can remove members. Do not put contacts into a shared organization unless you intend your team to see them.
When you scan a card with AI, the card image or text is sent over an encrypted connection to our processing endpoint (Cloudflare Workers) and then to our AI provider, Google (Gemini API), solely to extract the contact details and return them to your device. We do not store the image or the extracted text on our servers, and it is not used to build a profile of you. Google processes the request under its own terms. On free accounts we keep a monthly count of how many AI scans you have used, so we can apply the free limit. AI extraction can be inaccurate, so always review the results.
Cardelo Pro and Cardelo Business are sold and processed by Lemon Squeezy, which acts as the Merchant of Record. Lemon Squeezy collects and processes your payment and billing information under its own privacy policy. We never see or store your payment card details. Lemon Squeezy tells us your email address, which plan you bought, how many seats it covers, and whether the subscription is active, so that we can unlock the right features on your account. You can cancel at any time from "Manage subscription" in Settings.
We use the following providers, each acting on our behalf: Google Firebase (accounts and contact sync), Google Gemini (AI card extraction), Cloudflare (our processing endpoint and usage counters), Resend (verification and invitation emails), and Lemon Squeezy (payments). Each processes data under its own privacy terms.
The Cardelo app does not use advertising cookies and does not sell your data. To understand general usage, the app sends anonymous, aggregate event counts (for example: app opened, a contact was saved, an AI scan was run, the upgrade button was tapped). These contain no cookies, no IP addresses, no device identifiers and no contact data. Only a count of how often each action happens across all users, so we cannot identify you from them. Payment pages operated by Lemon Squeezy may use their own cookies.
When you open our website (cardelo.app) in a browser — for example after clicking one of our ads — we use the Meta (Facebook) Pixel to measure ad performance, such as page views and sign-ups. This sets cookies and shares limited event data with Meta. The installed Cardelo app does not load the Meta Pixel or any advertising tracker.
You can view, edit, export (full backup) or permanently delete your contacts from within the app at any time ("Delete all data" in Settings). To delete your account entirely, including your email address and everything synced to it, email us at the address below and we will action it. Depending on your location, you may have rights to access, correct, delete, or port your personal data, and to object to or restrict processing. For data held by Lemon Squeezy, see their privacy policy or contact us and we will help.
We keep your account and the contacts synced to it until you delete them or ask us to delete your account. We do not retain card images or AI scan content on our servers. Subscription records are retained by Lemon Squeezy as required for billing and legal compliance.
Connections to our services use HTTPS. Your data is protected by your password and by server side security rules that prevent other users from reading it. No method of transmission or storage is perfectly secure, but we design Cardelo to handle as little data as we can.
Cardelo is intended for professionals and is not directed to children under 16. We do not knowingly collect data from children.
We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above.
Cardelo (Idane Amar)
Ra'anana, Israel
Support email: [email protected]
This Privacy Policy and any disputes related to the Service shall be governed by and construed in accordance with the laws of the State of Israel, without regard to its conflict of law provisions. Any legal action or proceeding arising under this Policy shall be brought exclusively in the courts located in Israel.