piktechs.Log in

Privacy Policy

Last updated: 3 November 2026

Data controller

The data controller is EMM, a French société par actions simplifiée à associé unique with a share capital of EUR 1.00, registered with the Paris Trade and Companies Register under number 107 138 109, with its registered office at 6 rue d'Armaillé, 75017 Paris, France. EMM operates Piktechs, a digital business card (QR, NFC, link) and contact management service, available on the web (piktechs.com) and as an Android and iOS mobile app. For any question about your personal data: [email protected].

Data we process

Depending on how you use the service:

  • Account: email address, hashed password, language, current plan. If you sign in with Google: the name, email address and profile picture Google shares with us.
  • Cards: name, job title, company, contact details, photo, links — whatever you choose to publish.
  • Contacts and leads: details you enter or import yourself, read from a business card you scan, or submitted by a visitor through a card form — including their answer to the optional box agreeing to receive the card owner's offers, kept with the date and the accepted wording as proof of consent.
  • Contact notes: written notes, voice notes (audio recordings) and photos you add.
  • Usage statistics: card views, NFC taps, clicks, form opens — tied to the card, not to the visitor's identity.
  • Mobile app: if you turn on notifications, a technical identifier for your device (push token).
  • Billing: Stripe customer and subscription identifiers (no card number ever reaches our servers).

Mobile app and permissions

The Piktechs app asks for a permission only when you use the feature that needs it. You can revoke it at any time in your device settings.

  • Camera: scan a QR code (processed on the device), photograph a business card to extract its details, or take a photo to attach to a contact note.
  • Photos: pick an image from your library (profile photo, card visual, business card to scan, photo attached to a contact note); only the image you select is read.
  • Microphone: record a voice note on a contact, only when you start a recording.
  • NFC: read a tag, or write your card's public address to a blank tag; the exchange happens between your device and the tag.
  • Notifications: if you turn them on, alert you when a new lead comes in.
  • The app does not access your location or your device's address book, and contains no advertising or audience-measurement tools.

Business card scanning

When you scan a business card, the photo is sent encrypted to OpenRouter, which passes it to an artificial intelligence model that extracts the contact details. Piktechs does not keep the photo: only the details you save end up in your contacts. If this service is unavailable, the text is read directly on your device.

Purposes and legal bases

  • Providing the service and performing the contract: account, card, contact and lead management, card scanning and notes (contract performance).
  • Billing and subscription management (contract performance and legal obligation).
  • Service emails (confirmations, reminders, notifications) and app notifications: contract performance; marketing emails: consent.
  • Audience measurement on the piktechs.com website and the app.piktechs.com web app via Google Analytics: consent, collected through the cookie banner.
  • Security, abuse prevention and product improvement: legitimate interest.

Processors and recipients

We never sell data. We rely on technical providers, each bound by a data processing agreement:

  • Supabase: database, authentication, file storage (photos, voice notes) and server functions; data stored in the European Union (Ireland).
  • Cloudflare: website hosting and delivery.
  • Stripe: payments and subscriptions.
  • Resend: transactional email delivery.
  • OpenRouter: artificial-intelligence analysis of the business cards you scan.
  • Google: Sign in with Google if you choose it, app notifications (Firebase Cloud Messaging) and audience measurement on the website and web app (Google Analytics, deployed through Google Tag Manager, only after your consent; Google Ireland Limited, with a possible transfer to the United States covered by the Data Privacy Framework and standard contractual clauses).
  • Google Play, Apple and RevenueCat: in-app purchases and subscriptions, when offered.
  • HubSpot, Odoo, Zapier and Make: only if you connect these tools to Piktechs yourself; the data then goes to your own account.

Cookies and trackers

The website sets two categories of trackers:

  • Strictly necessary: authentication session, language preference, and your saved cookie choice (the piktechs_cookie_consent cookie, 13 months, shared by piktechs.com and app.piktechs.com so you are not asked twice). These require no consent.
  • Audience measurement (Google Analytics 4, through Google Tag Manager): nothing is loaded until you click “Accept” — no Google Tag Manager, no Google Analytics, no cookie. Once you accept, the _ga and _ga_<id> cookies (13 months at most) measure page views and a few key clicks, on piktechs.com and app.piktechs.com alike (cross-domain measurement). Public business cards, event pages and NFC redirects are never measured. If you decline, nothing is loaded; if you withdraw your consent, the Google Analytics cookies are deleted.

Retention

Your account data is kept while your account is active; “Delete your account” below lists what is erased when you delete it. Photos of scanned business cards are not kept. Billing records are kept for as long as applicable accounting and tax obligations require. Audience measurement data is kept for the period configured in Google Analytics, capped at 14 months.

Delete your account

You can delete your account at any time, without having to contact us:

  • In the mobile app or on app.piktechs.com, signed in: Settings → Privacy → Danger Zone → “Delete Account”. A confirmation code is emailed to you.
  • If you can no longer access your account: write to [email protected] from the account's email address; we handle the request within one month.
  • Permanently deleted: your account, the data attached to it (cards, contacts and leads, written notes, voice notes and photos, statistics, the CRM integrations of your own workspaces, push tokens) and the files you uploaded (card photos, audio recordings, note photos). Any active subscription is cancelled.
  • Kept: the integrations (CRM, Zapier/Make) of a team or organisation you do not own — they belong to that shared workspace and hold its credentials, not yours; your name is erased from them. Also kept: billing records, with our payment provider Stripe, for as long as accounting and tax obligations require.

Transfers outside the European Union

Some providers (Stripe, OpenRouter, Google, Cloudflare) may process data outside the European Union, notably in the United States. These transfers rely on the European Commission's standard contractual clauses and/or the EU–US Data Privacy Framework.

Your rights

You have the right to access, rectify, erase, restrict, object to and port your data, and to withdraw your consent at any time. Write to [email protected] — we answer within one month. You can also delete your account yourself (see “Delete your account”) and lodge a complaint with the French data protection authority (CNIL, www.cnil.fr).

Manage your cookie choice

You can change your mind at any time: the banner will reappear so you can accept or decline audience measurement.