Privacy Policy

1. Introduction

LinkFayo is a digital business card platform operated by Convonexus Private Limited ("we", "us", "our"), a company incorporated under the Companies Act, 2013, with its registered office at First Floor, 75/1, Prem Tower, Araghar, Near Shiv Nagar, Dalanwala, Natthuwa Wala, Dehradun, Uttarakhand – 248001, India. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use linkfayo.com and our services. By creating an account or using our platform, you consent to the practices described in this policy. This policy is governed by the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000.

2. Information We Collect

Account Data

We collect your name, email address, and hashed password. All authentication is handled securely via Supabase. We do not store plain-text passwords on our servers.

Digital Card / Profile Data

Information you add to your digital card including job title, company name, phone number, website URL, social media profile links, and profile photograph. This information is intended for public display as part of your digital business card.

Payment Data

All payment processing is handled by Razorpay, a PCI DSS Level 1 certified payment aggregator licensed by the Reserve Bank of India. LinkFayo does not store, access, or process credit card numbers, debit card numbers, CVV codes, or UPI credentials. Razorpay's privacy policy governs the handling of your payment data.

CRM & Contact Data

If you use LinkFayo's built-in CRM, we store the contact information (names, emails, phone numbers) of leads and contacts you manually add or capture through your digital card's lead form. This data is stored securely in our Supabase database and is accessible only to you.

AI OCR Data

When you use the AI business card scanner feature, the photograph of the physical card you upload is transmitted to OpenAI's API for text extraction. This image is processed in transit and is not permanently stored by LinkFayo or OpenAI after processing is complete. Please do not scan cards containing sensitive personal or financial information.

Analytics Data

We track views of your digital card, link clicks, and contact saves. This data is aggregated and used to generate your analytics dashboard.

Technical / Device Data

IP address, browser type, operating system, device type, referring URL, and session duration, collected via cookies and server logs.

3. How We Use Your Information

We use your data to: create and manage your account; display and share your digital business card with recipients; process subscription payments via Razorpay; send transactional emails (account confirmations, payment receipts) via Resend; power the AI OCR scanning feature via OpenAI; generate analytics for your card performance; improve and maintain the LinkFayo platform; respond to support queries; and comply with legal obligations under Indian law.

4. Third-Party Service Providers

We share data with the following service providers solely for the purposes listed:

• Supabase (USA) — Database and authentication. Stores account data, card data, CRM contacts. Data processing agreement in place.
• Razorpay (India) — Payment processing. Processes payment data. RBI-licensed Payment Aggregator. PCI DSS Level 1 certified.
• Resend (USA) — Transactional email delivery. Receives your name and email for sending notifications.
• OpenAI (USA) — AI-powered OCR card scanning. Receives card images temporarily for text extraction.
• Vercel (USA) — Web hosting, CDN, and serverless functions. Processes web traffic infrastructure.

We do not sell, rent, or trade your personal data to any third party for marketing purposes.

5. Data Retention

Account data is retained for as long as your account is active, plus 90 days after deletion to allow for recovery requests. After 90 days, personal data is permanently deleted. Payment transaction records are retained for 7 years in accordance with Indian tax law and GST compliance requirements. Analytics data is retained in aggregated, anonymised form indefinitely.

6. Your Rights under the DPDP Act 2023

As a data principal under the Digital Personal Data Protection Act, 2023, you have the following rights:

• Right to access: request a copy of the personal data we hold about you.
• Right to correction: request correction of inaccurate or incomplete data.
• Right to erasure: request deletion of your personal data, subject to legal retention requirements.
• Right to withdraw consent: withdraw consent for data processing at any time, which may affect your ability to use the service.
• Right to grievance redressal: file a complaint with our Grievance Officer.

To exercise any of these rights, email support@linkfayo.com with the subject line "Data Rights Request — [your registered email]". We will respond within 30 days.

7. Cookies

We use the following cookies:

• Essential cookies: required for authentication and keeping you logged in (Supabase session cookies). Cannot be disabled.
• Analytics cookies: used to understand platform usage and improve our product. You may opt out via browser settings.

We do not use advertising or third-party tracking cookies.

8. Children's Privacy

LinkFayo is not intended for use by individuals under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact support@linkfayo.com and we will delete it immediately.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users via email of material changes at least 7 days before they take effect. Continued use of the platform after changes constitutes acceptance of the updated policy.

10. Contact

For privacy-related queries: support@linkfayo.com