Privacy notice

Who holds your data

Azim Faris is the data user for the purposes of the PDPA and is responsible for the personal data described here. You can reach him at azmfrs.studio@gmail.com.

What is collected

Two different kinds of personal data are involved, and it matters which is which.

Your own data. Your email address, from signing in. Anything you put on your own profile card — name, job title, company, phone, email. Optionally, a photograph of your own printed business card, front and back, which you choose to add and can remove at any time. Your sign-in is by emailed link or Google; no password is stored.

Other people's data, from the cards you scan. Photographs of business cards you capture, the text read from them (name, title, company, phone numbers, email addresses, websites, postal addresses), anything you add yourself such as where you met someone and your own notes, and tags produced automatically about the company.

The source of that second category is you: it comes from cards handed to you, not from any purchased list or public scrape.

Why it is collected

To provide the product: to read a card so you do not have to type it, to let you find and organise your contacts, to let you share a contact or send yourself an export, and to add publicly available context about a company.

Providing this data is voluntary. You can use KNOU without a profile card, and without notes or met-at details. If you do not scan a card, there is nothing for the product to do.

Who it is shared with

These are the only parties data reaches, and each is listed because of something the product genuinely does.

• Supabase — hosts the database, files and sign-in. Data is stored in the Singapore region.
• Cloudflare — serves the application.
• OpenRouter — the AI service that reads card images and generates company summaries and follow-up drafts. Card images and card text are sent to it. The app asks for your permission before the first card is sent, sends nothing until you agree, and lets you withdraw that permission in Settings.
• Your browser’s own speech service — only if you tap the microphone in the finder. Your browser sends that recording to its own maker (Google on Chrome, Edge and Samsung Internet; Apple on Safari) and returns the words as text. It is the same service your keyboard’s dictation button uses. KNOU never receives or stores the recording — only the text it becomes, which you can edit or clear before searching. If you would rather not send audio to those companies, do not tap it; typing does the same job.
• Resend — delivers sign-in emails, and delivers contact exports to addresses you type in yourself.
• Authorised KNOU staff — a small number of people on an admin list can open your account, its cards, events, companies and profile cards, to give support, fix data that went wrong, and remove accounts. Every time they open your contacts or change anything, it is logged with who did it, when and why, and that log cannot be edited or deleted.
• Anyone you give a share link to. A share link is unlisted but is not secret: anyone holding the link can open it until it expires or you revoke it.

Data is not sold, and is not shared with advertisers or data brokers.

What you control

• See and correct. Every field on every card is editable in the app, and your profile card is editable at any time.
• Delete. Deleting a card moves it to Trash, where you can restore it. After 30 days it is removed permanently, along with its images.
• Stop sharing. Any share link can be revoked from the Shared links screen, which also shows how many times it has been opened.
• Delete your account. Settings → Delete account removes your account and everything in it straight away: every card and image, your profile cards and their photos, your events, companies and share links, and your export history. It cannot be undone, and any QR code you have printed stops working.
• Ask for a copy, or for erasure. Write to azmfrs.studio@gmail.com and it will be handled.

How long it is kept

Cards are kept until you delete them. A deleted card sits in Trash for 30 days and is then removed permanently. A record of contact exports you send by email is retained as an audit log, because it records that personal data left the app and to whom. It is kept for as long as your account exists, and deleting your account deletes it too. The log of staff access to your account is kept too, even after the account is deleted, so that access can always be accounted for.

How it is protected

Each account can only read its own data; that separation is enforced by the database itself, not only by the application. The one exception is the staff access described above, which goes through a separate tool on its own address and is logged. Images of the cards you scan are stored privately and are served through links that expire after one hour. Public share pages expose only a limited set of fields and never your private notes.

The photo of your own card is different, on purpose. If you add one, it is meant to be seen: anyone you give your QR code or card link to can view it and save a copy to their own device, without signing in, for as long as you leave it switched on. You can hide it or delete it at any time from My card, but a copy someone has already saved is theirs, and taking it down here cannot reach it.

Being asked, and changing your mind

The people whose cards you scan have not agreed to this notice — you have. If someone asks you to remove their details, delete their card, and it will be gone within 30 days.