Privacy Policy
Effective as of 16 September 2026
本页以英文显示，因为只有英文版本是正确且具有约束力的文本。任何翻译仅便于理解，可能并不完全准确。
This Privacy Policy describes the rules pursuant to which Lodi processes the personal data of Users of the Lodi mobile application.
1. DEFINITIONS
1.1. The following terms shall have the meaning set out below when used in this Privacy Policy:
| Data Subject | a natural person who is a User of the Service, or a natural person whose personal data is processed through the Service (e.g., a person whose business card has been scanned by a User) |
| Lodi | Ernits OÜ, registry code 16136983, registered address Kuremarja tee 13-1, Pärnamäe küla, 74020 Viimsi vald, Harju maakond, Estonia. An information society service provider that has developed and operates the Service |
| User | a natural person who has registered as a user of the Service and who uses the Service for managing digital business cards and professional contacts |
| Service | the Lodi mobile application and related services, a digital business card management system that enables Users to scan, store, organise, enrich, and share professional contact information |
| Privacy Policy | this privacy policy |
| Agreement | the Terms of Service governing the use of the Service by the User |
| GDPR | Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) |
2. DATA CONTROLLER
2.1. Pursuant to the GDPR, a controller is a natural or legal person which, alone or jointly with others, determines the purposes and means of the processing of personal data.
2.2. Lodi provides the Service to Data Subjects and processes the personal data of Data Subjects as the controller.
3. PERSONAL DATA PROCESSED
3.1. Lodi processes the following categories of personal data in connection with providing the Service:
| Account Data | First and last name, email address, user credentials, and optionally company name and job title |
| Business Card Images | Photographs of business cards captured via the device camera or imported from the photo library, which may contain names, job titles, contact details, addresses, QR codes, logos, and handwriting |
| Extracted Contact Details | Structured contact fields extracted from scanned business cards through OCR and AI processing, including raw OCR text and multilingual variants |
| My Card Profile Data | The User’s own shareable digital business card information, including name, job title, company, phone numbers, email addresses, and website addresses |
| Notes and Voice memos | Text notes attached to contacts, voice recordings, and their transcripts |
| Meeting Context Data | Event name, location, and date information associated with contacts |
| QR Code Sharing Data | Selected contacts for sharing, sharing preferences, and generated QR codes |
| Company Enrichment Data | Business information about companies associated with scanned cards, obtained from publicly available sources and licensed business-data providers (e.g., company description, industry, location, employee count) |
| AI-Generated Insights | Optional AI-generated outputs such as company summaries, suggested tags, lead categories, relevance suggestions, and follow-up drafts (can be toggled off in Settings) |
| Subscription and Payment Data | Subscription plan type, subscription status, and purchase confirmation received from the Apple App Store, Google Play, or Stripe (Lodi does not receive or store full payment card details) |
| Device Data | Device model, operating system and version, app version, language setting, time zone, IP address, crash logs, and push notification token |
| App Usage Data | In-app usage events, time spent in the application, features accessed, and other analytical data relating to the use of the Service |
3.2. Lodi primarily processes personal data that it receives directly from the Data Subject. Lodi may also collect certain personal data automatically when the Data Subject uses the Service (e.g., Device Data and App Usage Data). In certain cases, Lodi may obtain personal data about companies and contacts from third-party business-data providers.
3.3. Lodi may combine automatically collected personal data and personal data obtained from third-party sources with personal data provided directly by the Data Subject.
3.4. The provision of personal data to Lodi is voluntary. However, Lodi may not be able to provide the Service to the Data Subject if the Data Subject refuses to provide certain personal data. For example, Lodi cannot register the Data Subject as a User if the Data Subject does not provide their email address.
4. PROCESSING PURPOSES, DATA COMPOSITIONS, AND LEGAL BASES
| DATA CATEGORY | PURPOSE | LEGAL BASIS |
|---|---|---|
| Account Data | Registering a User account and creating a profile on the Service | Performance of a contract (GDPR Art. 6(1)(b)) |
| Providing the Service (authentication, contact management) | ||
| Communicating with the Data Subject regarding changes to the terms applicable on the Service | ||
| Contacting the Data Subject for support purposes | ||
| Business Card Images | Performing OCR text extraction and AI-powered contact field parsing | Performance of a contract (GDPR Art. 6(1)(b)) |
| Enabling the Data Subject to review and correct extracted information | ||
| Storing images for future reference by the Data Subject | ||
| Extracted Contract Detail | Providing the core contact management service | Performance of a contract (GDPR Art. 6(1)(b)) |
| Enabling search, edit, and organisation of contacts | ||
| Exporting contacts to the device address book (only upon explicit User action) | ||
| My Card Profile Data | Enabling the Data Subject to create and share their own digital business card | Performance of a contract (GDPR Art. 6(1)(b)) |
| Generating QR codes for contact sharing | ||
| Notes and Voice Memos | Storing text notes associated with contacts | Performance of a contract (GDPR Art. 6(1)(b)) |
| Recording and transcribing voice memos using AI-powered speech-to-text services | Consent for voice recording functionality (GDPR Art. 6(1)(a)) | |
| Meeting Context Data | Associating contacts with events, locations, and dates for improved organisation | Performance of a contract (GDPR Art. 6(1)(b)) |
| QR Code Sharing Data | Enabling the Data Subject to share selected contacts via QR code | Performance of a contract (GDPR Art. 6(1)(b)) |
| Generating QR codes scannable by any device | Consent (GDPR Art. 6(1)(a)) | |
| Company Enrichment Data | Providing company information associated with scanned business cards | Legitimate interest of Lodi (GDPR Art. 6(1)(f)) |
| Enriching contact records with publicly available business data | ||
| AI-Generated Insights | Generating optional company summaries, lead categories, relevance suggestions, and follow-up drafts (The Data Subject may disable this feature at any time in Settings) | Consent (GDPR Art. 6(1)(a)) |
| Subscription and Payment Data | Managing subscriptions and verifying purchase status | Performance of a contract (GDPR Art. 6(1)(b)) |
| Fulfilling obligations under applicable accounting and tax legislation | Legal obligation (GDPR Art. 6(1)(c)) | |
| Device Data | Improving the quality of the Service | Legitimate interest of Lodi (GDPR Art. 6(1)(f)) |
| Detecting and resolving errors and security issues | ||
| Ensuring Service compatibility | ||
| App Usage Data | Improving the quality of the Service and features offered | Legitimate interest of Lodi (GDPR Art. 6(1)(f)) |
| Analysing trends and usage patterns Detecting and resolving errors |
5. AUTOMATED DECISION OR PROFILING
5.1. An automated decision refers to a decision made solely by automated processing of a Data Subject’s personal data. This means the processing of personal data using, for example, software code or algorithms without requiring human intervention.
5.2. Lodi may use automated processing of personal data for the following purposes:
5.2.1. extracting contact information from business card images using OCR and artificial intelligence technologies;
5.2.2. translating non-English business card text into English;
5.2.3. generating optional AI insights, including company summaries, lead categories, and relevance suggestions;
5.2.4. transcribing voice memos using speech-to-text technology;
5.2.5. categorising contacts based on AI-generated tags and lead categories.
5.3. The automated processing described above is necessary for the performance of the obligations set out in the Agreement or is based on the Data Subject’s consent. Lodi does not make decisions that produce legal effects or similarly significant effects concerning any person based solely on automated processing.
5.4. If the Data Subject does not agree with an automated decision or output, the Data Subject has the right to request that Lodi review the output, to express their point of view regarding the output, and to contest the output.
6. MARKETING COMMUNICATIONS
6.1. In order to keep the Data Subject informed of the best features and offers available on the Service, Lodi may send the Data Subject marketing communications via email or push notifications regarding the Service and its features.
6.2. The Data Subject shall only receive marketing communications from Lodi if the Data Subject has given Lodi consent to process their personal data for the purpose described in this section.
6.3. If the Data Subject has given Lodi consent to receive marketing communications but no longer wishes to receive them, the Data Subject has the right to withdraw consent at any time, regardless of the reason, in accordance with Section 10 of this Privacy Policy.
7. DATA RETENTION
7.1. Lodi does not retain personal data longer than is necessary based on the purpose of processing or as required by applicable law. As a general rule, Lodi retains the Data Subject’s personal data for as long as the Data Subject has an active user account on the Service. Lodi considers the Data Subject’s account to be active until the Data Subject has deleted their account.
7.2. In addition to the above, Lodi applies the following retention period:
7.2.1. Account Data is retained for 3 years following the deletion of the Data Subject’s account;
7.2.2. Business Card Images are retained for as long as the related contact record exists; the Data Subject may choose to auto-delete card images after extraction via Settings; images are deleted when the related contact is deleted;
7.2.3. Extracted Contact Details, Notes, and AI-Generated Insights are retained until the Data Subject deletes them or deletes their account;
7.2.4. Voice Recordings are retained together with the related contact record and their transcripts until the Data Subject deletes the recording, the contact, or their account;
7.2.5. following account deletion, personal data is deleted within 90 days, except where applicable law requires longer retention;
7.2.6. Subscription and Payment Data and any other documents evidencing the payment of fees are retained for 7 years from the date of payment, in accordance with applicable accounting and tax legislation;
7.2.7. data related to disputes and investigations is retained until a resolution is achieved;
7.2.8. residual encrypted copies in backups are removed within the normal backup cycle of 30 days.
7.3. The Data Subject understands and agrees that uninstalling the Lodi application from their device does not result in the automatic deletion of their account and the personal data stored therein. To delete the user account, the Data Subject must submit a request to Lodi through the Service (Settings > Account > Delete Account) or by contacting Lodi by email.
8. DATA TRANSFERS TO THIRD PARTIES
8.1. In order to provide the Service, Lodi may share the Data Subject’s personal data with the following categories of third-party recipients:
8.1.1. AI and text-recognition service providers – cloud-based artificial intelligence providers used for business card parsing, contact field extraction, translation, voice memo transcription, and generation of AI insights. Lodi describes these providers by category rather than by vendor name, as the specific technology partners may change as the Service evolves;
8.1.2. Business-data and research providers – providers of publicly available and licensed business information used for company enrichment of contact records;
8.1.3. Cloud hosting and infrastructure providers – providers of database, file storage, authentication, and serverless computing services used to operate the Service;
8.1.4. App stores and payment processors – the Apple App Store, Google Play, Stripe, and subscription management platforms used for the distribution of the application and processing of purchases;
8.1.5. Analytics, crash-reporting, and communications providers – providers used to maintain Service reliability, analyse usage, and communicate with the Data Subject regarding their account;
8.1.6. Professional advisers and public authorities – legal, accounting, and other professional advisers, as well as public authorities, where required by law or necessary for the protection of Lodi’s rights.
8.2. Lodi does not share personal data with advertising networks. The Service does not display third-party advertising on any plan.
8.3. Certain service providers are located outside the European Economic Area (EEA), including in the United States of America and the People’s Republic of China. Where personal data is transferred outside the EEA, Lodi ensures that appropriate safeguards are in place, including the European Commission’s Standard Contractual Clauses and supplementary technical and organisational measures. A list of Lodi’s current sub-processors is available upon request at support@uplodi.com.
9. DATA SECURITY
9.1. Lodi has implemented appropriate organisational, physical, and technical security measures to protect the Data Subject’s personal data against any misuse, unauthorised access, disclosure, alteration, or destruction.
9.2. Access to the Data Subject’s personal data is restricted to authorised personnel only. Persons with access to personal data are bound by confidentiality obligations.
10. DATA SUBJECT RIGHTS
10.1. The Data Subject has all rights arising from applicable law in relation to the processing of their personal data, including the following rights:
10.1.1. right of access: the Data Subject has the right to enquire at any time whether Lodi holds personal data about them and to receive information about what personal data Lodi processes concerning the Data Subject;
10.1.2. right of rectification: the Data Subject has the right to request that Lodi correct or supplement their personal data if such data is inaccurate, incomplete, or incorrect;
10.1.3. right to object: the Data Subject has the right to object to the processing of their personal data, for example where the processing is based on the legitimate interest of Lodi;
10.1.4. right to erasure: the Data Subject has the right to request the deletion of their personal data, for example where the personal data is processed on the basis of consent and the Data Subject has withdrawn such consent;
10.1.5. right to restriction: the Data Subject has the right to request that Lodi restrict the processing of their personal data under applicable law, for example where Lodi no longer needs the Data Subject’s personal data for the processing purposes or where the Data Subject has objected to the processing;
10.1.6. right to withdraw consent: where the processing of personal data is based on the Data Subject’s consent, the Data Subject has the right to withdraw their consent at any time;
10.1.7. right to data portability: the Data Subject has the right to receive personal data that the Data Subject has provided to Lodi and that is processed on the basis of consent or for the performance of a contract, in a structured, commonly used, and machine-readable format, and, where technically feasible, to request that Lodi transmit such data to another service provider;
10.1.8. right to lodge a complaint: the Data Subject has the right to lodge a complaint with the Andmekaitse Inspektsioon (Data Protection Inspectorate) or with a court of competent jurisdiction.
10.2. The rights of the Data Subject set out in this section are not absolute rights. In certain cases, the rights of other Data Subjects or the legal obligations of Lodi may limit the Data Subject’s rights.
10.3. To exercise the rights related to the processing of personal data or to submit requests, the Data Subject should contact Lodi at support@uplodi.com. Lodi shall respond to any such request within one month of receipt.
11. CHANGES TO THE PRIVACY POLICY
11.1. Lodi has the right to unilaterally amend and/or supplement this Privacy Policy from time to time. Upon updating this Privacy Policy, Lodi shall notify the Data Subject of the new Privacy Policy via email or through the Service. Where the updated Privacy Policy introduces the processing of the Data Subject’s personal data for a new purpose that requires the Data Subject’s consent, Lodi shall not process the Data Subject’s personal data for such new purpose until Lodi has obtained the Data Subject’s consent for such processing.
12. CONTACT DETAILS
12.1. For questions or requests regarding the processing of personal data, please contact support@uplodi.com, or write to: Ernits OÜ, Kuremarja tee 131, Pärnamäe küla, 74020 Viimsi vald, Harju maakond, Estonia.
12.2. For complaints regarding the processing of personal data, we recommend first contacting Lodi. The Data Subject also has the right to address complaints to the Andmekaitse Inspektsioon (Data Protection Inspectorate) or to a court of competent jurisdiction.