Privacy Policy

1. Introduction

Maxhibit AI is a product of Deka Analytics, the company responsible for this service and the controller for the personal data described below. You can reach us at support@maxhibit.io, and our registered address is available on request.

Maxhibit AI ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our business networking and contact management platform.

2. Data Controller & Processor

If you require a Data Processing Addendum (DPA) for enterprise or compliance purposes, contact us at support@maxhibit.io

3. Information We Collect

Account Information

• Name, email address, phone number
• Business name and details
• Login credentials
• If you sign in with Google or Apple, the name and email address they share with us (Apple lets you hide your email using a private relay address, which we support)

Business Data

• Your organization and business profile details
• Digital business cards you create
• Team members you invite to your organization

Card Scanning & Mobile App

• Camera and photos — with your permission, to capture or select images of business cards you scan, and to add a profile or contact photo
• Contacts — with your permission, to import contacts you select, and (if you choose) to save a captured contact back to your device address book
• Scanned card details — the contact information (such as name, company, title, phone, email and address) extracted from business cards you scan
• Scanned card images are processed by an automated AI service to extract these details (see "Data Sharing" below)

Usage Data

• How you use our mobile apps: screens you open, features you use (for example scanning a card, sending a follow-up, sharing a QR code), and when
• Your account details linked to this usage: your user ID, name and email address, so we can see how the product is used per account and help you when you contact support
• Device information: device model, operating system and app version
• On our website: pages visited, browser type, device type and IP address
• QR code scans and engagement metrics on your digital card and business page
• We do not record your location from this data, and in the mobile apps we do not store your IP address with it

Card Engagement Data

• When someone views or saves your digital card, we collect minimal data (such as view counts and timestamps) to show you engagement analytics
• We do not collect personal information from people who view your card unless they choose to share it with you

Purchases

• AI-powered card scanning uses scan credits, which can be purchased as in-app purchases. When you buy credits, we and our purchase processor (RevenueCat) receive purchase and transaction data — the product purchased, transaction identifier, purchase date, and store (Apple or Google)
• A device or account identifier is used to attribute the purchase to your account and credit the correct organization
• We never receive or store your payment card details — payment is processed entirely by the Apple App Store or Google Play

4. Google Integrations (Gmail and Google Sheets) & Google User Data

If you choose to send email campaigns from Maxhibit AI, you can connect your own Google (Gmail) account. We request only send-only access (the gmail.send scope) so that the follow-up emails you write are sent from your own inbox.

What we access

• Permission to send email on your behalf — the gmail.send scope only
• The email address of the connected account, so you and your recipients can see who the message is from

What we do not do

• We do not read, download, or store your inbox, emails, drafts, or Gmail contacts
• We do not use your Gmail data for advertising, and we do not sell it or share it with third parties
• We do not use, transfer, or sell Gmail data to develop, improve, or train generalized or foundational machine-learning or AI models
• No one at Maxhibit AI reads your Gmail data — access is used solely to send the campaigns you compose
• You can disconnect the account at any time from the app, which revokes our access

Google Sheets

An admin of your business can connect a Google account so that the contacts your team captures are kept in a Google Sheet. We request only the drive.file scope, which lets Maxhibit AI create one spreadsheet in that account's Google Drive and work with that file only, plus the account's email address to show whose Drive it is in.

• We write your contacts, their notes and tasks to the spreadsheet Maxhibit AI created, and keep it up to date
• We cannot see, open or change any other file in your Google Drive
• We do not read back changes you make in the sheet; the sync is one way
• An admin can disconnect at any time from the app, which stops the sync and deletes our stored access to the account. You can also remove our access in your Google Account settings. The spreadsheet stays in your Drive

Maxhibit AI's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Legal Basis for Processing

We process your data based on:

You may withdraw consent for optional processing at any time by contacting us.

6. How We Use Your Information

• Provide Service — Create and share your digital card, scan business cards, and manage your contacts
• Analytics — Show you card views, engagement metrics, and network insights in your dashboard
• Improve Product — Understand usage patterns to build better features
• Communicate — Send service updates, respond to support requests
• Security — Detect and prevent fraud, abuse, or security issues

7. Data Sharing

We do NOT sell your data.

We may share data with:

Integrations your business connects

An admin of your business can connect Maxhibit AI to Zoho CRM, HubSpot, Google Sheets or a webhook. Nothing is sent until an admin connects one and chooses which events send their contacts. We send this data on your business's instruction, as its processor (see Section 2).

• What is sent: the contact’s details (such as name, company, job title, email, phone, address and website), the event, who captured the contact, notes (including voice-note transcripts and location links), tasks, the business-card images, and photos or files added to the contact
• Zoho CRM access: create leads, notes, tasks, campaigns, fields and files, and read your account’s settings, its users’ names and email addresses (to set the owner of each lead) and its field and layout settings. We cannot read your leads, contacts or deals
• HubSpot access: create and update contacts and contact properties, read the list of owners (to set the owner of each contact), and upload files. We do not read your contacts, and we never delete or archive anything
• Maxhibit AI only adds records. It updates a record it sent only when someone on your team presses Send changes, and it never deletes anything in your CRM
• What we store: the connection’s access tokens (encrypted), the connected account’s name and region, and the user and field names needed for owner and field mapping
• Once data reaches your CRM, Google Drive or webhook address, it is held by that service under your business’s own agreement with it, and its privacy policy applies
• An admin can disconnect at any time from the app. This stops sending and deletes our stored access; for Zoho CRM and HubSpot we also ask the provider to revoke it. Data already sent stays in your CRM or sheet until you remove it there

8. Data Security

We implement industry-standard security measures:

• Encrypted data transmission (HTTPS/TLS)
• Secure cloud infrastructure (AWS)
• Access controls and authentication
• Regular security reviews
• Employee access limited to need-to-know basis

Incident Response

In the event of a data breach that affects your personal data, we will:

• Investigate and contain the breach promptly
• Notify affected users as required by applicable law
• Report to relevant authorities where legally required
• Take steps to prevent future incidents

However, no system is 100% secure. We cannot guarantee absolute security of your data.

9. Data Retention

Upon account deletion, we remove your data within 30 days, except where retention is required by law (e.g., tax records).

10. Your Rights

You have the right to:

• Access — Request a copy of your data
• Correct — Update inaccurate information
• Delete — Request deletion of your account and data
• Export — Download your account and contact data
• Restrict — Limit how we process your data
• Object — Object to processing based on legitimate interests
• Withdraw consent — Opt out of marketing communications

To exercise these rights, contact us at support@maxhibit.io. We will respond within 30 days.

11. Cookies

We use essential cookies on the Maxhibit AI dashboard and website to:

• Keep you logged in
• Remember your preferences
• Ensure security

We do not use advertising or third-party tracking cookies.

The public digital card pages people view use minimal or no cookies.

12. Children's Privacy

Maxhibit AI is a B2B service not intended for children under 18. We do not knowingly collect data from children.

13. International Data Transfers

Your data may be processed in servers located outside your country. Primary hosting regions include India and AWS global regions. Product analytics data from our mobile apps is processed by PostHog in the United States.

By using Maxhibit AI, you consent to this transfer. We ensure appropriate safeguards are in place, including:

• Standard contractual clauses where applicable
• Data processing agreements with sub-processors

14. Regulatory Compliance

We comply with applicable data protection laws, including:

• Digital Personal Data Protection Act, 2023 — India
• Information Technology Act, 2000 — India
• General Data Protection Regulation (GDPR) — European Economic Area
• California Consumer Privacy Act (CCPA) — California, USA
• Privacy Act 1988 — Australia
• Personal Data Protection Acts — Singapore, Thailand, Malaysia

Where local laws provide additional rights, those rights apply to residents of that jurisdiction.

15. Region-Specific Rights

California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information we collect and how it's used
• Right to delete your personal information
• Right to opt-out of the sale of personal information
• Right to non-discrimination for exercising your rights

We do not sell personal information as defined by CCPA.

To exercise these rights, contact us at support@maxhibit.io or submit a request through your account settings.

European Economic Area (GDPR)

If you are in the EEA, we process your data in compliance with the General Data Protection Regulation (GDPR). In addition to the rights listed in Section 10, you have the right to:

• Lodge a complaint with your local supervisory authority
• Request data portability in a machine-readable format
• Object to automated decision-making and profiling

Our legal bases for processing are detailed in Section 5 above.

Australia (Privacy Act 1988)

If you are in Australia, we handle your personal information in accordance with the Australian Privacy Principles (APPs). You may contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au if you have concerns about how we handle your data.

Singapore, Thailand, Malaysia (PDPA)

We comply with applicable Personal Data Protection Acts in Southeast Asian jurisdictions. Your rights include access, correction, and withdrawal of consent as provided under local law.

16. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or in-app notification at least 15 days before they take effect. Continued use after changes constitutes acceptance.

17. Contact Us

For privacy-related questions, data requests, or legal inquiries:

Email: support@maxhibit.io