Scannect Privacy Policy

This Policy applies to information EZDISPLAY collects and processes as the business or controller in operating the Service — for example, information about the account holder and how they use the Service.

The Service is a business-to-business tool. Our customers (typically an individual sales representative or their Organization) use the Service to enter and manage information about their own contacts, prospects, offices, visits, tasks, and pipeline ("Customer Data"). For that Customer Data, our customer is the business or controller and EZDISPLAY acts as a service provider or processor that processes Customer Data on the customer's behalf under our Terms of Service. If you are a contact of one of our customers and have questions about their use of your information, please contact that customer directly; we may also refer requests to them (see Section 17).

• Account & profile information. Name, work email, password (hashed), sender identity, business profile, signature, logo, phone, title, and workspace name.
• Subscription & transaction information (prospective). When paid plans are offered, we and our payment processor will collect plan selection, billing status, and limited transaction metadata. We do not store full payment-card numbers on our systems.
• Business-card & contact data. Card images you upload for scanning, extracted OCR/AI fields, and contact records you create, import, or edit.
• CRM activity. Offices, visits, notes, tasks, pipeline stages, templates, and related activity you record in the Service.
• Support & communications. Messages you send us, support tickets, and related metadata.
• Connected services. When you connect a third-party account such as Gmail or Outlook, tokens and limited profile metadata needed to operate the integration; connected-account credentials are stored encrypted.
• Usage & technical data. Log data, IP address, device, browser, timestamps, feature usage, error events, and similar diagnostics.
• AI inputs and outputs. The prompts, context, and Customer Data you submit to AI features, and the drafts and suggestions the Service returns.

The Service is not designed to collect, host, or process the following, and you agree not to submit them: patient records, protected health information (PHI), diagnoses, treatment information, prescriptions, laboratory or test results, insurance or patient-billing data, clinical images, Social Security numbers, driver's license or other government identifiers, full payment-card numbers, biometric identifiers, or information about children under 18. If you provide such information anyway, you do so at your own risk and in violation of our Terms of Service, and we may delete it.

• operate, maintain, and secure the Service and authenticate users;
• perform card scanning and OCR you request;
• organize your CRM records (contacts, offices, visits, tasks, pipeline);
• generate the AI drafts and suggestions you ask for;
• provide customer support and troubleshoot issues;
• detect, prevent, and respond to fraud, abuse, and security incidents;
• bill you and manage subscriptions (when paid plans are offered);
• measure usage, debug, and improve product quality and reliability;
• comply with legal obligations and enforce our Terms;
• produce aggregated or de-identified analytics that do not identify you or your contacts; and
• send permitted service and marketing communications, subject to your choices.

Where a legal basis is required, we process information to perform our contract with you, to pursue our legitimate business interests in operating and improving the Service (balanced against your rights and interests), to comply with legal obligations, and, where applicable, with your consent.

• Service providers. Vendors that host our infrastructure, provide database and storage services, deliver email and notifications, provide AI model inference, process payments, and support analytics, security, and customer support — bound by contractual confidentiality and data-protection obligations.
• Workspace administrators. Where an Organization administers a workspace or subscription, authorized administrators may have access to activity, usage, and configuration within that workspace.
• Directed third-party integrations. When you connect an integration, we share the data needed to operate it as directed by you.
• Legal & safety. To comply with law, valid legal process, or lawful government requests; to enforce our Terms; to protect the rights, property, and safety of EZDISPLAY, our users, or the public; and to detect or prevent fraud, abuse, or security incidents.
• Business transfers. In connection with a merger, acquisition, financing, reorganization, insolvency, or sale of assets, subject to customary safeguards.
• With your direction or consent. Any other disclosure you direct or authorize.

EZDISPLAY does not sell personal data for money and does not use Customer Data for third-party targeted advertising or cross-context behavioral advertising. If our practices change in the future, we will update this Policy and, where required, obtain consent or provide an opt-out.

The Service allows our customers to scan business cards and manage contact information about individuals who are not Service users ("Non-User Contacts"). Our customer is responsible for having a lawful basis to collect and process that information, providing any legally required notices, honoring opt-out and contact preferences, and maintaining the accuracy and timely deletion of those records.

If you are a Non-User Contact and have questions or requests about how your information is being used in the Service, please contact the customer that added you. You may also contact us at support@myscannect.com, and we will make reasonable efforts to route your request to the customer that controls the applicable workspace.

We retain information for as long as needed to provide the Service and for legitimate business, legal, tax, audit, and dispute-resolution purposes. When information is no longer needed, we delete or de-identify it in the ordinary course. Because we maintain backups and logs for reliability and security, residual copies may persist for a limited period after deletion.

We use administrative, technical, and organizational safeguards designed to protect information, including:

• authenticated access with hashed passwords and support for third-party sign-in;
• tenant isolation between workspaces;
• database row-level security policies enforcing tenant scoping;
• encryption in transit and encryption of sensitive connection credentials at rest;
• private storage buckets with time-limited signed URLs for uploaded assets;
• least-privilege administrative access and separation of the service-role key from user request paths;
• audit logging on sensitive tables and actions;
• server-side rate limits, usage metering, and abuse monitoring;
• routine backups and monitoring.

No system is perfectly secure and we cannot guarantee absolute security. You are responsible for safeguarding your credentials and your device.

If you become aware of unauthorized access, credential compromise, or a suspected vulnerability, please report it to support@myscannect.com. We investigate reports promptly and, where required by law, will notify affected users and authorities.

The Service uses cookies, session tokens, and browser storage (including local and session storage) that are strictly necessary for authentication, session management, security, preferences (such as theme), and core functionality. You can control cookies through your browser settings, but disabling them may break sign-in or other core features.

We may send you product updates, tips, and offers about the Service. You can unsubscribe at any time using the link in the email or by contacting support@myscannect.com. Transactional and account messages (security alerts, billing, and service notices) will continue even if you opt out of marketing.

Subject to applicable law, you may:

• access and correct your account information through Settings;
• request a copy or portable export of information we hold about you as an account holder;
• request deletion of your account and associated data;
• object to or restrict certain processing where applicable;
• withdraw consent where processing is based on consent;
• disconnect a linked integration through Settings; and
• close your account at any time.

To exercise a right that is not self-service, contact support@myscannect.com. We may need to verify your identity before responding. Requests that concern Customer Data controlled by another customer will be handled per Section 17.

If you are a Virginia resident, the Virginia Consumer Data Protection Act ("VCDPA") gives you certain rights, including to confirm whether we process your personal data; to access and obtain a copy; to correct inaccuracies; to request deletion; and to opt out of targeted advertising, sale of personal data, and certain profiling. Applicable statutory thresholds may affect whether the VCDPA formally applies to us, but we honor reasonable Virginia requests as a matter of practice.

Appeals. If we decline a request, you may appeal by emailing support@myscannect.com with the subject line "Privacy Request Appeal." We will respond within the time period required by law, and if we deny the appeal you may contact the Virginia Attorney General.

Residents of other U.S. states with comprehensive privacy laws (for example, California, Colorado, Connecticut, Utah, Texas, and others) may have similar rights to access, correct, delete, port, or opt out of certain processing. Send requests to support@myscannect.com. You may use an authorized agent where the law permits; we may verify the agent's authority and your identity.

Where information is Customer Data controlled by another customer (such as a business you were added to as a contact, or a workspace administered by your employer), that customer is generally responsible for responding to your privacy requests. If you contact us, we may route the request to the applicable customer and let you know.

The Service is a business product intended for users at least 18 years old. We do not knowingly collect personal information from children under 18. If you believe a child has provided us information, contact support@myscannect.com and we will take appropriate steps to delete it.

The Service is operated from the United States and information we process is stored and processed in the United States. By using the Service you understand that information will be processed in the United States, which may have data-protection rules different from those in your jurisdiction.

We may create and use de-identified or aggregated data — data that no longer identifies you or your contacts — for analytics, benchmarks, product improvement, and other lawful purposes. We commit to maintain and use de-identified data only in de-identified form and not to attempt to re-identify it, except as permitted by law.

We use automated processing to operate features such as OCR, AI drafting, ranking suggestions, and abuse detection. We do not use automated processing to make decisions that produce legal or similarly significant effects about you.

The Service may link to or interoperate with third-party sites and services that we do not control. Their privacy practices are governed by their own policies. We are not responsible for their content or practices.

We may update this Policy from time to time. If we make material changes, we will update the effective date above and, where appropriate, provide additional notice. Your continued use of the Service after the changes take effect constitutes acceptance.

EZDISPLAY LLC
Commonwealth of Virginia, United States
Email: support@myscannect.com