Privacy notice (draft — requires legal review)

This is a working draft prepared for development and must be reviewed by qualified counsel, including for India’s Digital Personal Data Protection Act, 2023, before commercial launch.

Roles

Exhibitors and organizers using Expo FollowUp decide why and how visitor contact data is processed (they are the data fiduciaries). Expo FollowUp processes that data on their behalf to provide the service.

What we process

Account data (name, email, password hash), business-card details captured at events, optional card images, consent records, follow-up messages and delivery status, notes, tasks and pipeline data entered by users.

Permission to communicate

A business card is not treated as permission for marketing messages. Automated follow-ups are only sent on channels where the exhibitor recorded the visitor’s permission, with its source and time. Every email includes an unsubscribe link; WhatsApp replies such as “STOP” are honoured immediately.

Processors

Depending on configuration: an email provider (e.g. Resend or an SMTP service), the WhatsApp Business Platform (Meta), and an OCR/vision provider for card reading. Card images sent for extraction may be processed outside India by that provider.

Retention and rights

Card images are deleted automatically after the retention period the exhibitor configures. Exhibitors can export their data and permanently erase a person’s data on request; opt-out records are kept so that person is not contacted again.

Contact

Questions: support@example.com