Privacy Policy
Last Updated: October 20, 2026
Effective Date: November 19, 2026
Arc Labs LLC uses your information to provide Rologram, help you manage business contacts, and keep the service secure. We do not sell personal information or use it for advertising tracking. This policy explains what we collect, how optional AI features process information, who receives it, and your rights and choices. It also covers shared card visitors, teams, and people whose information users collect.
1. Who we are and scope
Arc Labs LLC ("Arc Labs," "we," "our," or "us") provides Rologram. This policy applies to our iOS and Android apps, the web app and shared card pages at app.rologram.ai, and our marketing site at rologram.ai (together, the "service"). You can contact us at support@rologram.ai.
We are the controller of information about your account and your own business card, meaning we decide how and why that information is processed. When you collect other people's cards, you decide what to collect and we process it to provide the service. An organization is the controller of its team data; we process that data on its instructions. Sections 7 and 8 explain these relationships.
2. Information we collect
Information you provide
| Information | What it includes |
|---|---|
| Account | Your name, email address, account credentials, preferences, and settings. |
| Your business card | Name, title, company, email, phone number, address, website, photo, logo, and other details you choose to include. |
| Collected cards | Contact fields from cards you scan or enter, card photos, QR code data, collection dates, and sources. |
| Notes and voice notes | Notes you enter and transcripts created from dictated speech. Voice transcription happens only on your device; audio is never uploaded. A transcript saved as a note becomes part of your account content. |
| Follow-ups and tags | Follow-up text, drafts, reminders, contact stages, and tags you create or save. |
| Ideal customer profile (ICP) | The profile and criteria you enter to help organize and prioritize contacts. |
| Integrations | Information and access credentials needed for integrations you or your organization connect, including HubSpot and Salesforce authorization. |
| Imports, branding, and support | CSV headers and rows you import, organization branding inputs for templates, and information you send when asking for help. |
- Feedback: The message and optional category and rating you send through the in-app feedback form. Only if you leave "Include device details" on, your feedback also includes the app version and build, operating system version, device model, and language.
Apple Wallet pass: When you add your contact card to Apple Wallet, the card details you chose to share are sent to our servers to generate and digitally sign the pass. The pass lives in Apple Wallet on your device. We do not update, track, or revoke it. Apple's terms govern Wallet itself.
Information collected automatically
| Information | What it includes and why |
|---|---|
| Device and app information | Device model, operating system, app version, and technical information needed to operate and troubleshoot the service. |
| Network and delivery information | IP addresses used to deliver and protect the service, and push notification tokens used to deliver notifications. Shared card visitor records use a salted hash of the IP address, as described in Section 6. |
| Diagnostics | Error and diagnostic information used to investigate reliability and security issues. |
| Product usage | Feature interactions and activity recorded in our own database to operate and improve the service. We do not embed a third-party analytics or crash-reporting SDK. |
| Shared card views | A salted hash of the visitor's IP address, referrer, and time of the view, used for card view counts. |
Information from other sources
| Source | Information we receive |
|---|---|
| Public sources for contact enrichment | Information about people and companies from Wikipedia, SEC EDGAR, Crunchbase, NewsAPI, and Reddit when you request enrichment. |
| App Store and Google Play | Purchase and subscription status used to verify access to paid features. |
| Stripe | Organization billing and payment status. |
| Organization administrators | Membership information when an administrator adds you, and information shared with the team. |
| Other users and connected integrations | Contact information users collect about you, and data exchanged with HubSpot or Salesforce when an organization administrator connects those services. |
3. Artificial intelligence and automated features
AI features are optional and labeled in the app. Before a server AI feature runs, the app discloses that processing. The table below describes what each feature processes and where it happens. For server AI, our servers send the listed information through OpenRouter to a third-party model provider, which returns a result. Our servers currently operate in the United States; Section 12 explains international transfers.
| Feature | Information processed | Processor and location |
|---|---|---|
| AI OCR enhancement | Text recognized from a card image and the device's local interpretation of its fields. The card image itself is not sent to the AI model for this feature. | Arc Labs servers → OpenRouter → model provider. |
| Follow-up drafting | The contact's name, title, and company, your notes about the contact, and your name. | Arc Labs servers → OpenRouter → model provider. |
| Notes clean-up on your device | The dictated transcript. | Apple Intelligence through Foundation Models, on your device only. |
| Notes clean-up with server AI | The note text, only when your phone cannot run the on-device model and you have allowed server processing in Settings. Results are labeled "Enhanced with server AI." | Arc Labs servers → OpenRouter → model provider. |
| Voice transcription | Audio used to produce a transcript. | Apple Speech on your device only, including SpeechAnalyzer on supported iOS devices. Audio is never uploaded. |
| Tag suggestions | Contact fields and notes. | Arc Labs servers → OpenRouter → model provider. |
| Contact enrichment ("Find contact details") | Name, company, and email domain, with information retrieved from public sources to add context about the person or company. | Arc Labs servers → OpenRouter → model provider; our servers also query the public sources listed below. |
| AI card design | Your own card's name, title, and company for a style choice, plus any free-text design instructions you enter when improving a design. Contact lines are rendered by our code and are never sent to the model. | Arc Labs servers → OpenRouter → model provider for style selection; Arc Labs renders the images. |
| Organization card template generation | Organization branding inputs. | Arc Labs servers → OpenRouter → model provider. |
| CSV column mapping for web imports | CSV headers and sample rows. | Arc Labs servers → OpenRouter → model provider. |
| Lead intelligence: health score, priority, and ICP match | Collected card metadata, including interaction dates, contact stages, and your ICP profile. | Arc Labs servers only, using deterministic scoring rules rather than a large language model. |
We do not use your content or AI results to train or improve AI models. Our AI requests are routed through OpenRouter to third-party model providers under settings that exclude providers that would use request content for training; providers process the request only to return a result.
AI outputs may be inaccurate, incomplete, or misleading. Review them before relying on them, saving them, sharing them, or sending a drafted message. Saved results, such as notes or follow-up drafts, become account content; they are distinct from the AI request metadata described in Section 10.
Voice audio and on-device Apple Intelligence processing stay on the device and are governed by Apple's terms. This does not prevent a transcript you save as a note from syncing with your account or being sent to a server AI feature you choose.
To avoid optional AI processing, do not select the labeled AI features. For voice note clean-up, choose Settings → Voice notes → on-device only to prevent server processing. You can turn automated lead scoring off in Settings → Lead intelligence. Lead scores suggest which contacts may need attention or match your ICP criteria; they do not make decisions with legal or similarly significant effects about you or your contacts.
When you request contact enrichment, our servers query Wikipedia, SEC EDGAR, Crunchbase, NewsAPI, and Reddit. These queries use the contact's name, company, or email domain to find relevant public information. Public availability does not ensure accuracy or remove the person's privacy rights. Section 8 explains how people can request deletion of their details.
4. How we use information
We use feedback to understand problems, prioritize improvements, and reply when you have asked us to.
For EEA and UK users, the table identifies the legal bases we rely on when acting as controller. Where we act as a processor for an organization, we follow its instructions and the organization determines its legal basis. A contract with a Rologram user is not, by itself, a legal basis for processing another person's information.
| Purpose | Legal basis |
|---|---|
| Create and manage your account, store and sync cards, provide features you request, and respond to support requests | Performance of our contract with you. For information about other people, legitimate interests in providing contact management requested by users, subject to those people's rights. |
| Provide optional AI features other than server note clean-up | Performance of our contract when you request the feature; for contacts' information, legitimate interests in helping users organize and understand their business contacts, balanced against the contacts' privacy rights. |
| Process voice notes with server AI when on-device clean-up is unavailable | Consent through the server-processing choice in Settings. |
| Access the camera, selected photos, optional contact sync, microphone and on-device speech, or notifications | Consent through the relevant device permission or feature choice. |
| Show public cards, provide view counts, and support sharing and connected integrations | Performance of our contract with the card owner; legitimate interests in delivering shared pages and measuring their use. For team data, processing on the organization's instructions. |
| Verify purchases and manage subscriptions or organization billing | Performance of a contract and compliance with applicable financial recordkeeping obligations. |
| Maintain reliability and improve the service using diagnostics and product usage | Legitimate interests in identifying faults, understanding feature use, and improving usability. This does not include training AI models on your content or results. |
| Protect accounts and the service, investigate abuse, and enforce our terms | Legitimate interests in preventing fraud, unauthorized access, and misuse. |
| Send service, security, and policy notices | Performance of our contract, legitimate interests in keeping users informed, and legal obligations where applicable. |
| Send marketing communications if you opt in | Consent, which you can withdraw at any time. |
| Respond to lawful requests and meet legal duties | Compliance with a legal obligation. |
5. How we share information
We do not sell personal information, share it for cross-context behavioral advertising, or use advertising tracking.
Sub-processors and other service providers
The following providers support the service. We send information needed for the stated purpose. Some providers, including app stores and services you connect, also process information under their own terms and privacy policies. Our server connections originate in the United States; a provider's processing locations may vary by service or routing, as indicated below.
| Provider | Purpose and information involved | Location |
|---|---|---|
| Supabase | Hosting, database, authentication, storage, and server functions for account data, cards, images, notes, and other service records. | United States. |
| OpenRouter | Routes the AI feature data listed in Section 3 to third-party model providers, which process that data to return results. | United States for OpenRouter; model provider locations depend on routing. |
| Model providers routed through OpenRouter | Third-party model providers receive the AI feature data listed in Section 3 from OpenRouter and return a result; the provider used for a request depends on OpenRouter's routing under our settings that exclude providers that would store or train on request content. | Varies by provider; requests originate from our United States servers. |
| Apple | App Store purchases, push notifications, and on-device Speech, Intelligence, and CallKit Caller ID. Caller ID names are written only to the on-device call directory extension. | On your device for Speech, Intelligence, and Caller ID; Apple's service locations for purchases and push delivery. |
| Play Billing and purchase verification using purchase and subscription information. | Google's service locations; verification requests from our United States servers. | |
| Stripe | Organization billing and payment processing. | Stripe's service locations; connected to our United States service. |
| HubSpot | Contact and team data exchanged only when an organization administrator connects the integration through OAuth. | The connected organization's HubSpot service locations. |
| Salesforce | Contact and team data exchanged only when an organization administrator connects the integration through OAuth. | The connected organization's Salesforce service locations. |
| Wikipedia | Public information queries for requested contact and company enrichment. | Provider service locations; queries from our United States servers. |
| SEC EDGAR | Public company filing queries for requested enrichment. | United States. |
| Crunchbase | Public company information queries for requested enrichment. | Provider service locations; queries from our United States servers. |
| NewsAPI | Public news queries for requested contact and company enrichment. | Provider service locations; queries from our United States servers. |
| Public information queries for requested contact and company enrichment. | Provider service locations; queries from our United States servers. | |
| Microsoft Azure | Web hosting, including processing web requests and associated technical information. | Our United States hosting; provider service locations may vary. |
| Google Firebase | Web hosting where used, including processing web requests and associated technical information. This is not an embedded analytics or crash-reporting SDK. | Hosting locations depend on the deployment. |
Sharing you direct
We share information when you choose to publish or send your card, download or export data, connect an integration, or place cards and notes in a shared team pool. Recipients can retain copies you share with them. Section 6 describes public card pages, and Section 7 explains organization access.
Legal requests and business transfers
We may disclose information when required by law, in response to valid legal process, or when necessary to protect people's safety, investigate fraud or abuse, or protect our rights. If we undergo a merger, acquisition, financing, reorganization, or sale of assets, information may be disclosed or transferred as part of that transaction, subject to applicable privacy requirements.
6. Shared card pages and visitors
You do not need an account to visit a shared card page. For each view, we record a salted hash of the visitor's IP address, the referrer, and the time so the card owner can see view counts. A hashed IP address is not the same as removing all links to a visitor. We retain card-view analytics while the card exists.
A public card page displays the owner's name, title, company, and masked email address. Full contact details, including the unmasked email address, are available in the downloadable vCard. The card owner controls the page's visibility using the public toggle. Turning public visibility off does not recall copies someone has already downloaded or received.
Visitors can contact us about their information using the process in Section 9, even if they do not have a Rologram account.
7. Teams and organizations
Organization administrators can see cards in the shared team pool, team notes, member lists, audit logs, integrations, and exports. Organization API keys can authorize access to team data. Connecting HubSpot or Salesforce allows the data flows requested by the organization.
The organization is the controller of its team data, and Arc Labs processes that data on its instructions. A data processing agreement is available on request. Consult your organization's policies and administrator for information about its purposes, access rules, retention settings, and connected services.
If you leave an organization, contact its administrator about your membership and any team data you contributed. Leaving does not itself require the organization to delete its shared records, exports, or integration copies. Direct requests about organization-controlled data to the organization; you may also contact us, and we will assist it in handling the request.
8. People whose information you collect
When you scan, enter, import, or enrich someone else's contact details, you decide what information to collect. You are responsible for having a lawful basis, giving any required notices, respecting their requests, and using and sharing their information in accordance with applicable privacy laws. Collect only information you have the right to use.
We process collected cards, photos, notes, and related details to provide the service. Requested enrichment adds relevant public information from the sources named in Section 3. Review that information before using it, since it may be inaccurate or out of date.
If a Rologram user has collected information about you, you can contact support@rologram.ai with the subject Privacy Request to request access, correction, or deletion without creating an account. Provide enough detail for us to find the record and verify your identity. We honor requests to delete your details, subject to applicable legal requirements, and coordinate with the organization when it controls the record. Deleting a record in Rologram does not remove the original public source or copies held independently by recipients.
9. Your rights and choices
You can view and correct your account and card information in the service, delete individual collected cards, and request access, correction, or deletion by contacting us. To delete your account, use Settings → Delete account. To export your information, use Settings → Export and manage data. Retention periods and legal exceptions are explained in Section 10.
You control device permissions and optional features:
- Camera: Allow access when scanning cards or QR codes, or enter details manually. You can revoke access in device settings.
- Photos: Choose individual images through the photo picker; we do not require access to your entire photo library.
- Contacts: Contact sync is optional. Manage or revoke access in device settings.
- Microphone and speech: Voice transcription runs on your device only. Manage microphone and speech permissions in device settings.
- Notifications: Enable or disable notifications in device settings.
- Marketing: We do not send marketing communications without opt-in. You can withdraw that choice at any time by contacting us or using an unsubscribe option in a marketing message.
- AI and automated scores: Do not select optional AI features if you do not want their processing. Choose Settings → Voice notes → on-device only to prevent server note clean-up, and turn off Settings → Lead intelligence to disable automated lead scoring.
Email support@rologram.ai with the subject Privacy Request to exercise rights or ask for help. We respond within 30 days, subject to extensions allowed by applicable law. If an extension is needed, we will explain the reason and the additional time within the initial response period. Where the law requires a shorter deadline, we follow it.
We may ask for information reasonably needed to verify your identity and locate the relevant records. An authorized agent may submit a request on your behalf; we may require proof of authorization and, where permitted, confirmation from you. You do not need to create an account to make a request. If we cannot fulfill a request, we will explain why and describe any available appeal process. Sections 14 and 15 provide additional regional rights.
10. Data retention
| Information | Retention period |
|---|---|
| Account data, including cards, images, notes, and saved feature results | While your account remains active; deleted within 30 days after account deletion, subject to legal holds described below. |
| Feedback | Until you ask us to delete it or your account is deleted. |
| Backups | Deleted data may remain in backups for up to 90 days. |
| AI request metadata | 90 days for security and abuse review. Metadata includes hashes, sizes, model identifiers, and processing decisions, never request or response text. |
| Card-view analytics | For the life of the card. |
| Organization audit logs | According to the organization's retention settings. |
We may retain records longer when a legal obligation or legal hold requires it, such as required billing records or information needed to address a legal claim. Retention is limited to the information and period needed for that purpose. Saved notes or AI results follow account or team data retention; they are not stored as AI request logs.
11. Security
We use encryption in transit and at rest, row-level access controls, and least-privilege service keys to protect information and limit access. We do not keep AI request content in long-term request logs; only the metadata described in Section 10 is retained for security and abuse review. Content you save in your account remains subject to the account retention rules.
No system is perfectly secure. Keep your credentials confidential and contact us if you suspect unauthorized access. If a personal data breach requires notice, we will notify affected people and authorities as required by applicable law.
12. International transfers
Our hosted data is stored and processed in the United States, including information processed by our server AI features. On-device features remain on your device. Providers and connected services may also process information in their service locations, as described in Section 5. Privacy laws in these locations may differ from those where you live.
For transfers of EEA, UK, or Swiss personal data, we rely on the European Commission's Standard Contractual Clauses with our providers, the UK Addendum for UK transfers, and our own contractual safeguards, with applicable adaptations for Swiss data. These contractual protections are supplemented by encryption in transit and at rest, access restrictions, limiting the data sent for each feature, and limiting retention of AI request records to metadata. Contact us to request information about these safeguards or a copy of the relevant terms, with confidential information protected where necessary.
13. Children
Rologram is intended for people age 13 and older. In the EEA and UK, you must meet the age of digital consent in your country: 16 where the applicable law has not set a lower age, and never under 13 for Rologram.
We do not knowingly collect personal information from children below the applicable age. If you are a parent or guardian and believe a child has provided information contrary to this policy, contact support@rologram.ai so we can investigate and delete the information as appropriate.
14. US state privacy rights
Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and other states with comprehensive privacy laws may have additional rights, depending on the law that applies. This section supplements the rest of the policy, including for people whose information another user has collected.
Categories, sources, purposes, and disclosures
The following table maps the information in Section 2 to California Consumer Privacy Act categories, as amended by the California Privacy Rights Act (CPRA). Categories can overlap.
| Category | Information and sources | Purposes and recipients |
|---|---|---|
| Identifiers | Names, email addresses, account IDs, IP addresses or their salted hashes, and push tokens, from you, your device, users who collect your details, administrators, or public enrichment sources. | Account operation, contact management, sharing, delivery, and security; Supabase and relevant hosting, notification, AI, enrichment, or connected integration providers in Section 5. |
| Personal records | Contact information such as phone numbers and addresses, from you, collected cards, or connected sources. | Provide cards and contact management; Supabase and relevant AI or connected integration providers; recipients you direct. |
| Commercial information | Purchases, subscriptions, and organization billing records, from you, Apple, Google, or Stripe. | Billing and access to paid features; relevant payment, hosting, and database providers. |
| Internet or other electronic network activity | App interactions, diagnostics, referrers, and card-view times, from use of the service. | Operation, view counts, reliability, and security; hosting and database providers. |
| Visual information | Card photos, profile photos, and logos supplied by you or a user who collects a card. | Store and display cards and images; hosting and storage providers and recipients you direct. |
| Professional or employment information | Names, job titles, companies, and business contact details, from you, other users, administrators, integrations, or public sources. | Contact management, requested enrichment and other AI features, and team sharing; relevant providers and recipients described in Section 5. |
| Inferences | Lead health scores, priorities, and ICP matches derived from contacts' metadata and your ICP profile. | Suggest contact priorities; computed on Arc Labs servers and stored with service data. |
| Sensitive personal information | Account credentials supplied for authentication. | Sign-in and account security through our authentication provider. We use this information only to provide and secure the service. |
We do not collect precise geolocation. We receive IP addresses, which can indicate an approximate location. We do not collect voice audio on our servers or send it to a third party; transcription happens on your device, and saved transcripts are notes. We do not request sensitive personal information beyond account credentials; avoid adding sensitive details about yourself or others to cards or notes.
Section 2 identifies sources, Section 4 explains purposes, Section 5 lists disclosures to service providers and other recipients, and Section 10 gives retention periods. We do not sell personal information or share it for cross-context behavioral advertising, and we do not offer financial incentives for collecting, selling, or sharing it.
Exercising state rights
Subject to applicable law and exceptions, you may request access to or knowledge of personal information, including its sources, uses, and disclosures; a portable copy; correction; deletion; and limits on certain uses or disclosures of sensitive personal information. You may also opt out of sale, targeted advertising or cross-context behavioral advertising, and certain profiling. Our practices do not include sale or advertising sharing, and our use of credentials is limited to providing and securing your account.
We do not use automated decision-making technology to make decisions with legal or similarly significant effects about you. Lead scores are suggestions about contacts, and can be turned off as described in Section 3. Contact us to object to processing of information about you.
Use the request and authorized-agent process in Section 9. We will not discriminate against you for exercising privacy rights. If we deny a request, you may appeal by replying to our response or emailing support@rologram.ai with the subject Privacy Request — Appeal. We will review the decision and respond within the period required by your state's law, explain our decision, and provide information about contacting the relevant state authority if the appeal is denied.
We honor Global Privacy Control (GPC) signals on the web as requests to opt out of sale or advertising sharing, consistent with our practice of doing neither. You do not need an account to use GPC. Under California's "Shine the Light" law, California residents may ask about disclosure of their personal information for third parties' own direct marketing. We do not disclose personal information for those purposes; send related requests to the contact in Section 18.
15. EEA, UK, and Switzerland
Arc Labs LLC is the controller for information about your account and your own card as described in Section 1. Section 4 sets out our purposes and legal bases. For team data, your organization is the controller, and we process data on its instructions.
Subject to applicable law, you may request access, correction, erasure, restriction of processing, and portability. You may object to processing based on legitimate interests, including related profiling, and to direct marketing. You may withdraw consent at any time through the relevant setting or by contacting us; withdrawal does not affect the lawfulness of processing before withdrawal. If a feature requires the processing you decline, that feature may no longer work for you.
You may complain to a data protection supervisory authority in the EEA, including where you live or work or where you believe a violation occurred, to the UK Information Commissioner's Office, or to the Swiss Federal Data Protection and Information Commissioner, as applicable. You can also contact us using Section 9. Section 12 describes safeguards for international transfers.
16. Cookies and similar technologies
Our web service uses strictly necessary session cookies for sign-in and maintaining authenticated sessions. We do not use advertising cookies or advertising tracking. You can manage cookies in your browser; blocking necessary cookies may prevent sign-in or other account functions. Shared card view records are described in Section 6.
We honor Global Privacy Control signals as described in Section 14. Browser "Do Not Track" signals do not have a uniform standard, and we do not respond separately to them. Our no-sale and no-advertising-sharing practices apply whether or not either signal is enabled.
17. Changes to this policy
We may update this policy as the service or applicable requirements change. We will post the updated policy in the app and on the web and update the dates at the top. Where feasible, we will provide notice in the app and on the web at least 30 days before material changes take effect. If a change requires consent under applicable law, we will obtain it.
18. Contact
For questions about this policy or our handling of personal information, contact Arc Labs LLC at support@rologram.ai. For privacy requests, including requests from shared card visitors or people whose details another user collected, use the subject Privacy Request.