Privacy Policy

Effective Date: August 11, 2026
Last Updated: October 2, 2026

Service Data Controller: GeoTech B.V., Piet Mondriaanstraat 204, 1061 TT Amsterdam, Netherlands; KVK 84238445; VAT NL863143180B01
Contact: contact@geotech.one

GeoTech B.V. ("we", "us", "our") operates BusyTrip ("the Service"), a mobile-first scanning application that lets you photograph business cards, badges, and receipts, extract their data with AI, and save the results to selected Google Drive or compatible CRM destinations in your personal or team workspace. The privacy of your data — and it is your data, not ours — is a big deal to us. This policy explains what we collect, how we use it, who we share it with, and your rights.

1. Summary

• We collect the minimum needed to run the Service: your name, email, authentication records, subscription status, and usage counts.
• The documents you scan are processed to extract their data and are then saved to your selected personal or team destinations. Drive receives files and extracted results; a CRM receives the mapped fields and notes. Temporary server copies and scan history have the retention limits in Section 9.
• To extract data, the image is sent to a third-party vision AI provider (OpenRouter) for processing.
• We request Google's per-file drive.file permission, which covers files BusyTrip creates and files you explicitly open with or share with BusyTrip. It does not grant access to your entire Drive.
• We use AI to read your scans, but we do not make automated decisions about you (or about anyone whose details appear in your scans) that produce legal or similarly significant effects.
• We never sell your personal data, and we do not use your content or Google user data for advertising or to train AI models.

2. Information we collect

2.1 Information you provide

• Account information: your name and email address, collected when you register. Authentication (email/password and email verification) is handled through our authentication framework (Better Auth).

• Terms acceptance: When you register, we record the Terms version you accept and the date and time of acceptance, to document your agreement. We keep this record while your account exists and delete it with your account.

• Profile and team information: an optional profile photo, team names, membership roles, Finance access settings, invitation email addresses, and destination settings. Your name and profile image help team members identify who submitted a scan. Invitations are delivered by email and shown to the invited account in the app.

• CRM connection information: the server address, tool descriptions and schemas, field mappings, connection status, and encrypted API credential supplied by the connecting account or team owner. Credentials are used server-side and are not returned to team members.

• Billing information: payment is processed by Stripe. We never see or store your full card number. We receive limited billing metadata from Stripe, such as subscription status, plan, billing country, the last four digits and brand of your card, and transaction identifiers.

• Communications: messages you send us, including contact-form name, email, optional company, and message text. The marketing contact form uses Firebase to store the inquiry, Resend to notify our support inbox, and Google reCAPTCHA to prevent automated abuse.

• Bug reports and feedback: the message, optional reply email and picture you submit, page path, workspace/view label, browser and screen information, timezone, and report timestamps. URL query strings and fragments are removed. Picture metadata is stripped when the image is processed. Firebase stores the report and private picture; our private Slack support channel receives them so we can investigate and reply. We do not automatically capture your screen or attach your scans. Avoid including passwords, payment information, or unrelated personal data.

• Conversation audio: recordings or audio files you submit for transcription, temporary transcripts used to generate summaries, and the notes you choose to save. The conversation-recording disclosure below explains processing when this optional feature is enabled.

2.2 Information we generate

• Usage metadata: counts of scans performed, quota usage, timestamps, plan tier, and similar operational counters used to enforce free-tier limits and billing.
• Scan history: extracted contact or receipt fields, public links found during enrichment, your scan labels and notes, processing status, and references to the resulting Drive files or CRM records, retained for the period in Section 9.
• CRM delivery records: internal scan and destination identifiers, a payload hash, delivery status, remote record identifier, safe failure description, and timestamps. This ledger prevents duplicate writes and supports retries; it does not store the scan image or a copy of the mapped contact or receipt fields.
• Policy notices: the latest policy-update version acknowledged by your account and its acknowledgment time. Dismissing a notice is not consent to unrelated processing.
• Optional product analytics: if you consent, we record a limited allowlist of product actions using an internal account identifier. We do not send your name, email, scan contents, form contents, IP geolocation, or browser recordings to product analytics.
• Aggregate website counts: we count public page loads and broad referral channels without visitor identifiers, cookies, account links, or full referring URLs. These counts cannot identify unique visitors or follow a person between pages. Account-linked analytics remain optional.
• Technical/log data: IP address, device and browser type, and basic request logs, retained for security, abuse prevention, and debugging.
• Identifiers: internal user identifiers, session identifiers, and a Google account identifier used to associate your authorization with your account.

2.3 Google user data we access

When you connect Google Drive, we request the following scope for Drive access:

The public scanner uses drive.file for spreadsheet access rather than the broader Google Sheets scope. This permission covers spreadsheets BusyTrip creates and spreadsheets you explicitly open with or share with BusyTrip.

We do not request the broad "see and manage all your Drive files" scope (https://www.googleapis.com/auth/drive), nor any Gmail scope. The drive.file scope provides per-file access; it does not provide access to your entire Drive.

We also receive your basic Google profile information (name, email address, and Google account ID) through the OAuth sign-in/authorization flow, used to identify your account.

3. Limited Use disclosure (Google API Services User Data Policy)

BusyTrip's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

For data obtained through Google API scopes:

• We only use Google user data to provide and improve the user-facing features that are prominent in the Service (saving scans and receipt-log rows to the files and folders that BusyTrip creates in your Drive).
• We do not transfer or sell Google user data to third parties for advertising, retargeting, or any interest-based purpose.
• We do not use Google user data to train, develop, or improve generalized or non-personalized AI/ML models.
• We do not allow humans to read your Google user data, except (a) with your explicit prior consent (for example, to debug a problem you report), (b) where necessary for security purposes (such as investigating abuse), or (c) to comply with applicable law.

4. How scans are processed

1. You capture or upload an image/PDF in the app.
2. The image is transmitted to our backend and forwarded to our AI sub-processor, OpenRouter, which routes it to a vision language model that extracts structured data (fields and text) from the image.
3. The selected destinations determine where the result goes. Google Drive receives the original and extracted result in the configured app-created folder, with a receipt-log row where applicable. A configured CRM receives mapped extracted fields and notes; the current CRM connector does not upload the original scan image. More than one destination may receive a copy within the selected workspace.
4. Completed originals are removed from our server after filing. We temporarily retain failed or duplicate originals for retries and extracted scan history for review, subject to Section 9. Copies saved to a destination are controlled by that destination account or team and its provider's retention settings.

4.1 Team workspaces

In a team workspace, scans are saved to the selected destinations configured by the team owner. Current team members can see shared extracted contact fields, notes, project labels, and the contributor's name and profile image in BusyTrip. Only the owner and members with Finance access can see team receipt details or use team finance features. An Admin role alone does not grant Finance access. Personal workspaces remain separate. Team membership does not expose a member's personal scan history, original uploads, private Drive links, or connection credentials. Access to copies in Google Drive or the CRM depends on the destination's own sharing and access settings. Changing a BusyTrip role does not revoke separate access granted directly in those services.

We send the content needed for extraction and enrichment. Image-extraction and text-summary requests require OpenRouter endpoints with a zero-data-retention policy and deny provider data collection; they fail if no eligible endpoint is available. OpenRouter's policy allows temporary in-memory prompt caching. These inference restrictions do not apply to the separate web-search service described in Section 8.

About the AI, plainly: we use AI to read the images you upload and turn them into structured text. You can review and correct the results. We do not use automated processing to make any decision about you — or about anyone whose details appear in what you scan — that produces legal effects or similarly significantly affects anyone. Contact enrichment and summaries help organize your records; they are not eligibility assessments or decisions with legal or similarly significant effects.

4.2 Notion, monday.com, and custom CRM connections

For native Notion and monday.com connections, the connecting account or team owner authorizes BusyTrip with the provider, selects an existing database or board, and reviews the field mappings. For custom CRM connections, they provide an MCP server URL and an API key if required, then review the field mappings. Depending on that mapping, a delivery may send a name, company, title, email, phone, website, conversation notes, scanner attribution and timestamp, or receipt fields such as vendor, amount, tax, currency, date, category, and payment method. Only a separately configured receipt destination receives receipt data. We read back saved records to confirm delivery. If exact-email contact matching is configured, we query the CRM for matches and may append a note to an existing contact without replacing its existing contact fields. The CRM may return other matching fields while performing that lookup.

Connection tests use synthetic details, create a temporary record, verify its identity, and request its deletion. Successful tests do not appear in scan history. A failed or uncertain cleanup can leave a test record requiring review in the CRM. A provider's soft deletion, audit logs, and backups may retain a copy after its normal delete operation succeeds. Ordinary scan deliveries do not run the test cleanup tool.

A CRM selected and contracted by you or your organization is a recipient under that relationship; it is not automatically a BusyTrip sub-processor. Its hosting location, downstream providers, and access settings are determined by the CRM arrangement. Where we separately appoint a provider to process customer data on our behalf, our sub-processor obligations apply. Owners should choose a permitted destination and a key limited to the necessary boards and operations.

For Notion and monday.com connections, you authorize BusyTrip through the provider's sign-in and permission screen. We store encrypted access and refresh tokens, the selected database or board, and your field mapping. BusyTrip reads available destinations and their fields, verifies existing records, and sends mapped scan details and notes to the destination you enable. Removing the connection deletes the stored tokens and configuration from live BusyTrip storage; it does not delete records already saved there. You can also revoke access through the provider. These services are destinations you choose, under your account or organization's relationship with the provider.

4.3 Scan migration and notes edits

When you choose Move or Copy, BusyTrip reads the selected source records and delivers their extracted fields, notes, project labels, and original contributor attribution to the destination workspace and selected connections. Where an original is needed and still available, it may be retrieved from the source Drive and copied to the destination Drive. Target members gain access under that workspace's permissions. Copy leaves the source entry visible; Move hides it only after successful destination processing. Neither option deletes files or CRM records already delivered to the source's external services.

Matching contacts may receive appended notes without replacing existing contact fields. Receipts are matched by original scan identity rather than vendor and amount alone. Operational records retain source and target identifiers, the requesting user, selected scan identifiers, status, and delivery information to support safe retries. Failed or interrupted operations can retain temporary content needed for recovery for up to 30 days from the migration request, followed by scheduled cleanup. Cleanup removes migration payloads and temporary photos and disables retries of that expired request. Minimal operation identifiers and status remain to prevent accidental replay. Check the destination before starting a replacement migration; external and backup copies follow their own retention rules.

Editing saved notes updates the BusyTrip record and attempts supported updates to its connected destinations. Review the synchronization status: an edit does not guarantee that every independently copied or exported version is updated. The access and retention rules for the selected personal or team workspace continue to apply.

4.4 Business customer instructions

For business scan content processed solely on an organization's instructions, that organization is normally the controller and GeoTech B.V. acts as its processor under our Data Processing Agreement. GeoTech B.V. is controller for its own account, billing, security, and service-administration data. The actual roles depend on the processing, not just the account label. A customer's chosen destination does not give us permission to use scan content for another purpose.

4.5 Conversation recordings

Before recording or uploading a conversation, make sure everyone agrees to the recording and AI processing. BusyTrip sends the audio through OpenRouter to xAI's Grok speech service to transcribe it and distinguish voices. The transcript is then formatted as dictated notes or summarized through OpenRouter. Speaker labels distinguish voices within the recording; they do not identify people by voice. Review and correct the generated notes before saving.

If you acknowledged the voice notes notice in an older version of BusyTrip, we retain its version and acknowledgment date with your account until the account is deleted or the acknowledgment is replaced. Older versions may still request and save this acknowledgment to remember it across devices. The updated recording flow does not request or create this acknowledgment; recording or uploading audio does not create one. A notice acknowledgment is not acceptance of updated Terms or a record of other people's consent.

This optional feature is an exception to the zero-retention inference policy above: xAI may retain the audio and transcript for up to 30 days for abuse auditing. xAI states that it does not train on API inputs or outputs without explicit permission; we do not grant that permission. See xAI's API data policy. Text summarization continues to require zero-retention OpenRouter endpoints.

BusyTrip deletes its temporary audio after processing, failure, or cancellation and does not save the raw transcript as a recording history. Interrupted drafts expire after 24 hours and are removed by scheduled cleanup. Your device may retain a recording for retry until it is processed or discarded. Generated draft notes are temporary; notes you save become part of the selected personal or team contact and follow that record's retention and destination settings. Recovery backups may contain earlier temporary copies under their restricted retention schedule. Deleting BusyTrip's copy does not delete a provider's separately retained copy.

5. If someone scanned your business card or badge

When a BusyTrip user photographs a business card or event badge, the Service extracts the contact details printed on it - typically a name, employer, title, email address, and phone number - and may look up publicly available professional links (such as a company website or public profile) to complete the contact. To avoid repeating the same lookup, we cache company websites, descriptions, and industry labels for up to 90 days. This cache is not used to store people's contact details or personal profiles and is deleted with the account. The results are saved to the selected Google Drive or CRM destinations of the personal or team workspace. The destination account or organization controls those copies; team members can also access the shared details described in Section 4.1.

If your details appear in someone's scan or saved conversation notes:

• we process them for extraction and requested enrichment, and temporarily retain scan history under the limits in Section 9;
• we do not use them for any other purpose, do not build profiles of you, and make no decisions about you;
• the person or organization that scanned your card holds the resulting contact, much as if they had entered it into their own spreadsheet or CRM, and is responsible for its lawful use and any required notice to you.

You have the rights described in Section 10 — including access, rectification, and erasure of any data we still hold — and we will help you identify or reach the user who scanned you where we lawfully can. Contact contact@geotech.one.

6. How we use your information

• create and maintain your account and authenticate you (lawful basis: performance of a contract);
• run the scanning workflow — capture, AI-based extraction, and saving to authorized destinations (performance of a contract for service users; business scan content is processed on the customer's instructions as described in Section 4.4);
• process subscription payments and prevent payment fraud (performance of a contract; fraud prevention also serves our legitimate interest in operating safely);
• enforce free-tier quotas and measure usage (performance of a contract and our legitimate interest in preventing abuse of the free tier);
• send transactional emails such as verification, password resets, receipts, and renewal or cancellation confirmations (performance of a contract);
• secure the Service, prevent abuse, monitor availability, and debug problems using privacy-scrubbed operational telemetry (our legitimate interests in keeping the Service secure and working, and legal obligation where applicable);
• improve product flows using the limited optional analytics described above, only after your consent (consent);
• measure public website reach using aggregate page counts and broad referral channels without identifying visitors (our legitimate interest in understanding which information is useful);
• comply with legal and tax obligations, including invoice retention (legal obligation).

We do not use your scanned content or Google user data for advertising or for training AI models. If we ever wanted to process your data for a new purpose, we would tell you first and, where required, ask for your consent.

7. Data sharing and disclosure

We do not sell your personal data. We share data only with:

• Authorized team members and selected destinations, as described in Sections 4.1 and 4.2;
• Sub-processors listed in Section 8, who process data on our behalf under contract;
• Authorities or third parties where required by law, legal process, or to protect the rights, property, or safety of our users, the public, or us;
• A successor entity in connection with a merger, acquisition, or asset sale, subject to this Privacy Policy.

8. Sub-processors

Links to sub-processors' privacy policies: Google, Stripe, OpenRouter, Tavily, Resend, Sentry, PostHog, Better Stack, DigitalOcean, Cloudflare. Sentry and PostHog are configured to store project data in the European Union. OpenRouter routes inference to model-hosting providers subject to the restrictions in Section 4. Tavily may forward search terms to search-index providers. Its published policy permits using query data to improve its services unless a separate agreement restricts this; the inference restrictions in Section 4 do not extend to Tavily. We will keep this list current in this policy; if a change materially affects your data, we will tell you.

International transfers. Some sub-processors process data in the United States. Where a provider holds an active certification under the EU-U.S. Data Privacy Framework, we rely on the European Commission's adequacy decision for that transfer; in addition, or where a provider is not certified, we rely on Standard Contractual Clauses and supplementary measures. You can request a copy of the relevant safeguards at contact@geotech.one.

9. Data retention

Different copies have different retention rules. The periods below distinguish live BusyTrip storage, recovery backups, support records and copies delivered to your selected destinations. Deleting a scan, connection or account does not necessarily remove every copy. Shared team records, support reports and destination copies have the separate rules explained below.

• Bug reports and feedback: live Firebase reports and pictures are retained for up to 90 days, with deletion at the next scheduled cleanup. Pictures can remain recoverable for 7 days after deletion. Restricted Firebase report backups follow the recovery retention described below for contact-form inquiries. We process reports to provide support and improve reliability based on our legitimate interests.

• Slack support copies: copies follow our support workspace retention and may remain while needed to investigate or respond; deleting your BusyTrip account does not automatically remove a separately submitted support report. Contact us to request its removal.

• Feedback rate limits: hourly rate-limit identifiers use a rotating hash of the requesting IP address and are removed after two days at the next cleanup.

• Contact-form inquiries: website copies are removed after 90 days. Restricted Firebase recovery copies have a 30-day retention policy followed by 30 days of recoverable deletion, so an earlier copy may remain for up to 60 more days. Support correspondence in our inbox is kept while needed to resolve your request and meet any applicable recordkeeping obligation. We use these messages to respond to your inquiry, based on our legitimate interest in providing support or taking steps you request before a contract.

• Account data (name, email, identifiers): retained while your account is active, then deleted or anonymized on account deletion, subject to the narrow legal carve-outs below.

• Shared team history: copies of extracted contact and receipt details, labels, notes, and contributor attribution remain available to the team until the team is deleted. Removing a member, deleting their account, or deleting their individual scan history does not remove these shared copies. Team deletion removes the shared BusyTrip history, memberships, invitations, and destination settings; it does not delete files or records already saved to Google Drive or a CRM. Contact the team owner or our support address about a shared record that needs removal.

• CRM credentials and configuration: retained while the connection exists, including while paused. Removing the connection, deleting its owning personal account, or deleting the team removes these from live BusyTrip storage. For a custom API key, replacement overwrites the stored key; revoke the previous key at the CRM provider. Native Notion and monday.com accounts are reauthorized through the provider's sign-in flow. Recovery backups may retain earlier encrypted copies under their restricted retention schedule.

• CRM delivery records: removed by a daily cleanup after 30 days without delivery activity, so removal can take up to one additional day. BusyTrip refuses new CRM delivery attempts for scans more than 30 days old to avoid replay after ledger expiry. Unresolved setup-test records are retained with minimal identifiers and status until reviewed and resolved or the connection is removed, so an uncertain test cannot silently run again. They contain no original image or copied scan fields.

• Policy-notice acknowledgment: the latest version and acknowledgment time are retained while your account exists and removed with it.

• Billing and invoice records: retained as required by tax and accounting law (typically up to seven years). This carve-out covers billing records only — never your scan content or Google credentials.

• Usage metadata and operational logs: retained for up to 12 months, then deleted or aggregated.

• Optional product analytics: account-linked PostHog analytics use the EU project's configured retention and are deleted when you delete your account. Withdrawing analytics consent stops new account-linked events and, for a signed-in account, triggers a request to delete prior PostHog events (Section 10.3). Separate aggregate website counts have no account or visitor identifier and cannot be associated with an individual account.

• Error reports: Sentry error events follow the EU project's configured retention. This is a separate retention rule from the operational-log period above.

• Google user data / scan content: we do not retain your scanned files as a system of record. Completed scan originals are removed from our server after filing. Uploaded originals retained for failed or duplicate scans may remain for retry for up to 168 hours, then are removed automatically. Your individual extracted scan history, including contact or receipt fields, is retained for up to 30 days unless you delete the scan or your account sooner. A separate shared team history is retained until the team is deleted, as described above. An unsettled scan-usage operation can retain a minimal reconciliation record until settled, without the expired image, extracted fields, or notes. Captures queued offline on your device remain there until uploaded or removed; server retention periods begin after upload. Saved copies remain in your selected destinations and follow their retention and deletion behavior. Revoking our Google access (Section 10) stops further Google access; this does not revoke a separate CRM connection. Google OAuth tokens are deleted when you disconnect Drive or delete your account.

• Application recovery backups: the scan-retention periods above describe live application storage. Encrypted recovery backups can contain earlier copies and are held separately with restricted access. Recovery copies are used for recovery, not ordinary processing. If data is restored, applicable deletion instructions must be reapplied before it returns to ordinary service.

10. Your rights and choices

10.1 Revoking Google access

Disconnect Google Drive at any time in the app, or at https://myaccount.google.com/permissions. Revocation stops all further access to your Google data. Files already saved to your Drive remain yours and are unaffected.

10.2 Managing CRM access

Open the connection's Manage dialog to pause or remove it. For a custom CRM connection, you can replace its API key; a new successful test is required before deliveries can be enabled again. Reconnect native Notion and monday.com accounts through the provider's sign-in flow. Pause stops new deliveries and retains the encrypted credential; removal deletes the live connection, credential, and delivery ledger without deleting records already delivered to the destination. Also revoke BusyTrip's access at the provider or revoke the custom API key, as applicable, to end that authorization. A busy connection must finish its current operation before removal or replacement. Removing BusyTrip access does not erase the destination provider's records, audit logs, or backups.

10.3 Optional analytics

You can allow or reject optional product analytics from the Analytics settings page and change your choice at any time. Rejecting analytics stops new account-linked events immediately; for a signed-in account, we also request deletion of the account's prior PostHog events. Separate aggregate page counts contain no account or visitor identifier and cannot be associated with an individual account.

10.4 Account deletion

Delete your account from the app's settings, or by emailing contact@geotech.one. On deletion, we remove or anonymize your account data and usage metadata, subject to the retention carve-outs in Section 9. Deleting your account does not automatically delete records already saved in Google Drive or a CRM, or shared team history retained under Section 9. Contact the destination account or team owner to manage those copies. We assist with valid rights requests concerning customer data we process, including coordination with the responsible organization and recipients where required.

10.5 GDPR / data subject rights

If you are in the European Economic Area or the United Kingdom, you have the right to access your data, rectify inaccurate data, erase your data, restrict or object to processing, data portability, and to withdraw consent where processing is based on consent. To exercise these rights, contact contact@geotech.one. You also have the right to lodge a complaint with your data protection authority — in the Netherlands, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). GeoTech B.V. is established in the European Union and handles privacy requests directly at contact@geotech.one, so no separate EU representative is required. No separate UK representative has been appointed.

10.6 California / other US rights

Depending on your state, you may have rights to know, access, delete, and opt out of "sale" or "sharing" of personal information. We do not sell personal information. Contact contact@geotech.one.

We respond to verified requests within the timeframes required by applicable law (generally within 30 days).

11. Security

We use industry-standard safeguards including encryption in transit (TLS), encrypted storage of OAuth tokens and CRM API credentials, access controls, and least-privilege OAuth scopes. No system is perfectly secure; if we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as required by law.

12. Children's privacy

The Service is not directed to children under 16 (or the minimum age in your jurisdiction), and we do not knowingly collect their data. If you believe a child has provided us personal data, contact contact@geotech.one and we will delete it.

13. International users

We operate from the Netherlands and host the Service in the European Union. Your information may be processed in the United States and other countries where our sub-processors operate, with the safeguards described in Section 8.

14. Changes to this policy

We may update this Privacy Policy. If we change how we use Google user data, we will notify you and obtain your consent to the updated policy before applying the new use. Material changes will be announced via the app or email, and the "Last Updated" date will change.

15. Contact us

Questions or requests: contact@geotech.one GeoTech B.V., Piet Mondriaanstraat 204, 1061 TT Amsterdam, Netherlands; KVK 84238445; VAT NL863143180B01

Portions of this policy are adapted from the Basecamp open-source policies / CC BY 4.0, modified by GeoTech B.V.