When someone hands you their business card at a trade show, they are placing a limited and specific trust in you: they are giving their details to you, so that you can call them back. They are not giving them to an app publisher, a data broker or a service they have never heard of. Photographing that card brings a third party into a two-way relationship — and the only question that matters is what that third party does with it.
It is a question that is coming up more and more. Among sales professionals, wariness about where contact data comes from and how it is handled has become a reflex: people ask where a list came from, who compiled it, and what the supplier keeps. The subject is no longer just for lawyers.
This article covers three practical points: what a scanned business card is in legal terms, how “free” apps really make money, and the five questions to ask before installing one. We finish with how we built Contiax, stating precisely what is kept and by whom — because that is exactly what we would want to be told.
A business card is personal data
Let us start by clearing up a stubborn misconception: “these are business contact details, so the GDPR does not apply”. That is wrong. The name, job title, direct line and personal work email of an identified person are personal data, whether or not the person shared them in a professional setting. A generic address such as info@company.com is not; the address p.martin@company.com is.
What does change is that business-to-business prospecting enjoys a more flexible regime than prospecting aimed at consumers: under French rules, you can send a message to a professional at their work address without prior consent, provided the message relates to their role, they know who you are and they can easily opt out. A business card handed over on a stand by a maintenance manager interested in your machines obviously ticks those boxes.
But that flexibility covers sending the message, not managing the list. As soon as you record these contacts, you become the controller of that processing: you must be able to say where they come from, what they are used for and how long you keep them, and know how to delete one if asked. This is not a big-company constraint: it is simply good record-keeping, and a well-kept CRM covers it naturally.
And that is where the choice of scanning tool stops being a practical detail. If the app your cards pass through keeps those contacts on its side, then part of the processing you are responsible for takes place with someone you do not control, under conditions you do not know, and which you will not be able to explain to the person who gave you their card.
The four ways to fund a “free” app
A service that does something useful and charges nothing must be funded somehow. There are only four models, and you can always tell which one applies by reading two pages.
1. The entry quota. Scanning is free up to five or ten cards, then you need a subscription. It is honest and transparent: the free tier is a demo. The only risk is finding out on the second day of the show, with your thirty-fifth card in hand.
2. Advertising. The service is funded by banner ads and, more often, by the trackers that come with them. Those trackers are not interested in the content of your cards but in your behaviour, which is resold as advertising profiles. This is the model behind the consent banner when you open the app.
3. Exploiting the data. The most problematic model in our case: the extracted contact details feed a commercial database that is resold or used for cold outreach. It is usually mentioned in the privacy policy, worded vaguely enough not to alarm anyone. This is the one you need to look for actively, because it concerns a third party's data — not yours.
4. The marketing budget. The publisher covers the cost to raise its profile, because it sells something else. This is the model of a tool offered free by a company whose business lies elsewhere — and it is ours, as we explain below. It can be checked by one simple sign: there is nothing to unlock, nothing to accept and nothing to create.
None of these models is moral or immoral in itself. The problem is never that a service makes money: it is that it makes money from data that was not entrusted to it. A user can agree to be the product; the maintenance manager whose card was scanned agreed to nothing at all.
The real journey of a card photo
To judge a tool, follow the photo. The journey is always the same: your phone, a server, a reading engine, then the record coming back. What differs from one tool to another is what is left behind at each step.
The table below says the same thing another way: who holds what, at the end.
| On your phone | On the Contiax server | At Mistral AI | |
|---|---|---|---|
| The photo of the card | Yes, if you keep it | Never written to disk | Deleted automatically, 30 days maximum |
| The extracted contact | Yes — it is yours | Nothing | Nothing |
| Your identity | Not applicable | No account, no name | Not applicable |
| Your browsing | Not applicable | No cookies, no trackers | Not applicable |
The five questions to ask before installing
These five questions can be answered in a few minutes for any tool on the market, and they are enough to make the call.
1. Do you need to create an account to scan? This is the most telling question. An account means a user base, so contacts stored on the publisher's side, so processing you no longer control. A tool that scans without sign-up cannot, by design, link your cards to you.
2. Is the image kept, and for how long? Look for an explicit answer with a stated time limit. A policy that talks about “the time needed for processing” without ever giving a figure is not an answer.
3. Are the extracted contacts stored on the service? A hosted address book is convenient — until the day you have to export it, or explain to someone where their details are. A tool that leaves contacts on the device spares you the whole question.
4. Is there a cookie banner? Its presence is not trivial: you only ask for consent when you are placing something. A page that shows no banner because it has nothing to ask you to accept is a strong signal, and an easy one to check.
5. Where is the reading done, and by whom? Text recognition is almost always outsourced to a specialist engine. Knowing which one, and in which country it operates, is part of what you will need to be able to explain if asked. A publisher that names its provider gives you the means to check; a publisher that stays vague leaves you carrying the responsibility alone.
How we built Contiax
We designed Contiax for the industrial companies we work with, and we started by asking ourselves these five questions. Here are the answers, straight.
Contiax is genuinely free. No limited trial, no credit card, no premium version to unlock, no account to create. And no advertising trade-off either: no cookies, no trackers, no third-party analytics. The page calls no other website — so there is no consent banner to click, because there is nothing to accept. Contiax does cost us something, little today and set to rise with the number of users: we treat it as a brand-awareness budget, the one that makes Indusiax and its software known — designed by an industrial company, for industrial companies. It is our own business card.
Our servers keep nothing. The image arrives, it is stripped of its metadata — including the GPS location, which most phones write into every photo — it is passed on for reading, then discarded. It is never written to our disks. And the contact that comes out of it only passes through: neither the image nor the contact details stay with us. Your contacts live on your phone, in your spreadsheet or in your CRM — in other words, with you.
Reading is entrusted to Mistral AI, a French company. That is a choice, not a convenience: card recognition is done by a European provider, not by an American tech giant. Processing happens in real time, at the moment of the scan, and uploaded images are deleted automatically, within a period ranging from immediately to thirty days at most — a short, capped retention period intended for abuse detection, after which nothing remains.
We would rather put it this way, with that time limit, than suggest an instant end-to-end disappearance: it is a verifiable figure, it is short, and it is better than a neat promise. The rest is in the Contiax legal pages, which fit on one page and take five minutes to read.
The right question is not “is it free?”, but “what is left, and with whom?”. Both answers fit on one line when the tool was designed for it.
Try it with a card lying on your desk. Nothing to install, nothing to create.
Open ContiaxWhat you remain responsible for
First, a word about the source, since it has changed. Many contact details no longer arrive on a card but in an email signature — which you can simply photograph on screen to create a record, exactly like a card. That changes nothing in what follows. Whether the details reach you on a card handed over on a stand or in a message sent to you, copying them into a list is still building a list, with the same obligations.
A tool that keeps nothing settles half the issue. The other half is yours, and rightly so: the contacts you record are your list, built for your purposes. Three habits are enough to keep it in order, and none of them requires a lawyer.
Record the source. “Met at trade show X, June 2026” in the contact record. That is the answer to the only question you will ever be asked: “how did you get my details?”. A CRM does this naturally if the field exists — we cover this in our article on data entry, where we show that the useful fields are the ones you can fill in in three seconds.
Make opting out easy. An unsubscribe link in your emails, and the ability to actually delete a contact when asked. It is a small thing, and it is what separates a list you manage from a list you merely put up with.
Do not keep what is no longer useful for ever. A trade show contact who has not replied in three years is not a dormant prospect, it is dead weight. Cleaning it up is as much a matter of compliance as of sales efficiency.
No scanner will do this for you: that discipline lives in the tool where the contacts land. That is the role of Stator-CRM, where every record carries its source, its history and its follow-up date — and it is also the approach we apply across our whole suite, whose rationale we explain in our article on data sovereignty.
For a practical comparison of the four families of tools against these criteria, see our comparison of business card scanning apps.
Does scanning a business card fall under the GDPR?
Yes. The name, job title, phone number and work email of an identified person are personal data, even in a business context. By recording them for your prospecting, you become the controller of that processing: you must be able to say where these contacts come from, what they are used for and how long you keep them, and be able to delete them on request.
Is a free business card scanning app safe?
That depends entirely on how it is funded. A free service makes money one way or another: a subscription beyond a quota, advertising, reselling data, or a marketing budget its publisher openly takes on. The safety test is not the advertised price but the answer to three questions: does the service keep the image, does it keep the extracted contacts, and does it require an account?
What happens to the photo of a business card scanned with Contiax?
It is received, stripped of its metadata including the GPS location, passed straight to Mistral AI's reading engine, then discarded. It is never written to Indusiax's disks. At Mistral AI, a French company, uploaded images are deleted automatically within thirty days at most. The extracted contact goes nowhere: it stays on your phone.
Is Contiax really free, with no strings attached?
Yes. There is no subscription, no credit card, no account to create and no paid version to unlock. Nor is there any advertising trade-off: no cookies, no trackers, no third-party analytics and no resale of data. Indusiax funds Contiax as a marketing budget: it is our business card for industrial companies.
A well-designed scanning tool should have nothing to hide, and should be summed up in three sentences: it does not keep the image, it does not keep the contact, it asks nothing of you. The rest — speed, convenience, reading quality — can be judged in thirty seconds, with a card lying on a desk. But trust has to be judged beforehand: on what you are told about the journey your data takes, and on how precisely you are told.