Privacy Policy

1. Who we are

B2BKing is an event lead capture service run by B2BKing. This policy explains what personal data we handle, why, and the choices you have. It follows the Digital Personal Data Protection Act, 2023 (DPDP Act) and other Indian law.

It covers two groups of people: businesses that use our dashboard ("clients"), and people who share their details on a client’s event page ("visitors").

2. Visitors: what happens to your details

When you scan an event’s QR code and share your details, they go to the business that runs that event page. That business decides how your details are used and is responsible for them (under the DPDP Act it is the "data fiduciary"). We store and process them only on its behalf.

• What we collect: the details you type or that are read from your business card (name, designation, company, email, phone, and anything else printed on the card), the card photo if you upload one, the time you submitted, and which event it was.
• Card photos are read automatically to fill in the form for you. A photo you upload but never submit is deleted within 24 hours.
• The business may send you SMS or emails about the event or its offers. Every email has an Unsubscribe link, and you can ask the business to stop messages at any time.
• Campaign emails can tell the business whether the email was opened and which links were clicked (through a small image and tracked links). Links in SMS are tracked in the same way.
• To count page visits, the event page keeps a random number in your browser tab. It contains no personal details.
• If you tick "Also create a free account for my company", we (the platform) use your name, company, designation, email, phone, website and city to set up that account and to email you a link to claim it. Our team may contact you about it. This is separate from the business you shared your details with, and only happens if you tick the box. Ignore the email and nothing more happens; ask us at any time to delete it.
• If you tick "Remember my details on this phone", your name, designation, company, email and phone are kept only in your phone’s browser (not on our servers) for up to 90 days. At the next stall you see them and choose whether to share them with that business; they are never sent without you pressing the button. Tap "Remove" on any event page, or clear your browser data, to delete them.

To see, correct or delete your details, contact the business that ran the event. You can also write to us at the contact details on our website and we will pass your request on or help directly.

3. Clients: what we collect and why

• Account details: your name, email, phone, company name, website and logo, used to run your account and contact you about it.
• Payment details: plan, amount, GST invoice details and payment references. Card and bank details are handled by our payment partner, never stored by us.
• Usage and security records: login times, IP addresses and device information, used to keep accounts safe and to investigate problems.

We send emails needed to run your account (verification, password reset, invoices, important changes). We do not sell personal data, and we do not use visitors’ details for our own marketing.

4. Service providers

We use trusted providers who process data only on our instructions:

• Hosting and file storage: our servers and a cloud storage service for card photos, posters and exports.
• Email delivery (Resend) and an Indian SMS provider registered for DLT.
• Payments: Razorpay.
• Card reading: our own reader on our servers; if it cannot read a card, the photo may be sent to Google Cloud Vision.
• Bot protection on event pages (Cloudflare Turnstile), when turned on.

Some of these providers may process data outside India, with safeguards and as the DPDP Act allows.

5. How long we keep data

• Client accounts and their contacts: while the account is open.
• 360 days after a paid plan ends without renewal, contacts locked above the Free limit are archived. They are no longer shown in the account and can be restored on request.
• Contacts a client deletes: their personal details are erased within 30 days.
• Card photos that were never submitted: deleted within 24 hours.
• Invoices and payment records: as long as tax law requires.
• Backups: kept for up to 30 days, then overwritten.

6. Security

All traffic uses HTTPS. Passwords are stored only as secure hashes. Card photos are stored privately and shown through links that expire after a few minutes. Each client can only ever see its own data. Our team uses two-step login, and every admin action is recorded in an audit log that cannot be changed.

7. Cookies

The dashboard uses only the cookies needed to keep you logged in. We do not use advertising cookies.

8. Your rights

Under the DPDP Act you can ask for a summary of your personal data, ask us to correct or erase it, withdraw consent, nominate someone to act for you, and raise a complaint. If you are not satisfied with our answer, you can approach the Data Protection Board of India.

Grievance contact: the contact details on our website. We reply as soon as we can, and within the time the law allows.

9. Children and changes

The service is meant for businesses and adult event visitors, not for children.

If we change this policy in a way that matters, we will update the date above and tell clients by email or in the dashboard.