CardScan is hosted on Hetzner servers in Germany. Your data never leaves the European Union. GDPR by design.
All communications use HTTPS/TLS. Your data at rest is also encrypted. No personal data in plain text.
We use Claude Vision (Anthropic) for OCR extraction only. Business card images are not retained after processing. Compliant with EU AI Act (limited risk).
You have full GDPR rights: access (Art. 15), deletion (Art. 17), portability (Art. 20).