Privacy policy

Last update: 13/09/2026

This policy is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and describes how personal data of those who use ScanEron and those who visit the public pages generated by QR codes are processed.

1. Data controller

The data controller is ScanEron S.r.l., Via da compilare 1, 00000 Città (XX), Italia, VAT number IT12345678901, email support@scaneron.com.

For any requests regarding personal data, you can write to support@scaneron.com.

The data protection officer (DPO), if appointed, can be reached at the same address.

2. Roles: when we are controllers and when we are processors

We are controllers of the processing for the account data of registered users, for billing data, for technical and security logs of the platform.

We are processors on behalf of the registered user for any personal data contained in uploaded documents, for scanning statistics of their public pages, and for conversations with the AI assistant. In these cases, the controller is the user who created the QR, with whom we enter into an agreement upon request pursuant to art. 28 GDPR.

3. Data processed

  • Account data: first name, last name, email address, any business name, VAT number, phone, website, profile photo, password stored exclusively in encrypted form (bcrypt).
  • Uploaded content: manuals, documents, images, videos, texts, and FAQs, along with extracted text and automatically generated summaries.
  • Usage data of public pages: date and time of visit, type of device, browser, browser language, referring page. The IP address is not stored in clear: it is transformed into a non-reversible code (hash with secret key) used only to distinguish unique visitors of the day.
  • Conversations with the AI assistant: questions from visitors and generated responses.
  • Technical and security data: access logs, failed authentication attempts, application logs in case of error.

We do not use profiling cookies and do not carry out automated decision-making processes that produce legal effects on the data subjects.

4. Purposes and legal bases

  • Provision of the service (creation of QR codes, content management, AI assistant): execution of the contract — art. 6.1.b GDPR.
  • Platform security (prevention of abuse, protection from unauthorized access): legitimate interest — art. 6.1.f GDPR.
  • Aggregate usage statistics: legitimate interest of the QR controller to understand the use of their content — art. 6.1.f GDPR.
  • Tax, accounting, and legal compliance: legal obligation — art. 6.1.c GDPR.
  • Service communications (technical notices, periodic reports that can be activated and deactivated from the profile): execution of the contract and legitimate interest.
  • Promotional communications, if activated: free and revocable consent at any time — art. 6.1.a GDPR.

5. Suppliers and recipients

Data may be processed by suppliers acting as processors, appointed pursuant to art. 28 GDPR:

  • Aruba S.p.A. — hosting and data storage, with servers located in the European Union;
  • OpenAI — processing requests from the AI assistant, document reading, and summaries. Content sent via API is not used for training models; transfer to the United States is governed by the European Commission's standard contractual clauses and, where applicable, by the Data Privacy Framework;
  • any payment service providers and email sending services, solely for related purposes.

Data is not transferred or sold to third parties. They may be communicated to the judicial authority or other authorities when required by law.

6. Retention periods

  • Account data and uploaded content: for the entire duration of the relationship and until account deletion.
  • Scan statistics: 24 months, then automatically deleted.
  • Conversations with the AI assistant: 24 months.
  • Security logs and access attempts: 6 months.
  • Accounting and tax documents: 10 years, as required by law.

Upon account deletion, the QR codes, uploaded files, and associated statistics are permanently deleted.

7. Cookies and similar technologies

We only use technical cookies, which do not require consent under art. 122 of the Privacy Code:

  • session cookies, necessary to maintain access to the reserved area;
  • "remember me" cookies, to stay authenticated on the chosen device;
  • language preference cookies and light/dark theme cookies.

We do not use profiling cookies, third-party cookies for advertising purposes, or cross-site tracking tools. Embedded videos from YouTube are loaded in advanced privacy mode (domain youtube-nocookie.com) and set their own cookies only if the user starts playback.

8. Rights of the data subjects

You can exercise your rights under arts. 15-22 GDPR at any time:

  • access to data and obtaining a copy;
  • rectification of inaccurate data and completion of incomplete data;
  • deletion ("right to be forgotten");
  • restriction of processing;
  • data portability in a structured and readable format;
  • objection to processing based on legitimate interest;
  • withdrawal of consent, without prejudice to the lawfulness of prior processing.

Requests should be sent to support@scaneron.com and will be responded to within 30 days. You can also file a complaint with the Data Protection Authority (Piazza Venezia 11, 00187 Rome — www.garanteprivacy.it) or with the supervisory authority of your country of residence.

9. Security measures

We adopt technical and organizational measures appropriate to the risk: encrypted HTTPS connection, passwords protected with bcrypt algorithm, protection against repeated access attempts, anti-CSRF tokens on all operations, disabling code execution in uploaded file folders, saving IP addresses only in hash form, access to data limited to authorized personnel.

In case of a personal data breach that poses a risk to the rights and freedoms of data subjects, we will notify the Authority within 72 hours and, if necessary, communicate with the data subjects, pursuant to arts. 33 and 34 GDPR.

10. Data of visitors to public pages

Anyone scanning a QR code does not need to register and is not required to provide personal data.

If the visitor voluntarily enters personal data in the AI assistant chat, this data is stored along with the conversation and made visible to the QR holder. We encourage not to enter personal, health, or sensitive data in the chat.

The QR holder is responsible for the use of the information collected through their public page.

11. Minors

The service is not intended for minors under 16 years old and we do not knowingly collect their data. If you believe a minor has provided us with personal data, write to support@scaneron.com: we will proceed with deletion.

12. Changes to this notice

The notice may be updated to comply with regulatory changes or service modifications. The updated version is always published on this page with the corresponding date. Relevant changes are communicated via email to registered users.

Privacy · Terms