Privacy policy

Last updated: 29/10/2026

This policy is provided pursuant to articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and describes how personal data of those using ScanEron and those visiting public pages generated by QR codes are processed.

1. Data controller

The data controller is Bertoncello Stefano, Via San Giuseppe, 24 — 36060 Romano d'Ezzelino (VI), Italia, email info@scaneron.com.

For any requests regarding personal data, you can write to info@scaneron.com.

The data protection officer (DPO), if appointed, can be reached at the same address.

2. Roles: when we are controllers and when we are processors

We are controllers of the processing for the data of registered users' accounts, for billing data, and for technical and security logs of the platform.

We are processors on behalf of the registered user for any personal data contained in uploaded documents, for scanning statistics of their public pages, and for conversations with the AI assistant. In these cases, the controller is the user who created the QR, with whom we enter into an agreement upon request pursuant to art. 28 GDPR.

3. Data processed

  • Account data: first name, last name, email address, any business name, phone, website, profile picture, password stored exclusively in encrypted form (bcrypt).
  • Uploaded content: documents, images, videos, texts, features, and FAQs — related to products, software, or services — along with extracted text, image descriptions, translations, and automatically generated summaries.
  • Preferences and notifications: profile language, communication preferences, notifications from the reserved area, and, if activated, subscription to browser alerts (technical identifier provided by the browser, not the device content).
  • Automatic analyses of your QR codes: themes of visitor questions, missing answers, and improvement suggestions generated by Eron based on the usage data of your QR codes.
  • Usage data of public pages: date and time of the visit, type of device, browser, browser language, referring page. The IP address is not stored in clear: it is transformed into a non-reversible code (hash with secret key) used only to distinguish unique visitors of the day.
  • Conversations with the AI assistant: visitor questions and generated responses.
  • Technical and security data: access logs, failed authentication attempts, application logs in case of error.

We do not use profiling cookies and do not carry out automated decision-making processes that produce legal effects on the data subjects. The artificial intelligence functions generate texts and suggestions that the User reviews before publishing them.

4. Purposes and legal bases

  • Service provision (creation of QR codes, content management, AI assistant): execution of the contract — art. 6.1.b GDPR.
  • Platform security (abuse prevention, protection from unauthorized access): legitimate interest — art. 6.1.f GDPR.
  • Aggregated usage statistics: legitimate interest of the QR holder to understand the use of their content — art. 6.1.f GDPR.
  • Tax, accounting, and legal obligations: legal obligation — art. 6.1.c GDPR.
  • Service communications (technical notices, periodic reports, notifications in the reserved area, and browser alerts, which can be activated and deactivated from the profile; always written in the language chosen in the profile): execution of the contract and legitimate interest. Browser alerts require your explicit consent and can be deactivated at any time.
  • Assistance functions for drafting (auto-completion, image descriptions, translations, error checking, Eron suggestions): execution of the contract — art. 6.1.b GDPR.
  • Promotional communications, if activated: free and revocable consent at any time — art. 6.1.a GDPR.

5. Suppliers and recipients

Data may be processed by suppliers acting as data processors, appointed pursuant to art. 28 GDPR:

  • Aruba S.p.A. — hosting and data storage, with servers located in the European Union;
  • OpenAI — processing requests from the AI assistant, reading documents and summaries, and voice reading of responses (text-to-speech). Content sent via API is not used for training models; transfer to the United States is governed by the European Commission's standard contractual clauses and, where applicable, by the Data Privacy Framework;
  • Deepgram — transcription of voice dictation (the microphone button in the chat). The recorded audio is transmitted only for transcription, is not stored by us, and is not used for training models; transfer to the United States is governed by the European Commission's standard contractual clauses;
  • YouTube (Google Ireland Ltd.) and Vimeo — playback of videos inserted by the QR holder. The video is NOT loaded upon opening the page: it only starts when the Visitor requests it by pressing the play button, and from that moment the video platform receives the IP address and browser data. YouTube is used in cookie-free mode (youtube-nocookie.com) and Vimeo with the no-tracking parameter;
  • any payment service providers and email senders, solely for related purposes.

Data is not transferred or sold to third parties. They may be communicated to the judicial authority or other authorities when required by law.

6. Retention periods

  • Account data and uploaded content: for the entire duration of the relationship and until the account is deleted.
  • Scan statistics: 24 months, then automatically deleted.
  • Conversations with the AI assistant: 24 months.
  • Notifications in the reserved area: until archived or deleted by the User; subscription to browser alerts until deactivated.
  • Security logs and access attempts: 6 months.
  • Accounting and tax documents: 10 years, as required by law.

Upon account deletion, the QR codes, uploaded files, and associated statistics are permanently deleted.

7. Cookies and similar technologies

We only use technical cookies, which do not require consent under art. 122 of the Privacy Code. To remember some conveniences (for example, theme, filters, and views), local browser storage may also be used, which is not sent to our servers:

  • session cookies, necessary to maintain access to the reserved area;
  • "remember me" cookies, to stay authenticated on the chosen device;
  • language preference cookies and light/dark theme cookies.

We do not use profiling cookies, third-party cookies for advertising purposes, or cross-site tracking tools. Videos embedded from YouTube are loaded in advanced privacy mode (youtube-nocookie.com) and set their own cookies only if the user starts playback.

8. Rights of data subjects

You can exercise at any time the rights provided for in arts. 15-22 GDPR:

  • access to data and obtaining a copy;
  • rectification of inaccurate data and completion of incomplete data;
  • deletion ("right to be forgotten");
  • restriction of processing;
  • data portability in a structured and readable format;
  • objection to processing based on legitimate interest;
  • withdrawal of consent, without prejudice to the lawfulness of the processing carried out before.

Requests should be sent to info@scaneron.com and will be responded to within 30 days. You can also file a complaint with the Data Protection Authority (Piazza Venezia 11, 00187 Rome — www.garanteprivacy.it) or with the supervisory authority of your country of residence.

9. Security measures

We adopt technical and organizational measures appropriate to the risk: encrypted HTTPS connection, passwords protected with bcrypt algorithm, protection against repeated access attempts, anti-CSRF tokens on all operations, disabling code execution in uploaded file folders, saving IP addresses only in hash form, access to data limited to authorized personnel.

In case of a personal data breach that poses a risk to the rights and freedoms of the data subjects, we will notify the Authority within 72 hours and, if necessary, communicate with the data subjects, pursuant to Articles 33 and 34 GDPR.

10. Data of visitors to public pages

Those who scan a QR code do not need to register and are not required to provide personal data.

If the visitor voluntarily enters personal data in the AI assistant chat, this data is stored along with the conversation and made visible to the QR holder. We encourage not to enter personal, health, or sensitive data in the chat.

The QR holder is responsible for the use of the information collected through their public page.

11. Minors

The service is not intended for minors under 16 years of age and we do not knowingly collect their data. If you believe a minor has provided us with personal data, please write to info@scaneron.com: we will proceed with deletion.

12. Changes to this notice

The notice may be updated to comply with regulatory changes or service modifications. The updated version is always published on this page with the corresponding date. Relevant changes are communicated via email to registered users.

Privacy · Terms