Privacy Policy

Owner and Data Controller

In short

• The Owner operates no server that receives the User's documents. They are stored on the User's device and, with iCloud sync or automatic backups on (both are on by default), in the User's own iCloud storage, operated by Apple, to which the Owner has no access. Turning sync off does not stop backups: they are a separate setting.
• The text of the documents is recognised on the device. Names, summaries, tags, folder descriptions, the correction of the recognised text and the data shown as cards are produced by Apple's language models, on the device or through Apple's Private Cloud Compute. The private connection is on by default where available; the User can switch to On iPhone only in the Application's settings.
• No account. No advertising, analytics or tracking software. No cookies.

Types of Data collected

Among the types of Personal Data that this Application processes, by itself or through third parties, there are: the documents the User scans or imports (camera images of the pages, PDF files and images) and anything they contain; the text recognised in them; what is derived from that text (a suggested name and folder, the document's date, a summary, suggested tags, a correction of reading errors, and data such as amounts, deadlines, reference numbers and contacts); a short description of each folder, derived from the summaries of its documents; the names and tags the User gives to documents and folders; the signature and initials the User draws or types; preferences and settings; the names and iCloud identities of the people a folder is shared with, as provided by Apple; device information; application diagnostics; the content of the messages the User sends to the Owner, together with the User's email address; and Usage Data recorded in the website's server logs.

Documents can contain any kind of information, including data of third parties and special categories of data (for example a medical report). The Application treats every document the same way, as described below, and never sends one to the Owner. Users are responsible for the third-party Personal Data contained in the documents they store or share, and confirm that they are entitled to do so.

Unless specified otherwise, the Data described here is needed for the function that uses it; the User can always decide not to scan, import or share a document.

Mode and place of processing the Data

Methods of processing

The Owner takes appropriate security measures to prevent unauthorised access, disclosure, modification, or unauthorised destruction of the Data. The Data is processed using IT tools, following procedures strictly related to the purposes indicated. Apart from the Owner, the Data may be accessible only to the external parties named in this document, acting where necessary as Data Processors.

Place

The Data is processed on the User's device, in the User's own iCloud account, on Apple's Private Cloud Compute unless the User chooses On iPhone only, and, for the messages the User sends and the website's traffic and logs, at the Owner's offices and at the providers named below. Depending on the User's location, this may involve a transfer of Data to a country other than their own, including the United States. For Users in the European Economic Area, the United Kingdom and Switzerland, Apple's services are provided by Apple Distribution International Limited (Ireland), which, according to Apple, transfers data outside these regions under Standard Contractual Clauses. The sections below name the safeguards the other providers rely on.

Retention time

Documents, their text and their analysis stay on the User's device and in the User's iCloud storage until the User deletes them. Automatic backups run daily by default and the last 3 are kept, or the frequency and number the User sets; manual backups are never deleted automatically. A deleted document stays in existing backups until they are removed: automatic ones as they rotate out, manual ones when the User deletes them. The technical log on the device rotates at a fixed size, keeping the most recent entries. Emails sent to the Owner are kept for as long as needed to handle the request and any follow-up. Website logs are deleted once they are no longer needed for security and troubleshooting.

The purposes of processing

• Scanning and importing documents and storing them as PDF files, organised in folders;
• Recognising the text of the documents, to let the User read and search it;
• Suggesting a name, a folder, a date and tags for a document, writing a short summary, showing its data as cards, and describing what each folder holds;
• Syncing the User's documents across the User's devices and sharing a folder with the people the User invites, through the User's iCloud account;
• Creating backups in the User's own storage;
• Answering the User's emails and investigating the problems the User reports;
• Operating the website paginascan.com;
• Complying with applicable laws (legal basis: legal obligation).

The Owner takes no decision based solely on automated processing that produces legal or similarly significant effects on the User. The language models only suggest; the User decides.

Detailed information on the processing of Personal Data

Camera and imported files

If the User grants access, the Application uses the camera only while the User frames a page, through Apple's document scanner (VisionKit). The User can also import PDF files and images chosen in the Files app; the Application reads only the files the User picks. Each document is saved as one PDF on the device.

Personal Data processed: images of the pages; the imported files; anything visible in them.

Legal basis: performance of the service requested by the User.

Place of processing: User's device.

Text recognition and analysis

The text of each document is recognised on the device with Apple's Vision framework. To suggest a name, a folder and a date, write a summary and find the data shown as cards, the Application gives the recognised text (the first pages of a new scan; when a document is analysed again, its text up to a size limit), together with the names and descriptions of the User's folders for a new scan, to one of Apple's language models (Foundation Models), according to the setting in the Application's settings. The private connection is the default:

• On iPhone only: the model runs on the device and nothing leaves it.
• Private connection (where available, from iOS 27): the request is processed by Apple's Private Cloud Compute, which, according to Apple, uses the data only to answer the request, does not store it, and makes it inaccessible to anyone, Apple and the Owner included. When it is not available, or the User's daily allowance is used up, the device's own model is used instead.

With the private connection, after the text is recognised, the recognised text, up to a size limit, is also given to Private Cloud Compute to correct its reading errors. To describe a folder, the model receives the folder's name, its current description and the summary of the one document just added or removed. On iPhone only, these run on the device, except the correction, which is not performed.

The recognised text and the analysis are stored with the document and travel with it like the rest of the document. The Owner never receives them.

Personal Data processed: the text of the documents; the names and descriptions of the User's folders; the summaries of the documents; the results of the analysis.

Legal basis: performance of the service requested by the User.

Place of processing: User's device; for the private connection, Apple's Private Cloud Compute (see Apple's description and Apple's privacy policy).

Adding a date to the Calendar

From a card showing a date, the User can open the system's event editor, pre-filled with the document's name and that date. The editor is operated by iOS: the Application does not ask for access to the Calendar and receives nothing back from it.

Search and Spotlight

To search the documents, the Application keeps an index of their names, tags, folders and recognised text on the device. It is derived from the documents, is never synced and is not included in backups. If the User turns on Spotlight in the Application's settings (it is off by default), the names, tags, summaries and recognised text of the documents are also added to the system's search index on that device, managed by iOS, so that they can be found from the system search. Turning it off removes them.

Personal Data processed: the names, tags and summaries of the documents and their recognised text.

Legal basis: performance of the service requested by the User; for Spotlight, the User's choice.

Place of processing: User's device.

Signature

The User can save one or more signatures in the Application's settings, each with a name the User chooses and made of a signature and initials drawn with a finger or Apple Pencil (the initials can also be typed), and place them on the pages of a document. Placed signatures are kept with the document, can be moved or removed in the Application, and are printed into the PDF only when the User shares it. This is a handwritten-style image, not a digital or qualified electronic signature. Signatures placed on a document travel with it like the rest of the document, including to the people a folder is shared with. The saved signatures are stored on the device and are never part of a shared folder. Only if the User turns on "Save in iCloud and Backups" in the Signature settings (it is off by default) are they also stored in the User's private iCloud database, with iCloud sync on, and included in the Application's backups. Turning it off removes them from the private iCloud database while sync is on; backups made earlier keep them until those backups are removed. They stay on the device.

Personal Data processed: the names of the saved signatures, the drawings of the signatures and initials, the typed initials, and where new ones are placed on a page and how far from its edges.

Legal basis: performance of the service requested by the User; for iCloud and backups, the User's choice.

Place of processing: User's device; with the User's choice, the User's private iCloud database and backups.

Advanced statistics

The Application counts, for each document, how much work the language models did on it: the number of requests and of tokens read and written, split by step and by whether the work ran on the device or through Private Cloud Compute, along with a daily and an overall total. The counts are kept on the device, are never synced and are not included in backups. They are shown only if the User turns on Advanced Statistics in the Application's settings (it is off by default). The counts also appear, with no document content, in the technical log described below.

Personal Data processed: usage counts, with no document content.

Legal basis: performance of the service requested by the User.

Place of processing: User's device.

Data storage and iCloud sync

Documents, folders, their text and analysis, and the User's preferences are stored on the device. With iCloud sync on (it is on by default, and can be turned off in the Application's settings), they are also stored in the User's private iCloud database, managed by Apple Inc., so that they are available on the User's other devices. Apple's notification service tells the Application when something has changed; these notifications carry no document content. Turning sync off does not delete what is already in iCloud. The Owner has no access to this content.

If the User has iCloud Backup on, iOS includes the Application's data in the backup of the device, whatever the Application's own settings.

Personal Data processed: the documents and everything listed above.

Legal basis: performance of the service requested by the User.

Place of processing: User's device; with iCloud sync on, Apple's data centres.

Folder sharing

The User may share a folder with other people through iCloud. Its documents, with their text and analysis, then become visible to the participants the User invites and, if the User grants editing rights, can be changed or added to by them. Documents in a shared folder are stored in the iCloud account of the person who shared it. The User can stop sharing at any time, and a participant can leave at any time. Copies a participant saved to their own folders stay with them after sharing ends.

Personal Data processed: the shared folder's documents; the names and iCloud identities of the owner and the participants, as provided by Apple.

Legal basis: performance of the service requested by the User.

Place of processing: the iCloud accounts of the owner and the participants, managed by Apple Inc.

Backups

Backups, automatic or manual, are saved as files in the User's own storage: in the User's iCloud Drive where available, otherwise on the device. They contain the documents, their text and analysis, and the User's settings. Automatic backups are on by default, run whether iCloud sync is on or off, and can be changed in the Application's settings. The Owner has no access to them.

Personal Data processed: the documents and everything listed above.

Legal basis: performance of the service requested by the User.

Place of processing: User's device; the User's iCloud Drive, managed by Apple Inc.

Crash reporting and diagnostics

On the App Store, crash logs reach the Owner only if the User has chosen to share them with app developers in the device's privacy settings. In TestFlight, Apple gives the Owner crash reports, the feedback and screenshots the tester sends, and the tester's name and email.

The Application also keeps a technical log on the device, limited in size, which records what the Application did. It leaves the device only when the User attaches it to an email to the Owner or exports it from the Application's settings, and each time the User chooses what it contains. Its technical categories, included by default, contain times, counts, sizes, states, errors, internal identifiers, purchase status, the Application version, the device model, the iOS version and the locale, and never the text or the names of the User's documents. Two further categories are included only if the User turns them on for that email or export: Document Text (text recognised in the User's documents, such as names, addresses, tax codes, amounts or account numbers) and Document Names (the names of the User's documents and folders). At present the Application writes nothing to these two categories.

Personal Data processed: device model; OS version; diagnostic information; the contents of the technical log described above.

Legal basis: legitimate interest of the Owner in finding and fixing errors; for the technical log, the User's choice to send it and, for its two personal categories, the User's consent, given for each email or export.

Place of processing: Apple; for the technical log, the User's device and, if sent, the Owner's email service.

Purchases

Purchases of PaginaScan Pro are processed by Apple through the App Store. The Owner receives no payment details and no Personal Data of the buyer, only aggregate sales and download reports from Apple, including how many downloads came from links on the website. The Application checks with Apple, on the device, which purchases the User's Apple Account holds.

Legal basis: performance of the service requested by the User.

Place of processing: Apple.

Contacting the Owner by email

The User can write to the Owner by email, also from the Application (Settings, Support, Help & Feedback, or by shaking the device), which prepares a message in the User's own email app. Nothing is sent until the User sends it. A bug report includes the Application version, the iOS version and the device model, and the User may choose to attach the technical log described above.

Personal Data processed: email address; the name set in the User's email account; the content of the message and of any attachment; for a bug report, Application version, iOS version and device model.

Legal basis: performance of the service requested by the User and legitimate interest of the Owner in answering the messages it receives.

Place of processing: Italy and the locations of the Owner's email provider, Google (Gmail), which may include the United States on the basis of the EU-U.S. Data Privacy Framework.

Website

The website paginascan.com is a static site. It sets no cookies and runs no analytics. Every request passes through Cloudflare, Inc., which protects and delivers the site, and then reaches the Owner's server. On pages that show an email address, Cloudflare adds a small script that protects it from automated collection.

Like any web server, the server records each request in a log (IP address, date and time, page requested, response code, browser user agent), used only for security and troubleshooting. The site is hosted on a server rented from DigitalOcean, LLC, which acts as a Data Processor. Cloudflare also acts as a Data Processor: it processes visitors' IP addresses and requests, may receive network error reports from their browsers, and is the domain's registrar.

Personal Data processed: Usage Data (IP address, date and time, page requested, browser user agent).

Legal basis: legitimate interest of the Owner in operating a secure website.

Place of processing: Cloudflare's network and the data centre of the hosting provider; where data is transferred to the United States, on the basis of the safeguards in Cloudflare's and DigitalOcean's data processing terms (EU-U.S. Data Privacy Framework or Standard Contractual Clauses, as applicable).

Cookie Policy

This Application is a native mobile application and does not use HTTP cookies. Local storage on the device (such as the on-device database and the application's preferences) is used only for what the Service needs to work. The website sets no cookies.

The Application includes no third-party software development kit for analytics, advertising or tracking, and does not ask for permission to track under Apple's App Tracking Transparency framework because it does not track.

The rights of Users under the GDPR

Users may exercise certain rights regarding their Data processed by the Owner. In particular, to the extent permitted by law, Users have the right to:

• Withdraw their consent at any time, where they have given it. Withdrawal does not affect the lawfulness of processing carried out before it.
• Object to the processing of their Data, where it is carried out on a legal basis other than consent.
• Access their Data and obtain a copy of it.
• Verify and seek rectification of their Data.
• Restrict the processing of their Data.
• Have their Data deleted.
• Receive their Data and have it transferred to another controller, in a structured, commonly used and machine-readable format.
• Lodge a complaint with their competent data protection authority (in Italy, the Garante per la protezione dei dati personali).

Most of the User's Data never reaches the Owner: the User controls it directly. Deleting a document, a folder or the Application's iCloud data deletes it from the device and, with sync on, from iCloud; existing backups keep it until they are removed. For anything the Owner does hold, such as an email, requests can be sent to the contact details above and are answered as soon as possible, and within one month.

Children

The Application is not directed at children under 14, and the Owner does not knowingly collect their Data.

Changes to this privacy policy

The Owner may update this privacy policy at any time. The date of the last update is shown below; where changes are significant, the Owner may also say so in the Application.