Privacy Policy

1. What Information Do We Collect?

In Short: We collect information you provide directly (your account details and the documents you scan), information collected automatically (technical and usage data), and — if you use social sign-in — limited profile details from Google or Apple.

Account Information

• Email address (for account creation and authentication)
• Full name (for personalization and account management)
• Password (encrypted and never stored in plain text)
• If you sign in with Google or Apple instead, the name, email address, and (for Google) profile picture that provider shares with us
• Account preferences and settings

Document Data

• PDF files you upload and scan, and the text/images they contain
• Document metadata (file names, sizes, creation dates)
• Folder organization and tags you create
• Search queries and document interactions

You can import a PDF from any location your device's file picker can access — for example, a cloud storage app such as Google Drive, iCloud Drive, Dropbox, or OneDrive, if you have that app installed on your device. Your device's operating system, not FlexiScanner, connects to that app to retrieve the file; we only receive the specific file you choose, and we have no other access to, or ongoing connection with, your cloud storage account.

Device Security Information (Mobile App)

• Device integrity checks (jailbreak/root detection)
• Security event timestamps

Technical Information

• IP address and approximate location (we do not collect precise GPS location)
• Browser type and version
• Device information and screen resolution
• Usage counters for billing and plan limits (e.g. OCR, AI, conversion, and document-share counts)
• Security logs and authentication events
• Crash and error diagnostics (via our error-monitoring provider, Sentry) when something goes wrong, so we can fix it

2. How Do We Process Your Information?

In Short: We process your information to provide, secure, and improve the Services, power the features you choose to use, enforce plan limits, and communicate with you.

• Service Provision: To provide, maintain, and improve our PDF scanning services
• Account Management: To create and manage your account, authenticate users
• Document Processing: To process, store, and organize your PDF documents
• AI Features: To power the optional summarization, classification, extraction, and Ask Questions features, with your consent
• Device Security: To detect compromised devices (jailbreak/root) and protect app access on mobile devices
• Security: To protect against fraud, abuse, and security threats
• Communication: To send important service updates and security notifications
• Plan Limits: To enforce billing and monthly usage limits (OCR, AI, conversion, and sharing)
• Legal Compliance: To comply with applicable laws and regulations

3. What Legal Bases Do We Rely On to Process Your Information?

In Short: We only process your personal information when we have a valid legal reason to do so — such as your consent, to perform our contract with you, or to pursue our legitimate interests.

If you are located in the EEA, UK, or Switzerland, we rely on the following legal bases:

• Performance of a Contract: to provide the Services you signed up for
• Legitimate Interests: for security, fraud prevention, and improving the Services
• Consent: for example, before AI processing of your document content (see Section 6)
• Legal Obligation: to comply with laws and regulations we're subject to

4. When and With Whom Do We Share Your Personal Information?

In Short: We do not sell your information. We share it only with the service providers who help us run FlexiScanner, and only for the purposes described here.

We do not sell, trade, or rent your personal information to third parties, and we do not use it for cross-context behavioral advertising. We may share your information only in the following limited circumstances:

• Cloud Hosting, DNS & Database: Supabase, which stores your account and document data, Vercel, which hosts the web application, and Cloudflare, which provides DNS for our domains
• AI Processing: OpenAI, only for documents you choose to run AI features on, with your consent (see Section 6)
• Payment & Subscription Processing: RevenueCat, Apple, and Google, to manage subscriptions and process payments
• Error Monitoring: Sentry, for crash and performance diagnostics — not used for advertising or analytics
• Support & Contact: Resend, to deliver messages you send us through the contact form
• Legal Requirements: When required by law, court order, or government request
• Safety & Security: To protect the rights, property, or safety of our users or others
• Business Transfers: In connection with a merger, acquisition, or sale of assets (with user notification)
• Consent: With your explicit consent for any other purpose

5. Do We Use Cookies and Other Tracking Technologies?

In Short: We use a single strictly necessary cookie to keep you signed in. We do not use analytics, advertising, or marketing cookies.

We use only one type of cookie: an essential session cookie required to keep you signed in and to authenticate your requests. We do not use functional, analytics, advertising, or marketing cookies, and we do not use any third-party tracking or analytics services such as Google Analytics.

6. Do We Offer Artificial Intelligence-Based Products?

In Short: Some optional features send your document's extracted text to our AI provider, OpenAI, only with your consent and only to perform the feature you requested.

Some FlexiScanner features — document summarization and classification, extracting key data, and the "Ask Questions" document chat — use our AI provider, OpenAI, to process the text extracted from a document. This only happens for documents you actively choose to run these features on; we don't send every document to OpenAI by default.

• Consent first: before your first document is sent for AI processing, we show a one-time disclosure and require you to agree before continuing
• No model training: your document content is sent securely and is not used by OpenAI to train their models
• Scoped use: content is used only to generate the summary, classification, extracted data, or chat answer you requested
• Same retention rules apply: AI outputs (summaries, classifications, extracted data) are stored with your account and deleted immediately on account deletion, the same as your other document data

7. How Do We Handle Your Social Logins?

In Short: If you choose to sign in with Google or Apple, we receive limited profile information from them to create your account.

Our Services offer you the ability to register and log in using your Google or Apple account. Where you choose to do this, we receive certain profile information from that provider — your name, email address, and (for Google) profile picture. We only use this information for the purposes described in this Privacy Policy. We don't control, and aren't responsible for, how Google or Apple otherwise handle your data — we recommend reviewing their own privacy notices to understand that.

8. Is Your Information Transferred Internationally?

In Short: Your data may be processed outside your home country, with appropriate safeguards in place.

Your data may be processed in countries other than your own. We ensure appropriate safeguards are in place, including standard contractual clauses and adequacy decisions, to protect your data during international transfers.

9. How Long Do We Keep Your Information?

In Short: We delete your data from our active systems immediately when you delete your account.

• Account Data: Deleted IMMEDIATELY upon account deletion request - no retention period
• Document Data: All PDFs, folders, and organization data deleted IMMEDIATELY upon account deletion
• AI Processing Data: Document summaries, classifications, and extracted data deleted IMMEDIATELY
• User Profiles: Premium status, settings, and preferences deleted IMMEDIATELY
• Usage Counters & AI Request Logs: Deleted immediately upon account deletion
• Converted File Exports: Deleted immediately upon account deletion
• Data Export Files: If you use the "Export My Data" feature, the generated file is automatically deleted from storage after a short expiry window, whether or not you download it

10. How Do We Keep Your Information Safe?

In Short: We use industry-standard technical and organizational measures to protect your data, but no system is 100% secure.

Security Measures

• Encryption: Industry-standard encryption for data in transit and at rest
• Authentication: Secure authentication with session management
• Access Control: Strict access controls and user permission systems
• Rate Limiting & Abuse Prevention: Automated rate limiting and brute-force protection
• Input Validation: Validation and sanitization to guard against common web attacks (e.g. cross-site scripting)
• Secure Uploads: Validation of uploaded files before they're processed
• Device Security (Mobile App): Device integrity checks, including jailbreak/root detection
• Backups: Automatic daily database backups, which can be restored to recover from data loss
• Ongoing Maintenance: Regular security updates and patches

No method of transmission over the internet or electronic storage is 100% secure. While we work hard to protect your personal information, we cannot guarantee its absolute security.

11. Do We Collect Information From Minors?

In Short: FlexiScanner is not intended for children under 13.

Our service is not intended for children under 13 years of age, matching the minimum age to create an account set out in our Terms of Service. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will take steps to delete such information.

12. What Are Your Privacy Rights?

In Short: Depending on where you live, you have rights to access, correct, delete, and control how your personal information is used.

You have the following rights regarding your personal data:

• Access: Request access to your personal data
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request complete deletion of your account and all personal data (available in Profile settings)
• Portability: Download a copy of your data yourself using the "Export My Data" option in Profile settings, or by contacting us at privacy@flexiscanner.com
• Restriction: Request restriction of processing in certain circumstances
• Objection: Object to processing based on legitimate interests
• Withdrawal: Withdraw consent where processing is based on consent — this won't affect the lawfulness of processing carried out before you withdrew it

We do not use automated decision-making that produces legal or similarly significant effects about you. If you are located in the European Economic Area, the UK, or Switzerland and believe we are processing your personal information unlawfully, you have the right to lodge a complaint with your national data protection authority. As Nebulo Software Limited is based in Ireland, our lead supervisory authority is the Irish Data Protection Commission (dataprotection.ie); UK residents may instead contact the Information Commissioner's Office (ico.org.uk).

See Section 14 for additional rights if you live in the United States, and Section 15 if you live in Australia, New Zealand, or South Africa.

13. Controls for Do-Not-Track Features

In Short: We don't currently respond to browser Do-Not-Track signals, but we don't use tracking cookies regardless of your setting.

Most web browsers include a "Do Not Track" (DNT) setting, but there is no industry-standard way for sites to interpret it, so we do not currently respond to DNT signals. In practice this makes little difference for FlexiScanner, since we don't use tracking or advertising cookies regardless of your DNT setting.

14. Do United States Residents Have Specific Privacy Rights?

In Short: If you live in a US state with a comprehensive privacy law, you have additional statutory rights — though FlexiScanner doesn't sell data or use it for targeted advertising, so several of them won't change anything in practice.

If you are a resident of California, Colorado, Connecticut, Virginia, or another US state with a comprehensive privacy law, you have statutory rights including the right to know, delete, correct, and opt out of the sale or sharing of personal information for cross-context behavioral advertising. FlexiScanner does not sell personal information and does not engage in cross-context behavioral advertising, so there is nothing to opt out of in that respect. You may designate an authorized agent to submit a request on your behalf, and we may need to verify your identity before fulfilling any request. To exercise any of these rights, use the in-app Export/Delete tools (see Section 18) or contact privacy@flexiscanner.com.

15. Do Other Regions Have Specific Privacy Rights?

In Short: Residents of Australia, New Zealand, and South Africa have equivalent access, correction, and complaint rights under their local privacy laws.

If you are located in Australia or New Zealand, you have the right to request access to or correction of your personal information, and to complain about a breach of the Australian Privacy Principles to the Office of the Australian Information Commissioner, or of New Zealand's Privacy Principles to the Office of the New Zealand Privacy Commissioner. If you are located in South Africa, you have the same access and correction rights, and may complain to the Information Regulator (South Africa).

16. Do We Make Updates to This Notice?

In Short: We'll update the "Last updated" date above whenever we make material changes to this policy.

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically.

17. How Can You Contact Us About This Notice?

In Short: Questions? Email privacy@flexiscanner.com.

If you have any questions about this Privacy Policy or our privacy practices, please contact us:

18. How Can You Review, Update, or Delete Your Data?

In Short: You can review, export, or delete your data yourself in Profile settings, or by contacting us.

• Review or update: Log in and update your account details in Profile settings at any time
• Export: Use "Export My Data" in Profile settings to download a complete copy of your documents, folders, AI outputs, and account data as a ZIP file
• Delete: Use "Delete Account" in Profile settings to permanently and immediately delete your account and all associated data (see Section 9)
• Or contact us directly at privacy@flexiscanner.com if you'd prefer we action a request on your behalf