Privacy Policy

1. Data controller

Your personal data is processed by the publisher of Scanlr. For any question: contact@scanlr.app

2. Data we collect

Scanlr only collects the data needed to run the service:

• Account data: email address, display name, profile photo (optional)
• Scanned documents: images of the receipts and invoices you upload
• Extracted data: merchant, date, amount, VAT, items — produced by OCR analysis of your documents
• Billing data: handled exclusively by Stripe (we never store your card details)
• Technical data: sign-in logs for security purposes

3. Purposes of processing

• Providing and improving the service
• Account authentication and security
• Managing subscriptions and billing
• Sending service notifications (warranty expiry, etc.)
• Customer support

4. Legal basis

We process your data to perform the contract (Terms of Use) you accepted when signing up, and on the basis of our legitimate interest in keeping the service secure.

5. Processors

Scanlr relies on the following providers, all GDPR compliant:

• Supabase — database hosting and authentication (data stored in Europe)
• Mistral AI — document OCR and AI assistant. French company; data processed in the European Union, natively GDPR compliant. Images are analysed on the fly and are not retained by Mistral.
• Stripe — payments and billing (we never store your card details)
• OpenStreetMap / Nominatim — merchant geolocation for the map (no personal data sent, merchant address only)

GDPR note: AI processing (OCR and assistant) is performed exclusively by Mistral AI, a French company whose data stays in Europe. No data is transferred outside the EU for this processing.

6. Retention period

Your data is kept for as long as your account exists, then deleted within 30 days of account deletion. Billing records are kept for 10 years to meet legal obligations.

7. Your rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the following rights:

• Access — view your personal data
• Rectification — correct your data
• Erasure — delete your account and data from Settings → Danger zone
• Portability — export all your personal data from Settings → My GDPR data (portable JSON format)
• Objection — object to certain processing

To exercise these rights: contact@scanlr.app

8. Security

Your data is stored encrypted and access is protected by authentication. We have no access to your card details (handled directly by Stripe).

9. Cookies

Scanlr only uses technical cookies that are strictly necessary for the service to work (sign-in session). No advertising or third-party tracking cookies are used.

10. Contact & complaints

For any question or complaint: contact@scanlr.app
You may also lodge a complaint with the French data protection authority, the CNIL (cnil.fr), or with the supervisory authority of your country of residence.