01
Scope and controller
Scanverion is a product and brand operated by ECoding Slovakia s. r. o., Csermelyova 6, 929 01 Dunajská Streda, Slovakia, Company ID 51 486 105, VAT ID SK2120720041 ("ECoding", "we"). ECoding is the controller for personal data described in this Privacy Policy.
This Policy covers visitors, trial users, account users, workspace contacts, prospective customers, and support contacts. When a Customer submits documents, images, or other personal data to Scanverion for processing on its instructions, the Customer is normally the controller and ECoding is its processor. That processing is governed by the Data Processing Terms and the Customer's own privacy notice, not by ECoding independently deciding how to use that content.
02
Data we collect
- Account and workspace data: email, name, language, organization, role, invitations, authentication and account status.
- Billing data: billing contact, address, company and VAT details, plan, invoices, payment status, usage, and limited payment-method information received from the payment provider.
- Communications: name, work email, company, inquiry type, expected volume, message, support correspondence, and request references.
- Service and security data: IP address, timestamps, request and workspace identifiers, API-key prefix and activity, selected operations, usage counts, errors, device/browser information, and audit events.
- Website choices: language and analytics preference stored in your browser, and analytics data only after permission.
- Customer Content: files and outputs processed for the Customer under its instructions, as described separately in the Data Processing Terms.
We receive data directly from you or your workspace administrator, automatically from your use of the Service, and from providers involved in identity, payments, hosting, security, or analytics.
03
Purposes and legal bases
We process account, workspace, service, billing, and support data to enter into and perform our contract, including registration, authentication, service delivery, metering, invoicing, support, and account administration.
We process security logs, abuse signals, service diagnostics, business communications, product planning, and limited aggregated statistics for our legitimate interests in securing, operating, supporting, and improving Scanverion and protecting legal claims. We balance those interests against individual rights.
We process tax, accounting, compliance, and lawful-request data to meet legal obligations. Optional Google Analytics runs only with consent, which can be withdrawn through Cookie settings. Where consent is used, withdrawal does not affect earlier lawful processing.
05
Uploads, outputs, and public trial
Authenticated uploads and outputs are handled on the Customer's instructions under the Data Processing Terms. ECoding does not use Customer Content to train general-purpose or shared AI models unless expressly agreed in writing.
The anonymous trial is intended for non-confidential sample material. It uses the source IP for daily abuse prevention and may validate a bot-verification token. Do not submit real identity documents, special-category data, payment data, secrets, or production files through the public trial. Trial behavior may use deterministic sample results while the production processing service is being connected.
06
Recipients and service providers
Authorized ECoding personnel and contractors access personal data only where needed for their duties and under confidentiality obligations. We may use providers for cloud hosting and processing, payments, identity, email or support delivery, bot prevention, monitoring, and consented analytics.
Planned core infrastructure uses Amazon Web Services in eu-central-1 (Frankfurt) and Google Cloud services hosted in the EU. Stripe is the planned payment-system authority; Google Analytics is optional. Specific production providers can change as the Service develops. Processor subprocessors are governed by the notification and objection process in the Data Processing Terms.
We may disclose data to advisers, auditors, authorities, courts, or transaction counterparties where necessary for legal obligations, claims, corporate transactions, or protection of rights. We do not sell personal data.
07
Locations and international transfers
We aim to host Customer Content and primary Scanverion workloads in the European Union. A provider or its support personnel may nevertheless process limited data outside the EEA. Where an adequacy decision does not apply, we use an appropriate safeguard such as the European Commission's Standard Contractual Clauses and supplementary measures where required.
EU hosting does not by itself mean that every provider, support operation, telemetry event, or payment transaction remains exclusively in the EU. Customers with strict residency requirements should confirm them in a written order before production use.
08
Retention
We retain account and workspace data while the account is active and for a limited period afterwards to close the relationship, handle disputes, prevent abuse, and meet legal duties. Billing, invoice, tax, and accounting records are retained for the period required by applicable law. Contact and support records are kept while needed to respond and for reasonable follow-up and claim periods.
Security, audit, usage, and technical logs are retained for periods proportionate to security, billing, troubleshooting, and legal needs, then deleted or de-identified. Analytics retention follows the configured Google Analytics setting.
Customer Content is retained only as needed to provide the requested processing, maintain agreed transient outputs or backups, resolve incidents, or comply with law, and is deleted or returned as described in the Data Processing Terms and applicable order. Because production storage settings are still being finalized, ECoding will publish or contract specific operational periods before storing production Customer Content beyond transient processing.
09
Security
We use technical and organizational measures appropriate to the risk, including access controls, credential protection, least-privilege practices, logging, secure transmission, environment separation, vulnerability management, backups where applicable, and incident procedures. The Data Processing Terms describe the baseline for Customer Content.
No system can guarantee absolute security. Users must protect credentials, limit API-key scopes, use secure endpoints, and avoid sending sensitive data through inappropriate channels such as ordinary contact messages or the public trial.
10
Your rights
Subject to applicable law, you may request access, correction, deletion, restriction, portability, or objection; withdraw consent; and ask for information about safeguards. You may also object to processing based on legitimate interests. We may verify identity and may retain data where law or overriding legal grounds require it.
For Customer Content, first contact the organization that submitted your data. ECoding will assist that Customer as processor. For data controlled directly by ECoding, email gdpr@ecoding.sk or use the contact page.
11
Complaints and supervisory authority
Please contact us first so we can investigate. You also have the right to complain to the supervisory authority where you live, work, or where the alleged infringement occurred. ECoding's lead authority in Slovakia is the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky), dataprotection.gov.sk.
12
Changes and contact
We may update this Policy as Scanverion, its providers, or legal requirements change. We will update the effective date and provide a prominent notice where a change materially affects rights or processing.
The Slovak version is legally binding. This English translation is provided for convenience only, and the Slovak version prevails in case of any inconsistency.
ECoding Slovakia s. r. o.
Csermelyova 6, 929 01 Dunajská Streda, Slovakia
gdpr@ecoding.sk