Privacy Policy

Last updated: July 22, 2026

Draft notice: should be reviewed by a lawyer familiar with GDPR and Romanian data protection law before publication.

1. Who controls your data

DOTUX SRL ("we") is the data controller for personal data processed through Scanly. Contact: contact@scanly.ro.

This policy complies with the EU GDPR and applicable Romanian data protection law.

2. What data we collect

Account data:

Name, email, password (stored as a salted argon2 hash)
If using Google Sign-In: your Google account identifier and email
Company profile: name, entity type, CUI, address

Document data:

Photographs, scanned images, and PDF files you upload
Extracted data: supplier/buyer name and CUI, invoice numbers, dates, amounts, currency, categories

Usage/technical data: login timestamps, IP address, basic error logs.

We do not collect data for advertising and do not sell personal data to third parties.

3. Why we process your data (legal basis)

Purpose	Legal basis (GDPR Art. 6)
Providing the core Service	Performance of a contract
Processing subscription payment	Performance of a contract
Essential emails (password reset)	Performance of a contract
Optional product update emails	Consent
Security, fraud prevention	Legitimate interest
Retaining certain tax/accounting records	Legal obligation

4. Automated processing and third-party sub-processors

Uploaded documents contain financial data and, in some cases, personal data of third parties (e.g. a named individual on a supplier invoice).

We send document images to Google (Gemini API) for AI-based extraction. Google processes this data as our sub-processor under its own terms. Processing occurs in the EU region (Ireland, eu-west-1) under Google Cloud terms.

Other sub-processors:

Resend — processes your email for transactional email delivery
Hostinger — stores account data and files on infrastructure in [CONFIRM: server location]

We do not use your data to train any AI model beyond the single extraction request needed per document.

5. How long we keep your data

Account/document data: retained while active, plus 30 days after deletion
Backups: rolling retention, overwritten after 14 days
Password reset tokens: expire after 30 minutes, single-use

6. Your rights

Under GDPR, you have the right to:

Access the data we hold about you
Rectify inaccurate data
Erasure ("right to be forgotten")
Restrict or object to certain processing
Data portability
Withdraw consent at any time
Lodge a complaint with ANSPDCP (www.dataprotection.ro)

To exercise these rights, contact contact@scanly.ro.

7. Security measures

Passwords hashed using argon2
All traffic encrypted via HTTPS/TLS
Production data access is restricted and logged
Regular backups performed

If we become aware of a data breach, we will notify affected users and the supervisory authority per GDPR (generally within 72 hours).

8. International data transfers

Where a sub-processor processes data outside the EEA, we rely on GDPR-recognized safeguards (Standard Contractual Clauses or an adequacy decision).

9. Children's privacy

The Service is intended for adults managing an SRL or PFA. We do not knowingly collect data from individuals under 18.

10. Cookies and local storage

The Service uses browser local storage for authentication and does not use third-party advertising cookies.

11. Changes to this policy

Material changes will be notified at least 14 days before taking effect.

12. Contact

Questions: contact@scanly.ro