Privacy Policy

1. Who we are

SummaScan ("SummaScan," "we," "us," "our") is operated by Ana Grace Lapu, an individual developer based in the Republic of the Philippines. This Privacy Policy describes how we collect, use, store, disclose, and protect information when you use the SummaScan mobile application (the "App") and the summascan.app website (together, the "Service").

For the purposes of the EU General Data Protection Regulation (GDPR), the UK GDPR, the Philippine Data Privacy Act of 2012 (Republic Act No. 10173, "DPA"), and the Australian Privacy Act 1988 (Cth) ("Australian Privacy Act"), the operator identified above is the data controller / personal information controller of personal data processed through the Service.

2. Information we collect

a. Account data. Email address; authentication credentials (hashed and managed by our authentication provider — we never see your plaintext password); display name; onboarding preferences; subscription tier; and usage counters (such as scans used against your plan's limits).

b. Document data. Images and files you scan or upload; text extracted from them by optical character recognition (OCR); AI-generated outputs (summaries, extracted data, drafts, chat responses); and any optional format samples or templates you provide. Document data is uploaded to and stored on our servers so that your scan history, exports, and AI features work across sessions.

c. Technical data. Device type, operating system and app version, IP address and similar connection metadata processed in the course of operating our APIs, and limited diagnostic and error logs.

d. Payment data. We do not collect or store card numbers or full payment details on our servers. In-app purchases are processed by Apple and/or Google, and subscription entitlements are synchronized through RevenueCat. We receive only subscription status and transaction identifiers.

e. Sensitive content within documents. The documents you choose to scan may themselves contain sensitive or special-category information (for example, legal case files, health-related records, or financial documents). We process such content solely to provide the features you request. You are responsible for ensuring you have a lawful basis (and, where required, the consent of any third parties named in the document) to process that content through the Service.

3. How we use information

We use the information described above to:

• provide scanning, OCR, AI analysis, drafting, chat, and export features;
• create and authenticate your account and send authentication-related emails (sign-in links, password resets);
• apply your plan's usage limits and enable Pro/Max features;
• maintain, secure, and improve the reliability of the Service;
• provide customer support;
• comply with applicable law and with Apple App Store / Google Play requirements.

We do not sell your personal information, and we do not use your documents or personal data for advertising.

4. Legal bases for processing (GDPR / UK GDPR)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b)) — processing your account and document data to deliver the Service you signed up for;
• Legitimate interests (Art. 6(1)(f)) — securing the Service, preventing abuse, maintaining logs, and improving reliability, balanced against your rights and freedoms;
• Legal obligation (Art. 6(1)(c)) — where we must retain or disclose information to comply with law;
• Consent (Art. 6(1)(a)) — where we ask for it specifically; you may withdraw consent at any time without affecting prior processing.

5. Third-party processors

We engage the following processors to operate the Service. Each processes data only as needed to provide its function:

We do not use third-party analytics or advertising SDKs in the App.

6. International data transfers

Your information is stored and processed in the countries listed above, which may be outside your country of residence. Where data is transferred from jurisdictions with data-transfer restrictions (including the EEA, the UK, the Philippines, and Australia), we rely on appropriate safeguards, including the processors' standard contractual clauses and equivalent contractual protections, and we take reasonable steps to ensure overseas recipients handle personal information consistently with the protections described in this Policy (including, for Australian users, the requirements of Australian Privacy Principle 8 regarding cross-border disclosure).

7. Retention and deletion

• Original scan photos are retained with your scan history for 30 days, after which they are automatically deleted from our servers.
• Extracted text and AI outputs remain available in your scan history while your account is active, so your saved results continue to work.
• Account data is retained while your account is active.
• Account deletion. You may request deletion of your account and all associated data at any time by emailing summascanai@gmail.com. Upon verified request, we will delete your account data and stored documents within thirty (30) days, except where retention is required by law (for example, records of transactions).
• Diagnostic logs are retained for a limited operational period and then deleted or anonymized.

8. Your rights

Depending on your jurisdiction, you have some or all of the following rights:

Under the GDPR / UK GDPR (EEA and UK users): the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection (Art. 21), and the right not to be subject to solely automated decision-making producing legal or similarly significant effects (Art. 22). You also have the right to lodge a complaint with your national supervisory authority.

Under the Philippine Data Privacy Act (Philippine users): the rights to be informed; to object; to access; to rectification; to erasure or blocking; to damages; to data portability; and to file a complaint with the National Privacy Commission (privacy.gov.ph).

Under the Australian Privacy Act (Australian users): the rights to access and correct your personal information under Australian Privacy Principles 12 and 13, and to complain about a breach of the Australian Privacy Principles, first to us, and then to the Office of the Australian Information Commissioner (oaic.gov.au) if you are unsatisfied with our response.

All users, regardless of location, may contact us at summascanai@gmail.com to request access to, correction of, export of, or deletion of their personal data. We will respond within the timeframe required by applicable law (and in any event within 30 days for most requests). We may need to verify your identity before acting on a request.

9. Security

We use industry-standard measures to protect your information, including encrypted connections (TLS) for data in transit, encrypted storage through our infrastructure providers, hashed credentials, and access controls limiting who can reach production systems. No method of transmission or storage is completely secure; we cannot guarantee absolute security, but we take the protection of your documents seriously and limit access to what is necessary to operate the Service.

10. Data breach notification

In the event of a personal data breach likely to result in a risk to your rights, we will notify the relevant supervisory authority and affected users as required by applicable law, including within seventy-two (72) hours where the GDPR applies, within the periods prescribed by the National Privacy Commission under the DPA, and consistent with the Notifiable Data Breaches scheme under the Australian Privacy Act.

11. Children's privacy

The Service is not directed to children under 13 (or the higher minimum age required in your jurisdiction, such as 16 in certain EEA member states). We do not knowingly collect personal data from children below the applicable minimum age. If you believe a child has provided us personal data, contact us at summascanai@gmail.com and we will delete it.

12. Automated processing and AI

The Service uses artificial intelligence to analyze the documents you submit and generate summaries, extractions, drafts, and chat responses. AI outputs are generated for your reference only, do not constitute legal, medical, financial, or other professional advice, and may contain errors. You should verify AI outputs against your original documents before relying on them. We do not use your documents to train AI models.

13. Do Not Track and similar signals

The website does not currently respond to "Do Not Track" browser signals, as no uniform standard exists. We do not track users across third-party websites.

14. Changes to this Policy

We may update this Policy as the Service evolves. Material changes will be posted on this page with an updated effective date, and where required by law we will provide additional notice. Continued use of the Service after changes take effect constitutes acceptance of the revised Policy to the extent permitted by law.

15. Contact

Questions, requests, or complaints regarding this Policy or your personal data:

Email: summascanai@gmail.com

Philippine users may also contact the National Privacy Commission (privacy.gov.ph). EEA/UK users may contact their local supervisory authority. Australian users may contact the Office of the Australian Information Commissioner (oaic.gov.au).