Privacy Policy

1. Who we are

Scanova (the “app”) is a document scanner and AI paperwork assistant for iPhone. It is made by Origin Five Labs Teknoloji A.Ş., Esentepe Mah. Büyükdere Cad. No:199/6, Levent 199 Binası, Şişli, İstanbul, Türkiye (“Origin Five Labs”, “we”, “us”). We are the data controller for the personal data described in this policy.

Questions or requests: support@usescanova.com · usescanova.com/support

2. What stays on your iPhone

Scanova is built to work on the device. The following are created, stored and processed only on your iPhone, and are not sent to us:

• Your library: scanned and imported documents and their pages, folders, file names, annotations, the Recently Deleted folder, translated copies and saved Explain this results.
• Signatures and initials you draw or type.
• QR history: codes you scan and create. You can turn history off or clear it in Settings.
• Business cards you save, and the contacts you add to the Contacts app.
• Preferences, including your choices about cloud AI.

Scanova does its work with Apple's on-device engines whenever the iPhone can. These run entirely on your iPhone, and nothing they process is sent to us or to anyone else:

• Apple VisionKit: the document camera, edge detection and the live QR and barcode scanner. Filters run on the device with Core Image.
• Apple Vision: text recognition (OCR), searchable PDFs, reading QR codes from photos, and reading business cards into contact fields. Business cards and text recognition never use the cloud.
• Apple Translation (iOS 18 and later): Translate runs on the device when your iPhone has the language pair. iOS may download the language once, from Apple.
• Apple Foundation Models (Apple Intelligence, on supported iPhones): Explain this runs on the device when it is available.

Only when the device can't do the job does Scanova offer the cloud, and it asks you first (see section 4).

Scanova asks for access to the camera, Photos, Contacts, Calendar or Reminders only at the moment a feature needs it. A deadline you add goes straight into your Calendar or Reminders on the device. Because your library is not synced to us, we cannot recover it from our side. It may be included in your iPhone's own backups (such as iCloud Backup, if you use it), which Apple handles under its own terms.

3. What we collect

To run the service we collect only the following:

• Identifiers. Your anonymous account ID, created when you first open the app; a random device key the app creates and keeps in your iPhone's keychain, of which we store only a one-way hash, used to apply free-plan limits fairly (see section 9); an Apple App Attest key that proves requests come from the genuine Scanova app (we store its public key only); your device's identifier for vendors (IDFV); and your device's advertising identifier (IDFA) only if you allow tracking (see section 7).
• Usage counters. How many free exports, conversions, Explain this documents, translations and AI Art QR generations you have used, and your AI Art QR credits. These hold counts, not content.
• Purchases. Your Scanova Pro plan, trial and renewal status, and store transaction IDs. Apple handles payment; we never see your card details.
• AI Art QR. The style or description you choose, and the images generated for you. The content of the QR code (for example a link or a Wi-Fi password) is used to make the images but is not stored in our account database: it keeps only a one-way hash of it. While a generation runs, the content waits encrypted in our job queue so the generation can finish even if our server restarts, and it is deleted from the queue as soon as the generation ends.
• Support and feedback. Messages you send us from the app or by email, the email address you give us, the device details the in-app form adds (device model, iOS and app version, language and time zone), your rating of an AI result, and reports of a generated image.
• Diagnostics. Crash reports and performance data (device model, iOS and app version, and what the app was doing when it failed). Crash reports never include the content of your documents.
• Usage analytics. Events such as “document scanned” or “export completed”, with the device model, language and approximate country inferred from your IP address. They never include document content, file names or text, and we do not record your screen.

We do not collect your documents, your library, your signatures, your QR history, your contacts, your location, your photos or your name.

4. Cloud AI features

Some features need an AI model on a provider's servers when your iPhone can't run them itself. Before the cloud is used for the first time, the app tells you what is sent and who processes it, and asks for your consent. If you choose “Not now”, nothing is sent. You can turn each feature on or off later in Settings › Privacy & AI; when one is off, Scanova asks again the next time. If the work can be done on your iPhone, no consent is asked because nothing leaves it.

Only the text needed for the feature is sent, never your whole library. Images on a page, logos and signatures are not sent for translation. Requests go through our server, which passes them to the provider without storing document text; our logs never contain document text, questions or QR content. We use OpenAI's business API with storage of requests turned off, and OpenAI does not use API data to train its models. AI Art QR images are generated by EachLabs from the QR image, the style and your description; nothing else from your library is sent. Data sent to AI providers is used only to produce your result, never for advertising.

AI results can be wrong. Scanova always shows: “AI can make mistakes. This is not legal, financial or medical advice.”

5. Document conversion

Converting photos to PDF, PDF to images, merging and splitting run on your iPhone. Converting Word, Excel or PowerPoint to PDF, or PDF to Word, needs our server. The app asks for your consent first. The file is uploaded over an encrypted connection to a server we operate ourselves (hosted by Hetzner in Germany, see section 6), with no third-party conversion service and no AI. It is converted in a temporary folder, sent back to your iPhone and deleted right after the conversion; it is never stored or logged. We keep only a counter of how many conversions you have used, and technical logs of the formats, sizes and durations, never the file name or content.

6. Service providers

Our own servers. Your anonymous account, plan status, usage counters, AI Art QR job records, support messages and document conversion run on servers we operate ourselves. They are hosted by Hetzner Online GmbH in Falkenstein, Germany (EU), which provides the machines and does not access your data. The software on them is run by us, so its makers receive nothing.

Third parties that receive data, each under contract and only to run Scanova:

EachLabs keeps its copy of a request and its result under its own retention rules; we do not send it anything else from your library. We may also disclose data where the law requires it, to protect the rights and safety of our users or the public, or as part of a merger or acquisition, in which case we will tell you before your data becomes subject to a different privacy policy.

7. Advertising and tracking

Scanova does not show ads. It may use the Adjust, Meta (Facebook SDK) and TikTok SDKs to measure which ad campaigns lead to installs and subscriptions. The app asks for permission with Apple's App Tracking Transparency prompt, and it may ask before ad measurement is switched on, so your choice is already in place when it starts. Until ad measurement is switched on in the app, nothing is sent to these SDKs and your advertising identifier (IDFA) is never read, whatever you answered. When ad measurement is on:

• With your permission only. After onboarding (never on first launch), iOS shows Apple's App Tracking Transparency prompt. Only if you tap “Allow” do these SDKs read your advertising identifier (IDFA) and link your installs, app opens, subscription purchases and key in-app events to ad campaigns. Declining changes nothing in the app.
• Before or without permission, the SDKs send only anonymous install and app-open events without the IDFA, using Apple's privacy-preserving attribution systems (SKAdNetwork) and Meta's Aggregated Event Measurement, which are designed to measure campaigns without identifying you.
• We never send your documents, their text, your QR codes or anything you type to an advertising SDK. Only ids, events, prices and plan names.
• You can change your choice any time in iOS Settings › Privacy & Security › Tracking.

8. How we use data, and why

We do not sell your personal data, and we do not share it for cross-context behavioural advertising as defined by US state privacy laws, except for the ad measurement you allow in section 7. We do not use your documents or AI requests to train AI models.

9. How long we keep data

• Document text sent to cloud AI is not stored. It is processed for your result and then discarded.
• Files sent for conversion are deleted right after the conversion.
• AI Art QR images are kept until you delete your account. A copy may stay in the content-delivery cache at its private, unguessable address for a short time until the cache expires. The QR content itself is never stored.
• Your anonymous account, plan status, usage counters and App Attest key are kept while you use Scanova, and deleted when you delete your account.
• Purchase records are kept as long as tax and commercial law requires (up to 10 years under Turkish law). After you delete your account, billing event records are kept without any personal content.
• Crash reports and analytics are kept for up to 90 days and 12 months respectively.
• Support emails are kept for up to 2 years after the conversation ends.
• Server logs, which never contain document text, QR content or file names, are kept for up to 30 days for security.
• Free-plan usage counter. To stop the free plan from restarting when an account is deleted and made again, we keep an anonymous count of the free uses on a device, tied only to the one-way hash of the device key from section 3. It contains no personal information or content and is kept after you delete your account.

Everything stored on your iPhone stays there until you delete it, delete your account or remove the app. Documents you delete wait in Recently Deleted for 30 days, then are removed for good.

10. Deleting your data

In the app, open Settings › Account › Delete account and confirm. Scanova then:

• erases your documents, signatures, QR history, business cards and AI results from your iPhone;
• deletes your account, plan record, usage counters, App Attest key, AI Art QR images, support messages, feedback and reports from our servers and storage;
• deletes your anonymous account itself.

The anonymous free-plan usage counter described in section 9 is not deleted: it holds no personal information. Repeated deletions. If several accounts are deleted from the same iPhone in a short time, a new deletion is completed within 7 days instead of at once, and the app tells you so. You can keep using Scanova until then. To prevent abuse of the free plan, we keep a record of such a request (your account ID, the anonymous device hash and the dates) until it is completed.

This cannot be undone. Deleting your account does not cancel a subscription: Apple bills it, so cancel it in iOS Settings › your name › Subscriptions. You can also delete single documents, signatures and QR codes at any time, or email us and we will delete your server-side data for you.

11. Your rights

Depending on where you live, including under the EU and UK GDPR, Türkiye's Personal Data Protection Law No. 6698 (KVKK) and US state laws such as the California CCPA/CPRA, you have the right to:

• know what personal data we hold about you and get a copy of it;
• have it corrected or deleted;
• restrict or object to processing, including processing based on legitimate interests;
• receive your data in a portable format;
• withdraw consent at any time (this does not affect processing already done);
• not be discriminated against for using these rights;
• complain to a data protection authority, such as the Turkish Personal Data Protection Authority (KVKK) or the authority in your EU country.

Most of this you can do in the app. For anything else, email support@usescanova.com. Because Scanova accounts are anonymous, we may ask you to send the request from inside the app, or for a detail that shows the account is yours. We reply within 30 days.

12. Children

Scanova is not meant for children under 13, or under 16 in the European Economic Area and the UK unless a parent or guardian has consented where the law allows. We do not knowingly collect data from children below these ages. If you believe a child has used Scanova, contact us and we will delete the data.

13. International transfers

We are based in Türkiye, and our own servers are in Germany (EU). Some providers in section 6 process data in the United States: OpenAI, EachLabs, RevenueCat, Sentry, Amplitude, Meta, TikTok and Cloudflare. When personal data leaves Türkiye, the EEA or the UK, we rely on the safeguards the law provides: the providers' data processing agreements with the European Commission's Standard Contractual Clauses (with the UK Addendum), standard contracts notified to the Turkish Personal Data Protection Authority under KVKK, or your explicit consent where that is the applicable basis. Your documents and scans themselves never leave your iPhone, unless you send one to a cloud feature yourself.

14. Security

Data is encrypted in transit (HTTPS). The app can read only its own account's data and cannot change anything on our servers directly: every change goes through our server, which checks who you are and, with Apple's App Attest, that the request comes from the genuine Scanova app on a real iPhone. Your device key is protected by the iOS keychain, and your library by iOS data protection on your iPhone. AI Art QR images are stored at private, unguessable addresses. No system is perfectly secure, but we work to protect your data and will tell you and the authorities about a breach where the law requires.

15. This website

usescanova.com sets no cookies and uses no analytics or advertising trackers. Our host, Cloudflare, processes your IP address and standard request data to deliver and protect the site.

16. Changes to this policy

We will update this policy when Scanova changes. The date at the top shows the latest version. If a change is significant, we will tell you in the app before it takes effect.

17. Contact

Origin Five Labs Teknoloji A.Ş., Esentepe Mah. Büyükdere Cad. No:199/6, Levent 199 Binası, Şişli, İstanbul, Türkiye.

Email: support@usescanova.com

Terms of Use Support