Privacy Policy

Welcome to eScanX ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our document processing services.

2.1 Information You Provide to Us

• Account information (name, email address, password)
• Payment information (processed securely through Stripe)
• Documents you upload for processing
• Communications with our support team

2.2 Information Collected Automatically

• IP addresses and device information
• Browser type and operating system
• Usage data and analytics (via Google Analytics)
• API usage statistics

We use your information to:

• Provide and maintain our services
• Process your documents using OCR technology
• Process payments and prevent fraud
• Send service-related communications
• Improve our services and develop new features using aggregated usage statistics only — never document content
• Comply with legal obligations

3.1 Legal Basis for Processing (GDPR Article 6)

We process your data under the following legal bases:

• Account registration and service delivery — Contract performance (Art. 6(1)(b))
• Document OCR processing — Contract performance (Art. 6(1)(b))
• Payment processing — Contract performance and legal obligation (Art. 6(1)(b), 6(1)(c))
• Document retention during retention period — Legitimate interest (Art. 6(1)(f))
• Service-related communications — Contract performance (Art. 6(1)(b))
• Usage analytics (aggregated) — Legitimate interest (Art. 6(1)(f))
• Marketing communications — Consent (Art. 6(1)(a)), opt-in required

Where we rely on legitimate interest, we have conducted a balancing test to ensure your rights are not overridden. You may object to processing based on legitimate interest at any time by contacting support@erichsol.com.

We implement appropriate technical and organizational measures to protect your personal data:

• Encryption in transit (TLS/SSL) and at rest
• Regular security audits and penetration testing
• Access controls and authentication mechanisms
• Documents stored securely on EU-resident infrastructure with encryption
• Payment data handled exclusively by PCI-compliant Stripe

We retain your information for as long as necessary to:

• Provide our services to you
• Comply with legal obligations
• Resolve disputes and enforce agreements

Documents are processed on EU-resident infrastructure. Uploaded files are automatically deleted after a retention period set by our standard policy (see our Data Policy for exact windows). You can request immediate deletion at any time via your dashboard or API. Enterprise customers may negotiate custom retention periods.

If you are located in the European Economic Area (EEA), you have the following rights:

• Right to Access: Request copies of your personal data
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your data
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive your data in a machine-readable format
• Right to Object: Object to our processing of your data
• Right to Lodge a Complaint: Lodge a complaint with a supervisory authority if you believe your data protection rights have been violated

To exercise these rights, contact us at support@erichsol.com

We use cookies and similar tracking technologies to:

• Maintain your session and authentication
• Remember your preferences
• Analyze usage patterns (Google Analytics)
• Prevent fraud and abuse (reCAPTCHA)

You can control cookies through your browser settings.

We rely on the following sub-processors to deliver the Service. All process data on our behalf under written agreements with appropriate safeguards (Standard Contractual Clauses where required):

• AWS (Amplify, Lightsail, S3): Cloud infrastructure for frontend hosting (Sweden), backend compute (Stockholm) and document storage (Stockholm). All workloads pinned to EU regions.
• Verda: AI inference compute used during document extraction. Hosted in Finland on EU-resident infrastructure. Receives document content only for the duration of the extraction request and does not retain it.
• Stripe: Payment processing and subscription management. Receives billing data only — never document content. Stripe is covered by EU + US adequacy decisions.
• Microsoft: Transactional email delivery (account verification, password reset, billing notifications).
• Sentry: Application error tracking and performance monitoring. Pinned to the EU region. Does not receive document content.
• Google Analytics: Aggregated website usage analytics. Loaded only after you grant analytics consent in the cookie banner; IP anonymization is enabled.
• Google reCAPTCHA: Spam and abuse prevention on signup and contact forms.

Our infrastructure regions and compliance status are published at /policy; the current sub-processor list is available on request as part of our DPA.

Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place for such transfers, including Standard Contractual Clauses approved by the European Commission.

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through a prominent notice on our website. Your continued use of our services after changes constitutes acceptance of the updated policy.

If you have questions or concerns about this Privacy Policy, please contact us:

• Email: support@erichsol.com
• Address: Erichsol Oy, Finland
• Data Protection Officer: support@erichsol.com