Privacy policy
This policy, provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003, explains how personal data is processed when you use the UltraScan app for iOS and Android and when you visit the ultrascan.it website.
Data controller
Artisan di Domenico Mecca — VAT No. 07656700726
Via V. Bellini n. 1, 70132 Bari (BA), Italia
Email: dm@artisanlab.it
In short
- Your documents stay on your phone. Scanning, cropping, filters and text recognition (OCR) take place entirely on your device. We do not upload your scans to any server and we cannot see them.
- No account. We do not ask for your name, email address, phone number or location.
- No analytics or tracking tools have been integrated by us into the app or the website.
- In the free version, the app shows ads via Google AdMob, which processes device data according to the choices you make in the consent dialog.
- PRO subscriptions are paid through the App Store or Google Play; subscription status is managed through RevenueCat using an anonymous identifier.
1. Data processed by the app
1.1 Documents, photos and recognised text
The images you capture with the camera or import from your gallery, the PDFs and Word/text files you create, and the text extracted by OCR are processed only on your device: edge detection and filters use local libraries (Apple Vision, OpenCV), and OCR uses the recognition engines built into the operating system (Apple Vision on iOS, on-device Google ML Kit on Android). Files are saved in the app’s private storage or, if you choose, in the “UltraScan” album of your gallery.
The controller does not receive, store or have access to this content. When you choose to share a document (for example via Gmail, WhatsApp or Drive), the file is handed over to the app you select and, from that point on, is processed in accordance with that service’s privacy policy. Since documents may contain data about you or third parties (including special categories of data, such as health data), we encourage you to share them with care.
1.2 Device permissions
| Permission | What it is used for |
|---|---|
| Camera | Framing and scanning documents. The video stream is analysed in real time on the device and is neither recorded nor transmitted. |
| Photos / gallery | Importing photos you have already taken and saving scanned pages to your gallery. |
| Tracking (iOS only, App Tracking Transparency) | Requested only in the free version, to allow personalised ads. You can decline without losing any functionality. |
The app does not use the microphone or your location. You can revoke permissions at any time in your operating system’s settings.
1.3 Preferences stored on the device
The app stores certain technical settings locally: the language you have chosen and whether and when you have already been asked to leave a review. This data never leaves your device and is deleted when you uninstall the app. The review request uses the native App Store or Google Play dialog: if you leave a review, it is processed by Apple or Google.
1.4 Advertising (Google AdMob)
If you do not have a PRO subscription, the app shows full-screen ads provided by Google AdMob (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, USA). The advertising SDK is initialised only after your choices have been collected, where required in your country, through Google’s consent management platform (UMP, compliant with the IAB Transparency & Consent Framework).
Depending on your choices, Google may process: your device’s advertising identifier (IDFA on iOS, if you allow tracking; Advertising ID on Android), your IP address and the approximate location derived from it, device model and operating system, language, information about your interactions with ads and SDK diagnostic data. This data is used to serve ads, cap their frequency, measure their performance, prevent fraud and, only with your consent, personalise them. If you do not give your consent, non-personalised or limited ads may be shown, to the extent permitted by your choices.
For this processing, Google acts as an independent controller: see Google’s privacy policy and how Google uses information from sites or apps that use its services. You can change your choices at any time in the app under Settings → Change privacy preferences, reset your Advertising ID in your device settings, or remove ads entirely by upgrading to PRO: for PRO users the advertising SDK is not initialised.
1.5 PRO subscriptions (App Store, Google Play, RevenueCat)
Purchases are handled entirely by Apple (App Store) or Google (Google Play), which act as independent controllers: the controller never receives your payment details, your name or your email address.
To verify and restore your subscription, the app uses RevenueCat, Inc. (USA), which acts as a processor on behalf of the controller. RevenueCat receives a randomly generated anonymous user identifier created by the app, the receipts and transaction details provided by the store (product, purchase and renewal dates, country and currency, subscription status), technical device data (operating system, app version) and your IP address. More information is available in RevenueCat’s privacy policy.
1.6 Contact
If you write to us at dm@artisanlab.it, we process your email address and whatever you tell us solely in order to reply to you. Please do not send us scanned documents unless strictly necessary.
2. Data processed by the website
The ultrascan.it website is a static site hosted on Cloudflare Pages (Cloudflare, Inc., USA), which acts as a processor. In order to deliver the pages and protect the site against abuse, Cloudflare processes technical browsing data (IP address, browser and device type, date and time, requested page, referring page), which is retained for as long as strictly necessary for these purposes.
The website does not use cookies, whether first-party or third-party, does not use analytics or tracking tools and does not load resources from external services: even the fonts are hosted on the site itself. The only script on the home page selects the language based on your browser settings, without storing anything.
3. Purposes and legal bases
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Operation of the app on the device (scanning, OCR, saving, preferences) | Provision of the service you requested (Art. 6(1)(b)); no data is collected by the controller |
| Personalised ads and use of the advertising identifier | Consent (Art. 6(1)(a)), which may be withdrawn at any time |
| Non-personalised ads, frequency capping, fraud prevention | Legitimate interest in funding the free version (Art. 6(1)(f)), within the limits of the choices expressed in the consent dialog |
| Management of PRO subscriptions | Performance of a contract (Art. 6(1)(b)) and compliance with legal obligations (Art. 6(1)(c)) |
| Replying to email enquiries | Steps taken at the request of the data subject (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f)) |
| Delivery and security of the website | Legitimate interest (Art. 6(1)(f)) |
4. Recipients
Data may be processed by: Google (AdMob), as an independent controller; Apple and Google, for downloads and purchases through their respective stores, as independent controllers; RevenueCat, Inc. and Cloudflare, Inc., as processors. Data is neither sold nor disclosed to the public.
5. Transfers outside the EU
Google LLC, RevenueCat, Inc. and Cloudflare, Inc. are based in the United States. Transfers take place on the basis of the European Commission’s adequacy decision of 10 July 2023 (EU-US Data Privacy Framework), for providers certified under it, or of the standard contractual clauses adopted by the Commission (Art. 46 GDPR).
6. Retention
- Documents and preferences: on your device, until you delete them or uninstall the app (images saved to your gallery remain until you remove them).
- Subscription data held by RevenueCat: for the duration of the subscription and thereafter for as long as required by legal obligations or for the establishment or defence of legal claims.
- Advertising data: in accordance with the retention periods stated by Google in its privacy policy.
- Emails: for as long as necessary to handle the request and in any case no longer than 24 months.
- Website technical logs: for as long as strictly necessary for the security of the service.
7. Children
UltraScan is not intended for children under the age of 14. Ads are not designed for an audience of children.
8. Your rights
You may at any time request access to your data, rectification, erasure, restriction of processing and data portability, and object to processing based on legitimate interest (Arts. 15–22 GDPR); you may also withdraw your consent without affecting the lawfulness of processing carried out before its withdrawal. Write to dm@artisanlab.it. Since the app does not use accounts and the controller does not store your documents, for requests concerning subscriptions please state the store used and the date of purchase, so that we can identify them. For data processed by Google and Apple as independent controllers, you may also contact them directly.
You have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or with the supervisory authority of the EU country in which you live or work.
9. Security
Processing documents locally minimises the data that leaves your device. Communications with third-party services take place over encrypted connections (HTTPS). Since your documents are stored on the device, we recommend protecting your phone with a screen lock.
10. Changes
This policy may be updated, for example when new features are introduced or the law changes. The version in force is always published at this address, together with the date of the last update; in the event of significant changes, we will also let you know in the app.