This notice explains how we process personal data under Regulation (EU) 2016/679 (GDPR) and, for users in the United Kingdom, the UK GDPR and the Data Protection Act 2018. If you are in Türkiye, the Turkish notice under Law No. 6698 applies — see Türkçe.
Ali Bulut
E-mail: info@scannpost.com
We have not appointed a Data Protection Officer; data protection questions go to the contact details above.
| Category | Examples | Source |
|---|---|---|
| Identity and contact | Name, e-mail, phone, company name, tax number, address | Sign-up form, Companies page |
| Financial documents | Images of receipts, invoices, daily close reports and bank statements you upload, and the amount, date, vendor and VAT data read from them | Document upload, e-mail intake |
| Bank details | IBAN, bank/branch, account type; optional bank API credentials (encrypted) | Bank Accounts page |
| Third-party data | Names, tax numbers and addresses of your customers and suppliers, taken from the invoices you issue or receive | Invoicing, document reading |
| Usage and technical | Sign-in records, IP address, device/browser information, audit log | Automatic |
| Payment | Subscription and credit purchase records; card details stay with the payment provider and never reach us | Payment provider |
Where you upload documents containing other people's data, you are the controller for that data and we act as your processor (Art. 28). Ask us for a data processing agreement using the contact details above.
Documents you upload are sent to an AI model provider, acting as our processor, to extract fields such as amount, date and VAT. The provider uses the data only for that request and does not use it to train models. No decision with legal or similarly significant effect is made automatically: every reading is shown to you and you confirm or correct it (Art. 22 does not apply).
Some processors (AI model provider, hosting) may process data outside the European Economic Area and the United Kingdom, including in Türkiye and the United States. Such transfers are based on the European Commission's standard contractual clauses (Art. 46(2)(c)) and, for data from the UK, the UK International Data Transfer Addendum, together with supplementary technical measures (encryption in transit, access control). A copy of the safeguards is available on request.
Accounting records are kept for 10 years to meet commercial and tax retention duties. When you delete your account, it is deactivated at once and can no longer be used to sign in. Records we must keep by law are kept until the retention period ends; your other personal data is deleted or anonymised on request or when that period ends. In the UK, accounting records are kept for at least 6 years.
Data is transmitted over encrypted connections (TLS). Bank API credentials are encrypted with AES-256-GCM and are never displayed again. Access is role and permission based, and administrative actions are written to an audit log.
You have the right of access, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interests. Where processing rests on consent, you may withdraw it at any time without affecting prior processing. Write to info@scannpost.com; we answer within one month.
You also have the right to lodge a complaint with a supervisory authority in the EU member state of your residence, workplace or the alleged infringement (Art. 77). In the United Kingdom, the supervisory authority is the Information Commissioner's Office (ICO, ico.org.uk).
The identity, company and document data needed to run the service is required to enter into and perform the contract; without it we cannot provide the service. Everything else is optional.
The web application uses only strictly necessary cookies and local storage, for your session and your language choice. There are no advertising or tracking cookies, so no consent banner is required.
Updates to this notice are published on this page; significant changes are announced in the application.