Privacy Policy

Last Updated: April 17, 2026 · Effective Date: April 17, 2026

🔒 Privacy First — Our Core Commitment: DocuScanPro does not permanently store your uploaded documents or processed images. All image data is handled in transient memory during processing and purged upon session completion. We do not sell your personal data to any third party.

1. Who We Are

DocuScanPro ("we", "our", or "us") operates the document scanning and enhancement service available at https://www.docuscan.pro. This Privacy Policy explains how we collect, use, disclose, and protect information about you when you use our Service.

For privacy-related questions or requests, please . We respond to all inquiries within 48 business hours.

2. Information We Collect

2.1 Information You Provide

Account Information: If you register or sign in with Google via Supabase Auth, we receive your email address, display name, and profile photo URL from Google's OAuth service.
Payment Information: If you subscribe to a Pro plan, payment is processed entirely by PayPal. We never receive or store your credit card number, bank details, or financial credentials.
Support Communications: If you contact us, we retain your email address and the content of your message to resolve your inquiry.

2.2 Information Collected Automatically

Device ID: A randomly generated, anonymous identifier stored in your browser's localStorage to track free-tier quota usage and queue priority. It contains no personally identifiable information.
Usage Analytics: Anonymized page view and interaction data collected via Google Analytics (GA4), including pages visited, time on site, and general geographic region (country-level only). No personally identifiable data is shared with Google Analytics.
System Logs: Server-side logs may temporarily record IP addresses, request timestamps, HTTP method and status, and user agent strings for security monitoring and error diagnosis. These logs are retained for a maximum of 30 days.
Cookies & Local Storage: We use session cookies for authentication (managed by Supabase) and browser localStorage for quota tracking and user preferences. We do not use advertising cookies or third-party tracking pixels.

2.3 Image Data Handling

Images you upload are processed in real-time and are NOT stored. Images exist in server memory only for the duration of the processing task (typically under 10 seconds). No image files are written to persistent disk storage. Processed outputs are returned directly to your browser and are inaccessible after the connection closes.

3. Data Summary Table

Data Type	Purpose	Retention
Account email & profile	Authentication, subscription linkage	Until account deletion
Device ID (anonymous)	Free quota tracking & queue tier identification	Until localStorage is cleared
Queue position counter	Fair-use queue management (in-memory only)	Not stored — reset on server restart
Uploaded images	Document processing only	Not stored — purged after processing
Processed images	Returned to user browser	Not stored — purged after delivery
Payment records	Billing & dispute resolution (via PayPal)	Managed by PayPal; receipts retained 7 years per law
Analytics data	Product improvement (anonymized)	Governed by Google Analytics retention settings (26 months max)
Server logs	Security & error monitoring	Maximum 30 days, then purged
Support messages	Customer service resolution	Up to 2 years or until resolved

4. How We Use Your Information

We use collected information exclusively for the following purposes:

To create and manage your account and authenticate your sessions.
To process your uploaded images and deliver results.
To manage and verify your subscription status.
To enforce free-tier usage quotas and prevent abuse.
To determine your processing queue tier (free serial queue vs. Pro priority queue) based on subscription status and anonymous Device ID.
To diagnose technical errors and improve processing performance.
To respond to your support requests.
To analyze aggregate, anonymized usage patterns to improve the Service.
To comply with applicable legal obligations.

We never use your data for advertising profiling, cross-site tracking, or selling to data brokers.

5. How We Share Your Information

We do not sell, rent, or trade your personal data. We share information only in the following limited circumstances:

Supabase (Authentication provider): Your authentication credentials are securely managed by Supabase under their data processing agreement. (Supabase Privacy Policy)
PayPal (Payment processor): Subscription transactions are processed by PayPal. We share your email address with PayPal solely to identify your subscription. (PayPal Privacy Policy)
Google Analytics: Anonymized, aggregated analytics data is shared with Google Analytics for usage reporting. IP addresses are anonymized before transmission. (Google Privacy Policy)
Cloudflare Turnstile: Used for bot detection on form submissions. Minimal interaction data may be processed by Cloudflare.
Legal requirements: We may disclose information if required by law, court order, or a legitimate governmental request, or to protect the rights, safety, or property of DocuScanPro or its users.

6. Data Security Measures

We implement multiple layers of technical and organizational measures to protect your data:

TLS/HTTPS Encryption: All data in transit between your browser and our servers is encrypted using industry-standard TLS 1.2+.
Isolated Processing: Image processing occurs in sandboxed, ephemeral server environments to prevent cross-user data leakage.
Access Controls: Internal access to production systems is restricted to authorized personnel only, with multi-factor authentication required.
No Persistent Image Storage: By design, we never write uploaded or processed images to persistent databases or file systems.
Dependency Auditing: We regularly audit third-party software dependencies for known security vulnerabilities.

Despite these measures, no internet transmission or electronic storage is 100% secure. You use the Service at your own risk as described in our Terms of Service.

7. Cookies & Tracking Technologies

We use the following types of browser storage and cookies:

Essential Session Cookies: Managed by Supabase for login session management. Required for authenticating your account.
localStorage (Device ID): Stores your anonymous device identifier for quota tracking. Not a cookie — cleared with browser data.
Analytics Cookies (Google Analytics): Used to collect anonymized usage statistics. You can opt out via Google's opt-out browser add-on.

We do not use advertising cookies, retargeting pixels, or any cross-site tracking technologies. Most browsers allow you to control or disable cookies through their settings.

8. Your Rights & Choices

Depending on your jurisdiction, you may have the following rights regarding your personal data:

Right to Access: Request a copy of the personal data we hold about you.
Right to Correction: Request correction of inaccurate or incomplete personal data.
Right to Deletion: Request deletion of your account and all associated personal data. Note: anonymized analytics data and legally-required payment records cannot be deleted.
Right to Data Portability: Request your data in a structured, machine-readable format.
Right to Restrict Processing: Request that we limit how we use your data.
Right to Object: Object to certain types of data processing where applicable.
Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting prior processing.

To exercise any of these rights, please and we will respond within 30 days (or as required by law).

9. GDPR & CCPA Compliance

9.1 For EU/EEA Residents (GDPR)

Our lawful basis for processing your personal data includes: (a) contract performance — processing necessary to provide the Service; (b) legitimate interests — security monitoring and fraud prevention; (c) consent — analytics cookies and marketing communications. You have the right to lodge a complaint with your local supervisory authority.

9.2 For California Residents (CCPA/CPRA)

DocuScanPro does not sell personal information as defined under the CCPA. California residents have the right to know what personal information is collected, request deletion, and opt out of data sharing for advertising purposes. To submit a CCPA request, please .

10. Children's Privacy

DocuScanPro is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal information, we will delete it promptly. If you believe a child has submitted data to us, please contact us immediately.

11. Data Retention

We retain personal data only for as long as necessary for the purposes described in this policy, or as required by law. Specific retention periods are detailed in the Data Summary Table in Section 3. When data is no longer required, it is securely deleted or anonymized.

12. International Data Transfers

Your data may be processed in countries outside your country of residence, including the United States. We ensure that any such transfers comply with applicable data protection laws through appropriate safeguards, such as standard contractual clauses where required.

13. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices or applicable law. We will notify you of material changes by updating the "Last Updated" date at the top of this page. For significant changes, we may also notify you by email (if you have an account) or via a notice on our website. Your continued use of the Service after changes become effective constitutes acceptance of the updated policy.

14. Contact Us

For any privacy questions, data access requests, or concerns, please .

For formal legal or regulatory correspondence, please use the subject line: "Privacy Request – [Your Name]" in your message.

We are committed to resolving all legitimate privacy inquiries promptly and transparently.