Privacy Policy

Data Controller

The data controller for the RealScan platform is Lemorange Ltd, a company incorporated in the Republic of Cyprus. You can contact us at [email protected] for all data-related enquiries.

What We Collect

• Account details: your name, email address and a securely hashed password.
• Uploaded financial documents and their images: invoices, receipts, bank statements, credit notes and any other documents you submit for processing, together with the structured data extracted from them.
• Camera access (mobile app): used only to capture document photos within the RealScan app. Images are uploaded immediately to your account; they are not stored locally on the device beyond the active capture session.
• Location data (optional, opt-in only): approximate or precise GPS coordinates, used only to embed a geotag in document captures when you enable that feature. We do not track your movements.
• Device, usage and diagnostic data: device type, operating system version, app version, feature-usage telemetry and error logs, used to maintain and improve the service.

Why We Use It and Our Legal Bases

We process personal data for the following purposes and on the following legal bases under GDPR Article 6:

• Providing the service: processing data is necessary to fulfil our contract with you (Article 6(1)(b)).
• Document processing and posting: reading, classifying and posting documents to your accounting system - the core function of the service (Article 6(1)(b)).
• Customer support: responding to your help requests and resolving issues (Article 6(1)(b)).
• Security and fraud prevention: protecting the service, our users and the integrity of financial data (Article 6(1)(f) - legitimate interests).
• Legal compliance: meeting applicable legal obligations, including responding to lawful regulatory requests (Article 6(1)(c)).

Sub-processors

We use the following categories of third-party processors to deliver the service: cloud document processing and OCR services; cloud hosting and storage infrastructure. All processors are contractually bound to handle your data only on our instructions and to maintain appropriate security measures. We use providers based in the EU or covered by an adequacy decision or Standard Contractual Clauses. Data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256).

Third-party AI processing

RealScan reads documents and answers questions about them with third-party AI services: Microsoft (Azure AI Document Intelligence), Mistral AI and Anthropic. They receive the documents and questions you upload only so RealScan can read them for your company's account. The mobile app asks for your permission before sending anything, and you can withdraw it at any time in More, Privacy & data, Document processing.

International Transfers

We store and process your data within the EU/EEA. Where any sub-processor operates outside the EEA, we ensure appropriate safeguards are in place under GDPR Chapter V, including Standard Contractual Clauses or reliance on an adequacy decision by the European Commission.

How Long We Keep Your Data

• Account data: retained for the duration of your subscription, plus 30 days after account closure, then permanently deleted.
• Uploaded documents and extracted data: retained according to your configured retention policy. The default is 7 years, aligned with Cyprus and UK statutory requirements for financial records.
• Backup copies: deleted within 90 days of the document's retention date.
• You may request earlier deletion at any time - see your rights below.

Your Rights

Under GDPR you have the right to access, correct, erase and port your data, and to object to or restrict certain processing. You can download a copy of your data at any time in the app (More, Privacy & data, Your data). To delete your account, request it there or follow these steps; your firm completes the request, and accounting records stay with your company for the period the law requires. To exercise any right, contact us at [email protected] - we will respond within one calendar month. You also have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection in Cyprus (dataprotection.gov.cy) or with the supervisory authority in your country of residence.

Security

We protect your data with encryption in transit and at rest, role-based access controls, full audit logging of every data change, and security controls designed to ISO 27001 standards. We conduct regular security assessments and notify affected users of any breach as required by GDPR Article 33.

Children

RealScan is a professional accounting and document-management tool. It is not directed to children under the age of 18, and we do not knowingly collect personal data from children.

Mobile Application - Device Access

The RealScan Android app is built to request as little device access as possible.

• Camera: used to photograph documents. Capture is handled by Google's on-device document scanner (part of Google Play services), so the image is taken within that secure Google component. Captured images are uploaded to your account and are not kept on the device beyond the capture session.
• Local network: if you use the in-app scanner feature, the app looks for compatible scanners on your local network (for example an office multifunction printer/scanner) so it can import scanned pages. This traffic stays on your local network.
• Location (optional): requested only if you turn on Add GPS to scans in Settings, to tag captures with a location for audit trails. You can decline and the app works fully without it, and revoke it anytime in Android settings.
• Minimal permissions: the app does not request contacts, microphone or standalone storage permissions. On the network it declares only internet access.

Google Drive Data

When you connect a Google Drive folder to RealScan, our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• What we access: we request only the drive.file scope. This gives us access to the folders and files you explicitly select through the Google file picker, and to files later placed in those folders. We cannot see the rest of your Google Drive.
• Why we access it: to import your documents into the company you connected them to, so they can be read, indexed and prepared for bookkeeping.
• What we store: the document itself in your RealScan account, together with the Drive file identifier, file name and modification time so the same file is never imported twice. We also store an encrypted OAuth refresh token so the folder can continue to be checked for new files.
• What we never do: we do not transfer Google user data to third parties other than the processors listed above, do not use it for advertising, do not sell it, do not allow humans to read it except where you ask us to for support or where the law requires it, and do not use it to develop, improve or train generalised artificial-intelligence or machine-learning models.
• How to revoke: disconnect Google Drive from the company page in RealScan, or revoke access at myaccount.google.com/permissions. On disconnection we delete the stored token and stop checking the folder. Documents already imported remain in your account until you delete them.

Changes to This Policy

We may update this policy from time to time. We will note the new effective date at the top of this page. For material changes we will notify you by email at least 14 days before the change takes effect.

Contact

Lemorange Ltd - [email protected]