Privacy Policy

Last updated: July 2026 · Compliant with GDPR and Dutch UAVG

1. Data Controller

ScrapperScan · The Netherlands · support@scrapperscan.com

ScrapperScan is the data controller responsible for your personal data as described in this policy.

2. Information We Collect & Legal Basis

We process the following personal data:

  • Account data (email address, display name): Collected when you create an account. Legal basis: Art. 6(1)(b) GDPR — necessary to perform the contract.
  • Collectible images (Disney pins and Disney Lorcana trading cards): Photos you submit are transmitted to our AI analysis provider for analysis. Not stored on any ScrapperScan server after analysis. Legal basis: Art. 6(1)(b).
  • Scan results (item name, score, verdict, AI reasoning, marker results, date, and — where available — a market value estimate): Stored locally on your device. A copy of the scan result — never your photos — is also stored on our EU-hosted server, linked to your account, to support service features and quality monitoring, and is deleted when you delete your account. Legal basis: Art. 6(1)(b) and Art. 6(1)(f) — legitimate interest in monitoring and improving result quality.
  • Daily scan counter: An integer tracking how many scans you have used today, stored on your device. Legal basis: Art. 6(1)(f) — legitimate interest in enforcing fair-use limits.
  • Training data (optional, consent-based): If you opt in via the 'Help improve ScrapperScan' toggle, your pin scan images and analysis results are stored on our secure EU-hosted servers and may be used to train a future ScrapperScan AI model. Legal basis: Art. 6(1)(a) GDPR — your explicit consent. You can withdraw at any time by toggling off 'Help improve ScrapperScan'; withdrawal does not affect scans already submitted.
  • Scan feedback (optional): If you submit a thumbs-up or thumbs-down verdict on a scan result, that feedback (a single 'up' or 'down' value) is stored on our servers associated with the corresponding scan record. Used solely to evaluate and improve the accuracy of the AI model. Legal basis: Art. 6(1)(f) GDPR — legitimate interest in improving service quality. Feedback is deleted when you delete your account.
  • Usage analytics: We collect pseudonymous app-usage events (screens viewed, feature taps, scan funnel steps) via Google Analytics for Firebase to understand and improve how the app is used. These events never include your images or scan content. Legal basis: Art. 6(1)(f).

We do not collect location data, contacts, or any data beyond what is listed above. Advertising identifiers are used only if you allow tracking in the iOS App Tracking Transparency prompt, and only to serve ads to free-tier users.

3. Third-Party Processors

  • Authentication provider (EU-based): Stores email and display name for account management. Subject to the EU–US Data Privacy Framework.
  • AI analysis provider (USA): Receives pin images for AI analysis. Transferred under Standard Contractual Clauses (SCCs) per GDPR Art. 46(2)(c).
  • Cloud storage provider (EU data region): Stores optional training data for consenting users, exclusively in the EU region.
  • Advertising provider (Google AdMob, USA): Serves banner and rewarded ads to free-tier users. Uses the advertising identifier only if you allow tracking via the iOS App Tracking Transparency prompt; otherwise ads are non-personalised.
  • Analytics provider (Google Analytics for Firebase, USA): Processes pseudonymous app-usage events under the EU–US Data Privacy Framework and Standard Contractual Clauses.
  • Market data providers (USA): To display market value estimates, our server queries third-party marketplace APIs — the eBay Browse API for pins and card price databases for Lorcana cards — using only the identified item's public name or design. Your photos, account data, and personal data are never shared with these providers.
  • Card catalogue provider (Lorcast): When you scan a Lorcana card or browse a card set, the app requests public catalogue data and card images directly from the Lorcast API. As with any internet request, that provider receives your device's IP address; no account data or scan content is sent.
  • App store and payment provider: Handles subscription billing through the App Store.

We do not sell your personal data to any third party.

4. Data Storage & Retention

  • Collectible images are stored exclusively on your device (unless you opt in to training data). Scan results are stored on your device, and a copy of each result (never the photos) is kept on our EU-hosted server linked to your account until you delete the scan or your account.
  • Free-tier users: Scan results older than 90 days are automatically deleted from your device.
  • Premium users: Scan results are retained on your device until you delete them or delete your account.
  • Account data: Retained until you delete your account.
  • Training data (consent-based): Retained for as long as needed to train and improve the model. Request deletion at support@scrapperscan.com.
  • All locally stored data is permanently removed when you delete your account or uninstall the app.

5. Your Rights Under GDPR

  • Access (Art. 15): View all scan data in the History tab at any time.
  • Rectification (Art. 16): Update your display name via Profile > Edit Profile.
  • Erasure (Art. 17): Delete individual scans, all scans, or your entire account via Profile.
  • Restriction (Art. 18): Contact support@scrapperscan.com.
  • Data portability (Art. 20): Export all scan data as JSON via Profile > Export My Data.
  • Object (Art. 21): Contact support@scrapperscan.com.
  • Withdraw consent: Delete your account at any time.
  • Lodge a complaint: Autoriteit Persoonsgegevens, Postbus 93374, 2509 AJ Den Haag · www.autoriteitpersoonsgegevens.nl · +31 70 888 8500

6. Automated Decision-Making

ScrapperScan uses AI to generate an authenticity score and verdict (Art. 22 GDPR disclosure). This does not produce legal effects or similarly significant effects on you. The score is informational only.

7. Data Security

  • All communication with third-party processors uses HTTPS/TLS encryption.
  • Account credentials are managed by our authentication provider and never stored in plaintext.
  • Scan data is stored in your device's private application sandbox.
  • The app uses Google AdMob (free tier) and Firebase Analytics; no personally identifiable information is included in analytics events, and tracking requires your explicit App Tracking Transparency permission.

8. Children's Privacy

Not directed at children under 16 (Dutch UAVG Art. 5). Contact support@scrapperscan.com if you believe a child under 16 has registered.

9. Changes to This Policy

Material changes will be notified via in-app notice with an updated 'Last updated' date.

10. Contact & Complaints

support@scrapperscan.com · We will respond within 30 days (GDPR Art. 12).