What we hold,
and what we never touch.

The short version

• Scanned documents never reach us. The image travels between the browser and the service on the same machine, and nowhere else.
• The contact form sends us your name, email, optional domain and message, by email. Nothing about it is stored in a database.
• The site sets no cookies, runs no analytics, and loads nothing from another company's server.
• The licence service, which runs only after you buy or trial the product, checks the key every twelve hours and writes a log line each time. That line contains an IP address.
• Nothing is deleted on a schedule. Read the retention section, it is the part most people care about.

Who to contact

Write to hello@scanbridge.dev. That address reaches the people who run ScanBridge, and it is the address to use for any request about your data, including asking for a copy of it or asking for it to be deleted.

Scanned documents

This is the part the product exists for, so it comes before everything else.

When a page scans through ScanBridge, the browser talks to a small service installed on the same Windows machine, over plain HTTP on 127.0.0.1. That address never leaves the computer, it is not routed to a network. The image comes back into the page in your own application, and what happens to it after that is entirely your application's business.

We never receive the image, the file, the page count, or the name of the document. There is no upload step, no processing on our side, and nothing to opt out of, because the path to us does not exist.

The contact form

The form on the front page sends four things you type, plus which of the four subjects you picked:

• your name
• your email address
• the domain the licence should run on, optional
• your message, optional

These are composed into an ordinary email and sent to hello@scanbridge.dev. The email also carries the time it was sent and the IP address the form was submitted from. Nothing is written to a database, and the site has no account system, so there is nothing to log into and nothing stored under your name.

Access to that mailbox is limited to the people who work on ScanBridge. Messages are kept, see the retention section below.

One technical detail, for completeness

To stop the form being used to send floods of mail, the server counts submissions per visitor for one hour. It does this by writing a small temporary file whose name is a one way hash of the IP address, and the file contains nothing but timestamps. The address itself is never written to disk in readable form, and these files are deleted automatically after two hours.

The licence service

This applies only after you have a key. It has nothing to do with visiting this website.

The installed service checks that its licence is still valid. Every twelve hours it sends one request to our licence server containing four things:

• the licence key
• the origin, meaning the web address of the application that is using it
• a machine identifier
• the product version

The machine identifier is a one way fingerprint built from the computer name, the Windows user name and the platform. It cannot be turned back into those values. It exists so that a licence can be recognised as the same installation rather than a new one. If the browser does not send an origin, the computer name is sent in its place.

Our licence server writes one log line for each of those calls. The line holds the time, the licence key, the customer name, the calling domain, the outcome, and the IP address the request came from. An IP address counts as personal data under the GDPR, which is why it is named here explicitly rather than folded into a phrase about technical data.

Cookies, tracking and other companies

There are none, and this is deliberate rather than an oversight.

• No cookies are set. That is why you were not asked to accept any.
• No analytics, no tracking pixels, no advertising, no social widgets.
• The typefaces are served from this domain, not from a font service, so opening the page contacts no one but this server.
• Nothing is sold, rented or shared with anyone for marketing.

The server that hosts this site keeps ordinary web server logs, as every web server does. We do not use them to build a picture of who visits.

How long things are kept

The temporary rate limiting files described above are the exception: they are removed automatically within two hours.

Your rights

If you are in the European Union or the United Kingdom, the law gives you the right to ask for a copy of the personal data we hold about you, to have it corrected, to have it deleted, to restrict or object to how it is used, and to receive it in a portable form. You also have the right to complain to your national data protection authority.

Every one of those requests goes to the same place: hello@scanbridge.dev. We will answer within one month.

Changes to this page

If what we collect changes, this page changes with it, and the date at the top changes too. There is no mailing list, so the date is the honest way to tell whether anything moved.