Privacy policy

Who is responsible

The controller within the meaning of the GDPR is Scan my Home GmbH, Millennium City, Handelskai 94/Stiege 4/5. OG, 1200 Wien, Österreich. Please send data protection enquiries to office@scanmyhome.de.

We have not appointed a data protection officer, because the conditions of Article 37 GDPR are not met.

What we process data for, and on what legal basis

Every processing activity needs a basis in law. Here are ours, each with the provision we rely on:

• Account and sign-in, credit, creating a report. This is performance of the contract with you, Article 6(1)(b) GDPR. Without this data we cannot provide the service you ordered.
• Invoices, bookkeeping, retention. Legal obligation, Article 6(1)(c) GDPR, in conjunction with the statutory tax retention periods.
• Enquiries through the contact form or the assistant. Legitimate interest, Article 6(1)(f) GDPR, namely answering your enquiry; if the enquiry leads to a contract, then (b) applies instead.
• Operation, security, abuse prevention (server logs, a log of sign-in attempts, throttling automated requests). Legitimate interest, Article 6(1)(f) GDPR: being able to run a service that is not overrun.
• Newsletter. Your consent, Article 6(1)(a) GDPR. Your address only goes onto the list after confirmation: you enter it, we send you an email with a link, and only your click on that link switches sending on. The link is valid for seven days. Until you click it, nothing happens, and entering someone else's address achieves nothing. For every confirmation we record when it happened, which wording you agreed to and on which page. You can withdraw consent at any time with effect for the future. The footer of every newsletter email carries an unsubscribe link that takes you to a page with exactly one button; no reason is needed. An informal message to office@scanmyhome.de works just as well. We record when you unsubscribed, so we can prove it.
• If you let us remember where you are (the save box). Your consent, Article 6(1)(a) GDPR, and for storing the identifier on your device, additionally section 165(3) of the Austrian Telecommunications Act 2021 or section 25(1) TDDDG. You are asked at exactly one point, namely while a check is running, and not when you enter the site. Declining is exactly as quick there as agreeing, both answers look the same, and nothing happens if you do not answer at all. We record when you answered, which version of the text and for which purposes, plus country, language and the page on which you were asked. This record contains no name, no email address and no IP address. You can withdraw at any time, without giving a reason, through the button on the cookie page; it deletes both cookies and the save box immediately. What is kept in the save box, and what is expressly not, is also set out there.
• Counting visits to our site. Legitimate interest, Article 6(1)(f) GDPR, namely recognising where our service is unclear. This count does not access anything on your device and sets no cookie; it runs entirely on our own server, which is why no consent under section 165 of the Telecommunications Act or section 25 TDDDG is needed here either. The value used to label a session includes the calendar date, so the same person counts as a different session the next day. No personal profile is created, and none is possible. If we ever want to add up several days, we ask you first; that is the second question in the save prompt and is then based on your consent, Article 6(1)(a) GDPR.

We derive any estimate of how far along someone is in their journey solely from these steps. We do not use any characteristics of your person for this: no age, no income, no purchasing power, no bought-in data.

This estimate only decides which notice we show you. It has no legal effect and in particular does not affect your price; there is no automated decision within the meaning of Article 22 GDPR.

You are not obliged to give us data. Without an email address there is no account, and without property data there is no analysis. Phone number and date of birth are voluntary, more on that below.

What data is processed

For an analysis we process the property data you provide (link, text, photos, uploaded documents) plus technically necessary server log data. Photos and documents are used exclusively to create your report.

When you create an account, we store your email address, your password (only as an irreversible hash, never in plain text), your name and your country. We need the name for the greeting, and the country determines which legal system and which official registers apply to your analysis.

Phone number and date of birth are voluntary: we use the number only for queries about a running analysis, and the date of birth only if a payment ever needs to be checked. If you leave both blank, everything still works. You can view, change and delete all of this data, together with your account, at any time.

In addition, the account stores the language we write to you in. We set it once when the account is created, either from your country or from the language version of this site on which you signed up.

It is used solely to write our messages to you in that language and is not passed on to anyone. If you want to change it, reply to one of our emails or write to office@scanmyhome.de.

AI processing

To create the analysis, property data is sent to an AI provider with a seat in the United States and processed there on our behalf. The same applies to what you type into the assistant's question field on the site. Your IP address and your email address are not transmitted in the process. Do not submit documents containing personal data of third parties unless you are authorised to do so.

Your data does not train any AI model. Under contract, the provider may not use the submitted content to train its models, and we ourselves do not train any model of our own with your property data, documents or questions.

No machine makes a decision about you in the end. The analysis assesses a property, not a person. There is no automated decision within the meaning of Article 22 GDPR that produces a legal effect on you, and no profiling of you as a person. What the report contains is an assessment of the matter, which you can query and should have checked.

Who else gets to see data

We do not sell data and do not pass anything on for advertising purposes. Here are exactly the places data goes to in the course of operating the service:

• AI provider (United States) for the actual analysis and for the assistant. The property data and your question are transmitted, not your email address.
• Image AI provider (United States), but only if you have a photo enhanced. In that case exactly that photo is transmitted, nothing else.
• Hosting and email providers in the European Union, who run the site and send messages on our behalf.
• The payment provider (paddle) for topping up credit. You enter your payment details there, not with us: we see neither your card number nor your account details, only that and how much a payment has arrived.
• Map services when you open the “Location” tab, see the dedicated section above. These requests are made by your browser.
• Authorities and courts, when we are legally obliged to.

We store your account and your reports in the European Union.

Transfers to countries outside the EU

Recipients in the United States are the AI provider, for the map image an aerial imagery provider and, if you have a photo enhanced, the image AI provider. The basis is the European Commission's standard contractual clauses under Article 46 GDPR. Only what is needed for the respective service is transmitted, not your account data.

If you have a photo enhanced

In a report you can have your own photo enhanced, for example to see a room renovated, cleared out or newly furnished. For this we send this photo and your instruction to an image AI provider based in the United States, without your IP address. This only happens after your explicit click on this feature. Please do not upload photos in which people are recognisable for this feature.

Maps and address search

On the “Location” tab of a report your browser shows a map whose images and data it fetches directly from mapping services. These providers learn your IP address, the map section shown and the address being searched for. Those involved are an aerial imagery provider based in the United States, services built on OpenStreetMap and, if you switch on an additional layer such as flood risk or noise, the official mapping services of the respective country. No map is loaded on any other page. For the map image in the report file, only the location of the property goes to the mapping services, not your IP address.

Who can see your report

A finished report has a long, random number, and this number is also the key: whoever has the link can see the report. It is built this way so you can pass it on without detours, to your bank, your accountant, an agent or your family. The recipient does not need to sign in for this.

Nobody can guess the number; it consists of 32 characters. Even so, treat the link like the paper it replaces: whoever shares it in a group shares the whole report, including address and figures. In your account you can delete any report yourself at any time, after which a link that has been passed on also leads nowhere.

How long we keep things

• Account and master data: for as long as your account exists. Delete it, and this data is gone too, see below.
• Reports: 12 months after creation, after which we delete them automatically. Before then you can delete them yourself at any time or save them as a PDF.
• Invoices: seven years. This is not our decision but a statutory tax retention duty; Article 17(3)(b) GDPR excludes exactly this kind of data from erasure. When an account is deleted, the link to the person is cut in the database, but the recipient recorded on the invoice remains.
• Questions to the assistant: at most 90 days, then deleted automatically.
• Enquiries by form or email: until the matter is resolved, then within the usual commercial-law time limits.
• Save box: 180 days after your last visit, then it is deleted. If you withdraw beforehand, it is gone immediately. The identifier on your device expires by itself after twelve months.
• Proof of your consent (time, version of the text, purposes, country, language, page): three years. It deliberately survives a withdrawal, because under Article 7(3) sentence 2 GDPR the processing remains lawful until the withdrawal, and this must still be provable afterwards too. It contains no name and no email address.
• Visit counts: the entries contain no link to a person, because the value that labels a session contains the calendar date and cannot be reversed. They are kept as statistics.
• Log of sign-in attempts (time, email address, success or failure, IP address): this serves security, for example to detect password guessing. We delete it automatically after 90 days. Server logs: for as long as they are needed for operation and security. On request we delete your entries.

If you write to us

If you write to us through the contact form, or pass a question from the assistant on to us, your message, together with your email address, goes to our own mailbox at office@scanmyhome.de. We store it there until your enquiry is resolved and use the details only to answer you.

The assistant on the site

If you ask the assistant on the website a question, we store your question and its answer for a limited time, to improve the service.

We do not store an IP address for this, only a random session value that changes daily. We delete these logs automatically after 90 days at the latest. Please do not enter personal data of third parties, or particularly sensitive information, into the question field.

Cookies and local storage

This site does not use cookies to analyse your behaviour, and no advertising cookies. No third-party tracking or advertising services are embedded either.

The fonts are shipped with our own server, so no request goes out for them. This does not apply to the maps; everything about that is in the section "Maps and address search".

If you only look at one page, almost nothing is set. With one exception, every cookie that can occur is technically necessary; the exception only arises if you agreed to the save prompt. Each one is listed by name, purpose and duration in the cookie policy. The most important are:

• scanmyhome-land and scanmyhome-sprache remember the country you select above yourself. Currency, the figures shown and the language depend on this. They are only set once you select a country, last a year and are not passed on to anyone.
• immolens_session keeps you signed in. It is only set when you sign in, cannot be read by scripts in the browser, and is deleted when you sign out.
• ds_besucher is a random number with no link to your person. It ensures the questions to the chat are counted per visitor rather than for everyone together; without it, one person could use up the daily allowance for everyone else. It cannot be read by scripts in the browser and is used for nothing else.
• smh_einwilligung and smh_merker only come into being once you have answered the save prompt. The first records your answer, including a “no”, so you are not asked again. The second is a random number pointing at your save box with us, and only arises on a “yes”. Both last twelve months, cannot be read by scripts in the browser and are deleted immediately on withdrawal.

In addition, your browser keeps some things only with itself: the country selected, the state of an analysis currently in progress (so it is not lost after a reload) and your changes in the floor plan editor. This data does not leave your device.

For operating the service itself we do not show you a consent window, since only technically necessary data is stored for that. There is therefore no window when you enter the site. You are asked at exactly one point, namely during a running check, and there it is only about the save box. Declining there is as quick as agreeing, and nothing happens if you do not answer.

How we protect your data

We protect your data with appropriate technical and organisational measures under Article 32 GDPR, among other things with encrypted transmission (HTTPS) and passwords that are stored only as an irreversible hash.

Your rights

You have the right to access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and to object to processing we base on a legitimate interest (Article 21). You can withdraw a consent you have given at any time for the future (Article 7(3)).

You can exercise two of these rights yourself, immediately and without waiting: in your account, under “Data protection”, you can download all your data as a file and also delete your account together with your reports there. For everything else, an informal message to office@scanmyhome.de is enough. We reply within the statutory period of one month, usually much faster.

If you think we are not handling your data correctly, you can complain to a supervisory authority (Article 77 GDPR). The authority responsible for us is the Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Wien, Österreich, dsb@dsb.gv.at, www.dsb.gv.at. You can also contact the authority of your own country of residence.