Privacy

Nimavera Inc. (in formation), operating Scopecanon. Data protection enquiries: privacy@scopecanon.com. A postal address for service of notice is available on request at privacy@scopecanon.com.

Names pasted into the public estate check are matched and returned within the request, and are not written to any database. They are a map of your software estate and therefore commercially sensitive; keeping them would make that page a liability rather than a lead.

Because the result is a URL you can send to a colleague, the list does travel in the query string — which means it reaches our server logs, retained for 14 days for security and then discarded.

We hold your name, email address, hashed password, organisation, role and locale, in order to provide the service — the lawful basis is performance of a contract.

We hold your register: the software you recorded, the classifications your people confirmed, and the evidence you attached. We process this as your processor, on your instructions, under the terms in the DPA.

We hold an audit trail of state-changing actions — who confirmed what, and when. That is the point of the product, and it is also a legitimate interest in being able to show the register was not altered without record.

No advertising, no profiling, no selling or sharing of personal data, no third-party analytics that tracks you across sites. The marketing site loads no third-party script at all and the fonts are self-hosted, specifically so that reading this page does not disclose your IP address to anybody else.

We do not use your register to train models, and we do not read it except where you ask us to for support.

Account and register data: for as long as the account is open, then 30 days, then deleted. Audit entries survive the deletion of the user they name — the entry is retained with the actor reference removed, because a deletion log that can itself be deleted is not a log. Server logs: 14 days. Invoices: as long as tax law requires.

Access, rectification, erasure, restriction, portability and objection, under the GDPR. Write to privacy@scopecanon.com and we will answer within 30 days. You may also complain to your supervisory authority; in Spain that is the AEPD.

Account deletion is self-service and actually deletes — it is not a flag. Before the irreversible step the product shows you exactly what will be destroyed, counted by type.

The application, the database and the backups are hosted in the European Union. The subprocessors are named in the DPA. Some are US companies (email delivery, payments, object storage), and the operator is established in the United States; where personal data is transferred to or accessed from outside the EEA, the transfer relies on the European Commission’s standard contractual clauses.