Privacy Policy

Effective Date: August 2026

LectraScan AI ("LectraScan", the "Service") is operated by Cien Rios LLC ("Cien Rios", "we", "us"). This policy explains what we collect when you use the LectraScan mobile app and website, why we collect it, who processes it on our behalf, how long we keep it, and the choices you have.

1. Who LectraScan is for

LectraScan is an educational and informational tool for lecturers, teachers, and tutors. It transcribes handwritten or printed documents, produces an AI-assisted "clarity" rewrite, and can machine-translate the result. Accounts are limited to educators aged 18 or older who confirm at sign-up that they are authorized to process the documents they upload. The Service is not directed to children, and we do not knowingly create accounts for anyone under 18.

2. Information we collect

• Account data — email address, display name, hashed password, optional multi-factor authentication settings, and sign-in timestamps.
• Documents you upload — page images you capture or import, plus the OCR text, AI clarity rewrites, translations, and any corrections you make. These may include personal data of students or other third parties (for example a name on a page).
• Organization data — class, assignment, and student names you enter to organize scans.
• Subscription data — plan identifiers, entitlement status, and purchase events from Apple, Google, or Stripe. We never receive your full card number.
• Usage analytics — first-party product events (for example "scan completed", "export generated") with platform, app version, locale, and country. Stored in our own database; not shared with advertising networks.
• Device and security data — IP address, user agent, and request metadata used for rate limiting, abuse prevention, and the Cloudflare Turnstile check at sign-up.
• Website cookies — a language preference cookie and aggregate Vercel Web Analytics and Speed Insights on lectrascan.cienrios.com. Visitors in the EEA, the UK, and Switzerland are shown a cookie banner and analytics runs only if you accept; elsewhere these aggregate measurements run by default. Email privacy@cienrios.com to opt out from any region.

3. How we use information

• Provide OCR transcription, AI clarity rewrites, translation, organization, and export.
• Operate your account, subscription entitlements, and security features.
• Measure feature usage so we can maintain and improve the product.
• Detect abuse, enforce quotas, and comply with legal obligations.

We do not use your documents to train AI models. Our AI providers process API traffic under terms that do not use inputs to train their models.

4. How documents are processed

• Capture — pages are compressed on your device and uploaded to private, access-controlled storage. Nothing is analyzed until you finish scanning.
• OCR — on supported iPhones and iPads, single-page scans may be transcribed on-device using Apple Vision, in which case the image is never sent to an OCR provider. All other scans are transcribed server-side by the Google Cloud Vision API via one of our edge functions.
• AI clarity and translation — the OCR text (not the image) is sent to the Cien Rios AI proxy, which forwards it through Cloudflare AI Gateway and OpenRouter to a large-language model provider (currently OpenAI, Anthropic, or Google, depending on availability). Providers process the text under API terms that do not permit training on your data. We do not send student names, class lists, or account records to these providers. Note that the OCR text is a transcription of the page, so if a student wrote their name on the paper that name is part of the text that is sent.
• Exports and share links — PDF/DOCX exports are stored in private storage and delivered through short-lived signed URLs. If you create a share link, anyone with that link can view the export until it expires (1–60 days, default 14) or reaches its view limit.

5. AI processing and accuracy

• OCR, AI clarity rewrites, and translations are generated automatically and may be wrong.
• Outputs are provided for educational and informational purposes only.
• They are not certified, sworn, legal, medical, or official translations or transcriptions, and should not be relied on for any decision where accuracy matters without your own review.
• The original image and original OCR are preserved so you can always check the source.

6. Student and third-party data

Documents you upload may contain personal data of students or others. You are responsible for having the authority to process it (for example under your institution's policies, FERPA, GDPR, or local law). We act as a processor of that content on your instructions and do not claim ownership of it. Institutions that need a Data Processing Addendum should contact privacy@cienrios.com to start that process.

7. Who we share data with

We do not sell personal data and we do not share it with advertisers.

We share data only with:

• Service providers that operate the product on our behalf — Supabase (auth, database, storage, edge functions), Google Cloud Vision (server-side OCR), the Cien Rios AI proxy and its downstream providers (Cloudflare AI Gateway, OpenRouter, OpenAI, Anthropic, Google), RevenueCat (app-store subscription verification), Stripe (web subscriptions), Apple and Google (store billing), Vercel (web hosting and analytics), Cloudflare (DNS and Turnstile), and Resend (transactional email). The full list, the data each receives, and where they operate is on our sub-processor page.
• Legal requirements — when required by law, subpoena, or to protect the rights and safety of users or the public.
• Business transfers — if Cien Rios is involved in a merger or acquisition, with notice to you.

8. Data storage, security, and residency

• Documents are stored in private buckets with row-level tenant isolation; access requires your credentials.
• Data is encrypted in transit (TLS) and at rest by our hosting providers.
• We do not make documents publicly accessible unless you create a share link.
• Our primary database, storage, and edge functions run on Supabase in the United States. We do not currently operate EU-, UK-, or India-resident infrastructure. Where personal data of EEA, UK, or Swiss data subjects is transferred outside its origin jurisdiction, transfers rely on Standard Contractual Clauses (see sub-processors). Institutions requiring regional residency should email institutions@cienrios.com before signing up.

No method of storage or transmission is completely secure; we cannot promise absolute security.

9. Data retention

• Account, organization, document, OCR/AI text, correction, and export data is kept until you delete it — per document inside the app, or in full by deleting your account. There is no automatic expiry: we do not delete your scans on a schedule.
• Deleting your account removes the organizations you solely own, including their stored page images and exports. If you share ownership of an organization with another person, that organization and its documents remain with the other owner after your account is deleted.
• Export download links expire after 1 hour; share links expire after 1–60 days.
• Organizations removed by an administrator are marked as removed and retained for audit. We do not currently run an automated purge job, so that record persists until it is deleted on request.
• Usage analytics events and rate-limit records are kept in aggregate or pseudonymous form.

Audit-log retention exception

We retain a minimal audit log of administrative actions — account-deletion requests, plan changes, export and share-link generations, and AI compliance-guard violations — beyond the deletion of the underlying account or organization. This trail is needed to demonstrate compliance, investigate misuse, and respond to lawful requests. Each entry contains a UTC timestamp, the action name, and the organization / actor IDs involved; it does not contain document content. Retained audit-log entries authored by you are included in your self-service export bundle.

10. Your rights and choices

• Access and export — Settings → Export my data (app) or your account page (web) produces a ZIP containing your profile, a sanitized authentication record, your audit-log entries, every owned organization with all org-scoped tables (documents, OCR results, clarity rewrites, translations, corrections, export metadata, usage events, entitlements), and original page images.
• Correct — edit OCR and clarity text in the app, or email us to correct account details.
• Delete — Settings → Privacy → Delete my account (app), the account page (web), or the public instructions at lectrascan.cienrios.com/delete-account. Deletion is permanent and removes your credentials, profile, owned organizations, documents, and exports.
• Object or restrict — email privacy@cienrios.com. EEA/UK residents may also lodge a complaint with their supervisory authority. California residents have the rights described in the CCPA/CPRA; we do not "sell" or "share" personal information as those terms are defined there.
• Marketing — we send transactional email only (confirmation, password reset, security notices).

11. Children's privacy

LectraScan is for adult educators. We do not knowingly collect personal data directly from children under 18, and the app requires an 18+ educator confirmation at sign-up. Documents uploaded by educators may describe minors; educators are responsible for having permission to process them. If you believe a child has created an account, contact privacy@cienrios.com and we will delete it.

12. Changes to this policy

We may update this policy as the product changes. Material changes are announced in the app or by email before they take effect, and the effective date above is updated.

13. Contact

privacy@cienrios.com · general support: support@cienrios.com

Cien Rios LLC, 17113 Miramar Parkway #1027, Miramar, FL 33027, USA