GDPR & Privacy

In accordance with Regulation (EU) 2016/679 — GDPR

1. Data controller

2. What data we collect

Data you provide directly:

• Full name — for account identification
• Email address — for authentication and communications
• Password — stored as SHA-256 hash (not in plaintext)
• Number of hives — for service personalization

Data generated through use:

• Photographed images — sent to the AI server (Anthropic) for analysis and stored on our server for a maximum of 90 days, for the purpose of investigating complaints, improving AI accuracy and ensuring service quality. After 90 days they are automatically deleted.
• Images with marked detections — generated automatically from the original image (circles drawn over detected varroa/queen/drones) and stored alongside the original with the same 90-day retention.
• Scan results — stored both locally in your browser (localStorage) and on our server (database), for cross-device synchronization and personal statistics.
• IP address — temporarily logged for rate limiting (security)

3. Purpose and legal basis

• Performance of contract (Art. 6(1)(b) GDPR) — providing the scanning service
• Legitimate interest (Art. 6(1)(f) GDPR) — platform security, abuse prevention
• Consent (Art. 6(1)(a) GDPR) — non-essential cookies, marketing communications

4. Third-party data processors

• Anthropic PBC (USA) — image processing through Claude AI. Images are processed and deleted in accordance with Anthropic's policy (not used for model training). Transfer covered by Standard Contractual Clauses (SCC).
• Render.com (USA) — backend server hosting. Data processed with adequate safeguards (SCC).
• Hostico / ISPConfig (Romania) — static file and scanned image hosting.
• Resend (USA) — transactional email delivery (account verification, password reset, notifications). Covered by SCC.
• Google LLC (USA) — Google authentication (OAuth) for users who choose to log in with Google. Covered by SCC.
• Netopia mobilPay (Romania) — payment processing. Card data processed directly by Netopia, in accordance with PCI-DSS.

5. Your rights (Art. 15-22 GDPR)

• Right of access — you may request a copy of your data
• Right to rectification — you may correct inaccurate data
• Right to erasure ("right to be forgotten")
• Right to data portability — export data in CSV format
• Right to object — to processing based on legitimate interest
• Right to withdraw consent at any time

To exercise your rights: gdpr@varroascan.ro — response within 30 days max.

6. Data retention

• Account data — for the duration of use + 1 year after deletion
• Scanned images (originals and marked detections) — maximum 90 days from upload, after which they are automatically deleted. When the account is deleted, all associated images are deleted immediately (cascade).
• Scan results (numerical data) — for the duration of account use
• Billing data — 10 years in accordance with Romanian tax legislation
• Security logs — 90 days

6.1. Legal basis for image storage

We temporarily store scanned images (max. 90 days) on the basis of legitimate interest (Art. 6(1)(f) GDPR), for:

• Investigating user complaints regarding detection accuracy
• Monitoring and improving AI model quality
• Platform security and abuse prevention

You have the right to object to this processing (Art. 21 GDPR) — write to us at gdpr@varroascan.ro and we will delete the images associated with your account within max. 7 days.

7. Supervisory authority

You have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP):

Last updated: May 8, 2026

Cookie Policy

In accordance with the ePrivacy Directive and Romanian Law no. 506/2004

What are cookies?

Cookies are small text files stored in your browser. VarroaScan uses localStorage (similar to cookies) for the operation of the application.

What we store in your browser

🟢 Essential (no consent required)

• vs_sesiune — authentication session data (id, email, plan)
• vs_utilizatori — local account data (encrypted)
• vs_lang — language preference
• vs_cookies_accepted — your cookie preference

🟡 Functional (with consent)

• Scan history — stored locally for charts and reports
• AI server settings — configured URL

🔴 We do not use

• Tracking or behavioural analysis cookies
• Advertising or retargeting cookies
• Third-party cookies (Google Analytics, Facebook Pixel etc.)

Deleting browser data

You can delete all application data from Dashboard → Profile → Delete local data or directly from your browser's settings → Application → Local Storage → varroascan.ro → Delete all.

Last updated: May 8, 2026

ANPC & Dispute Resolution

Mandatory information under Romanian and European legislation

National Authority for Consumer Protection

Online Dispute Resolution (ODR)

Internal complaint procedure

1. Step 1: Send a complaint to contact@varroascan.ro
2. Step 2: We respond within a maximum of 5 business days
3. Step 3: If you are not satisfied with the response, you may contact ANPC or SAL-Fin

Alternative Dispute Resolution Entity (SAL)

Payment information — Netopia mobilPay

Online payments are processed by Netopia S.R.L., authorized by the National Bank of Romania as a payment institution. Your card data is processed directly by Netopia and is not accessible to VarroaScan.

Warranty and refund

• Right of withdrawal: 14 calendar days from subscription (if the service has not been used)
• Refund: Within 14 days from the approval of the withdrawal request
• Technical complaints: Resolution within max. 5 business days

Last updated: April 24, 2026 | Document version: 1.0