Privacy policy

Version 5 September 2026 · Please read this document carefully.

Controller and scope

Buchhart Digital & Trade e.U., Reclamgasse 56, 1220 Wien, Österreich · admin@streamscout.tools. This policy covers the website, user dashboard, Android app, camera and upload analysis, support system and browser extension.

Data categories and purposes

Account data: authentication, profile and service delivery.
Product images, challenge code, capture metadata, OCR and analysis results: verification, fraud prevention, quality review and certificate creation.
Billing, subscription and checkout-consent records: contract performance, payment administration and legal proof.
Support tickets, messages and diagnostics: handling and documenting requests.
Technical security logs: IP address, browser type, timestamp and error data.
Optional extension telemetry: pseudonymous installation ID, browser family, extension version, event type, error code, duration and timestamp. No browsing history, page content or complete URLs.

Legal bases

Art. 6(1)(b) GDPR for contract performance; Art. 6(1)(c) for statutory duties; Art. 6(1)(f) for security, fraud prevention and service stability; Art. 6(1)(a) for optional telemetry and communications based on consent. Consent can be withdrawn prospectively at any time.

Processors and transfers

IONOSApplication hosting, self-hosted database, stored evidence and server logsStripePayments and subscriptionsResendTransactional and support email, when enabledAnthropicServer-side visual AI analysis, when enabled

Processors must be bound by appropriate contracts. Before enabling a provider that may process data outside the EEA, its DPA, transfer mechanism, retention settings and data minimisation must be verified.

Retention and automated analysis

Product originalsFor analysis, certificate evidence, quality review and dispute handling; deleted when no longer required or following a valid request, subject to legal dutiesSecurity logs30 daysExtension events90 days, then deletion or irreversible aggregationSupport tickets24 months after closureAccounting recordsStatutory retention period

The AI output is a risk assessment. Where an outcome may significantly affect an account, users may request an explanation, human review and correction; no final solely automated account sanction is imposed.

Camera, uploads and notifications

Camera access starts only after device permission and user action. Images selected or captured for a scan are transmitted to the StreamScoutAI server. Push or email notifications are used only where technically required or separately permitted; device permissions can be revoked in system settings.

Your rights

You may request access, rectification, erasure, restriction, portability and object to processing. You may withdraw consent and lodge a complaint with the Austrian Data Protection Authority at dsb.gv.at. Contact us at the address above.