Privacy Policy

Last updated: 30 September 2026

1. Who we are

scannedby is operated by AIHS PRO CONSULTING SRL, a company registered with the Trade Register in Romania under CUI 54610750. We are the data controller for the personal data described here.

You can reach us about anything in this policy at ca@aihs.pro.

2. Waitlist (before we open)

While scannedby is not yet open, you can join the waitlist on our opening-soon page: you tell us your current or target role and your email address, and you get a place in line and a personal invite link. This is the only personal data we process through that page.

• What we collect. Your email address, the role you typed, the date you signed up, the country your request came from (derived by our infrastructure provider), and basic browser information. If you joined through someone's invite link, we record that link, so the person who invited you can see how many people joined through it (never who they are). We do not store your IP address.
• Why, and on what legal basis. To keep your place on the waitlist, show you your place and your invite progress, and notify you when scannedby goes live. The legal basis is your consent, given by ticking the box on the form.
• Your status without an account. After you join, we set one cookie on this browser holding a random code, and we give you a personal status link with the same code, so you can see your place again without a password. We store only a scrambled (hashed) form of that code. Keep the link private.
• Withdrawing consent. You can ask us to delete your address at any time by writing to ca@aihs.pro; the launch email will also include a way to opt out. Withdrawing does not affect anything done before.
• How long we keep it. Until we launch and the notification is sent, or until you ask us to remove it, or 24 months if we have not launched, whichever comes first.
• Where it is stored. In Cloudflare (see section 7). We do not sell it, share it, or use it for anything other than the waitlist and the launch notification.

3. Why the rest of this policy is unusual

Most services collect data about you, from you. scannedby does something different: other people describe you, and you describe other people. At different moments you are in two different positions, with different rights, as a profile owner, the person the feedback is about, and as a respondent, the person giving feedback about someone else.

Section 8 explains a real tension this creates. We would rather state it plainly than bury it.

4. What we collect (once the service is open)

• When you create an account. You sign in with Google. We receive your name, email address and profile picture. We never receive or store your Google password.
• What you add to your profile. Work experience, education, and anything else you choose to enter. You can change or remove it at any time.
• Feedback you receive. The attributes and values chosen by people you invited, three words, and short descriptions of situations they observed.
• Feedback you give. The same, stored against the request you responded to, together with your confirmation of how you knew that person and where you worked together.
• Personality results. If you complete the Big Five questionnaire, your answers and results.
• Jobs activity. Jobs you save, and jobs you open from scannedby to apply on an employer's site.
• Technical data. Basic information your browser sends, and local storage used to keep you signed in and to remember saved jobs before you sign in.

We do not ask for or want special-category data, health, political opinions, religion, trade-union membership, sexual orientation or similar. Please do not include such details in free-text answers about another person.

5. Why we use it, and on what legal basis

• Running your account and profile, and collecting the feedback you requested, performance of a contract.
• Storing feedback you gave about someone else, legitimate interest; the service cannot exist without it.
• Showing your profile to connections or to recruiters, consent. Off by default; you turn it on and can turn it off.
• Notifying you at launch if you joined the waitlist, consent (section 2).
• Security, abuse prevention and keeping the service working, legitimate interest.
• Improving the product using aggregated, non-identifying figures, legitimate interest.

We do not sell personal data, and we do not use it for advertising.

6. Automated processing

Written answers are rewritten by an automated system before they can appear on a profile, so that the wording is not traceable to the person who wrote it. Attribute selections are aggregated into scores and a positioning summary.

None of this produces a decision with a legal or similarly significant effect on you. Recruiters may read a profile, but any hiring decision is theirs, made by people.

7. Who else processes data for us

• Cloudflare, website hosting and delivery, and storage of the waitlist email addresses (Cloudflare D1).
• Supabase, database and authentication hosting, in the EU (eu-central-1, Frankfurt).
• Netlify, hosting and delivery of the application.
• Google, sign-in only.
• Anthropic, rewrites the text of written answers so it cannot be traced back to its author, and, when you choose to import a CV, reads that CV to pre-fill your profile for you to review. The uploaded file is used only for that parse and is not stored by us.

Each acts under a data processing agreement. Where data leaves the European Economic Area, transfers rely on the European Commission's standard contractual clauses.

8. Feedback is anonymous, and what that means for your rights

Feedback on scannedby is shown to you without saying who gave it. That promise is made to the respondent, and it is what makes honest answers possible.

If you ask us for a copy of your data, we will give you everything we hold about you, but not the identity of the people who described you.

Telling you would break a promise made to someone else and would expose their personal data. We rely on Article 15(4) GDPR, which provides that the right to a copy must not adversely affect the rights of others. You can still ask us to correct or delete a description of you, and we will assess it.

If you are a respondent and want your answer deleted, contact us. If it has already been merged into aggregate figures, we can remove the answer itself and the aggregate will be recalculated without it.

9. How long we keep data

• Waitlist email addresses, as described in section 2.
• Your account and profile, until you delete your account.
• Feedback about you, until you delete your account, or until you ask us to remove a specific item.
• Feedback you gave, kept while the recipient's profile exists, because it is part of their profile, not yours.
• Requests that were never answered, 12 months.
• Jobs activity, 24 months.

When you delete your account, we delete your profile and everything shown on it.

10. Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another service in a portable form. Where we rely on your consent, you can withdraw it at any time.

Write to ca@aihs.pro. We answer within one month.

If you are not satisfied, you can complain to the Romanian supervisory authority, ANSPDCP (www.dataprotection.ro), or to the authority where you live.

11. Cookies and local storage

We do not use advertising or tracking cookies, and we do not run any analytics or session-recording tool. We use what is strictly necessary to keep you signed in, one cookie that lets you see your waitlist status (section 2), and local storage on your device to remember saved jobs and your place in a list.

12. Age

scannedby is not intended for anyone under 16. If you believe a person under 16 has created a profile, tell us and we will remove it.

13. Changes

If we change this policy in a way that affects you, we will say so before the change takes effect. The date at the top always shows the current version.