GDPR Compliance

Last updated: March 23, 2026

ScreenVault is committed to protecting your data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"). This page summarizes your rights and our obligations.

Your Rights at a Glance

📋 Right of Access (Art. 15)

You can export all your data from the app: Settings → Data → Export My Data. Data is provided in JSON format within 24 hours.

🗑️ Right to Erasure (Art. 17)

Delete all your data: Settings → Data → Delete All Data. This permanently removes your account, all classifications, chat history, and any stored images within 30 days. This action is irreversible.

✏️ Right to Rectification (Art. 16)

Reclassify any incorrectly categorized screenshot within the app, or contact us to correct account information.

⏸️ Right to Restrict Processing (Art. 18)

Opt out of data improvement: Settings → Privacy → Help Improve Our AI (toggle off). Your images will be deleted immediately after classification.

📦 Right to Data Portability (Art. 20)

Export your data in machine-readable JSON format via the app. Includes all classifications, descriptions, OCR text, and chat history.

🚫 Right to Object (Art. 21)

Object to processing for legitimate interests by opting out of data improvement or deleting your account entirely.

How to Exercise Your Rights

Action	How	Response Time
Export data	App: Settings → Data → Export	Immediate (JSON)
Delete all data	App: Settings → Data → Delete All	Within 30 days
Opt out of data improvement	App: Settings → Privacy → toggle off	Immediate
Other requests	Email: privacy@screenvault.pics	Within 30 days

Data Processing Summary

Processing Activity	Legal Basis	Data Categories
Image classification	Contract (Art. 6(1)(b))	Screenshots, classification results
Account management	Contract (Art. 6(1)(b))	Apple ID, email
Data improvement	Legitimate interest (Art. 6(1)(f))	Anonymized images (opt-out available)
Subscription management	Contract (Art. 6(1)(b))	Transaction ID, tier, status

Sub-Processors

Name	Purpose	Location	Safeguards
Anthropic PBC	AI image classification	USA	SCCs, API data not used for training
Hetzner Online GmbH	Server hosting	Helsinki, Finland (EU)	EU data residency
Apple Inc.	Authentication, payments	USA	SCCs, Privacy Shield successor
ISRG (Let's Encrypt)	TLS certificates	USA	Public service, minimal data

International Transfers

Your data is primarily stored in the EU (Finland). Classification requests are processed through Anthropic's API (USA). These transfers are protected by:

Standard Contractual Clauses (SCCs) with Anthropic
Anthropic's commitment that API inputs are not used for model training
Data minimization: only images and structured metadata are sent for classification

Data Protection Measures

TLS 1.3 encryption for all data in transit
AES-256 server-side encryption for stored images
EXIF metadata stripped before AI processing (prevents data leakage)
Strict access controls (SSH key-only, firewall, intrusion prevention)
Regular security updates (automated)

Breach Notification

In case of a personal data breach likely to result in risk to your rights:

We will notify the relevant supervisory authority within 72 hours (Art. 33)
We will notify affected users without undue delay if high risk (Art. 34)

Contact & Complaints

Data Protection Contact:
Email: privacy@screenvault.pics

If you are unsatisfied with our response, you have the right to lodge a complaint with your local supervisory authority. For users in Finland: Office of the Data Protection Ombudsman.