Privacy & Policy - Oriogo Scanner
Effective date: July 19, 2026
This Privacy Policy explains how Oriogo Scanner ("the App", "we", "us") collects, uses, shares, and protects information when you use the App and related services.
1. Who we are
Oriogo Scanner is provided by Starky's Club s.r.o. (operating under the brand "Oriogo"), registered at Strancicka 1084/29, Prague 10, Czech Republic, company registration number (IČO): 05301122. For any privacy question, contact us at privacy@oriogo.com.
2. Scope
This policy applies to the Oriogo Scanner mobile app. It covers data belonging to team admins, team members, and end users invited to a team workspace.
3. Information we collect
3.1 Account and login data
Email address; login method used (Oriogo login, Google, Microsoft, email magic link, email/password, or enterprise SSO/SAML/OIDC); PIN or password (stored hashed, never in plain text); a flag indicating whether biometric app-lock is enabled on your device (biometric data itself, such as fingerprints or face scans, stays on your device and is never sent to us).
3.2 Scanned documents and files
Photos and PDFs you scan (e.g. receipts, invoices, contracts, delivery notes), and related metadata such as file name, page count, document type, timestamp, and the team/workspace the scan belongs to.
3.3 Connected storage credentials
When your team admin connects a storage destination (Google Drive, Microsoft OneDrive/SharePoint, Dropbox, Box, or Oriogo storage), we store the access tokens needed to upload documents on the team's behalf. We do not access files already in that storage beyond what's needed to deliver new scans.
3.4 Team and workspace data
Team name, member list, roles and permissions, invite records, workflow and naming-rule configuration, and admin-defined settings (login policy, storage routing, retention rules).
3.5 Usage and diagnostic data
Upload logs (user, timestamp, destination, status, error messages if any), admin setting-change logs, app crash reports, and basic device/OS information used to keep the service reliable, collected via tools such as Sentry. We do not use this data for advertising or ad targeting.
4. How we use your information
- Provide core app functionality: authentication, scanning, upload routing, and workflow automation
- Maintain team membership, roles, and admin-configured policies
- Keep uploads reliable: retry logic, error reporting, and upload history for admins
- Secure the app: fraud prevention, abuse detection, and audit logging
- Provide customer support and respond to inquiries
- Improve app stability through crash and diagnostic reporting
5. Controller and processor roles
For account, login, team, and usage data, we act as the data controller — we decide why and how this data is processed.For the content of documents you scan (receipts, invoices, contracts, and similar files, which may contain personal data about third parties such as customers, vendors, or employees), your team/organization is the data controller and
Oriogo Scanner acts as a data processor, handling that content only as instructed by your team admin to deliver it to your configured storage destination. Business customers who require a Data Processing Agreement (DPA) covering this processing can request one at privacy@oriogo.com.
Oriogo Scanner acts as a data processor, handling that content only as instructed by your team admin to deliver it to your configured storage destination. Business customers who require a Data Processing Agreement (DPA) covering this processing can request one at privacy@oriogo.com.
6. Legal basis for processing (EU/EEA users)
Where GDPR applies, we process personal data under the following legal bases: performance of a contract (delivering the scanning and storage-routing service your team signed up for), legitimate interests (security, reliability, and product improvement), and legal obligation (billing records, fraud prevention). Where we rely on consent (e.g. optional analytics), you may withdraw that consent at any time by contacting privacy@oriogo.com or via in-app settings, without affecting the lawfulness of processing carried out before withdrawal.
7. Sharing your information
We share data only as needed to run the service:
- Storage providers you or your admin connect (Google Drive, OneDrive/SharePoint, Dropbox, Box, or Oriogo storage) — to deliver your scanned documents
- Identity providers you choose to log in with (Google, Microsoft, SSO/SAML/OIDC)
- Infrastructure, hosting, and diagnostic tool providers (e.g. cloud hosting, crash/analytics tools named in Section 3.5) who process data on our behalf under contract
- Legal authorities, only where required by law
We do not sell personal data.
8. Cookies and similar technologies
The mobile app itself does not use browser cookies. Where analytics cookies are not strictly necessary, we will ask for your consent before setting them, as required under EU ePrivacy rules. You can manage cookie preferences via the cookie banner or browser settings.
9. Automated decision-making
We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you.
10. Data retention
We retain account and team data for as long as your team's workspace is active. Scanned documents are routed to your configured storage destination; any locally cached draft on your device is encrypted and removed once upload succeeds, subject to your admin's retention policy. Upload and audit logs are retained for 12 months for security and troubleshooting purposes. When a team account is closed, we delete or anonymize the associated account and team data within 30 days, except where longer retention is required by law (e.g. billing records). You can request deletion of your account data as described in Section 12.
11. Data security
We use encrypted transport (TLS) for all data in transit, encrypted local storage for draft scans, hashed storage of credentials, and role-based access controls. No method of transmission or storage is 100% secure, but we work to protect your information using industry-standard safeguards.
12. Your rights
Depending on your location, you may have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to withdraw consent where processing is based on consent (see Section 6). You can contact privacy@oriogo.com to exercise these rights. If you are in the EU/EEA, you also have the right to lodge a complaint with your local data protection authority.
13. International data transfers
Your data may be processed in countries outside your own, including by the storage and infrastructure providers listed in Section 7. Where personal data is transferred outside the EU/EEA, we rely on appropriate safeguards such as Standard Contractual Clauses.
14. Children's privacy
Oriogo Scanner is a business tool intended for use by employees of organizations. It is not intended for, and we do not knowingly collect personal data from, anyone under the age of 16.
15. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be announced in the app or by email to team admins. The "Effective date" above reflects the latest revision.
16. Contact us
Questions about this policy or your data: privacy@oriogo.com
Postal address: Strancicka 1084/29, Prague 10, Czech Republic
Postal address: Strancicka 1084/29, Prague 10, Czech Republic
