Privacy Policy

Effective and last updated: 23 September 2026

Language notice: Localised versions are provided for convenience. If a translation differs from the English text, the English version prevails to the extent permitted by mandatory law.

Privacy by design. Scriptum PDF performs its core PDF, OCR, handwriting, editing, measurement, redaction, page-management and rendering functions locally on your Apple device. Documents are not automatically uploaded to PortanX. Cloud AI processing occurs only when you deliberately invoke an online feature after an explicit opt-in.

1. Scope and controller

This Privacy Policy applies to the Scriptum PDF native application for iOS, iPadOS and macOS (the “App”), the website scriptumpdf.com (the “Website”), Scriptum Cloud AI at api.scriptumpdf.com, and related support communications (together, the “Services”).

The controller responsible under the Swiss Federal Act on Data Protection (“Swiss FADP” or “revDSG”) and, where applicable, Regulation (EU) 2016/679 (“GDPR”) is:

PortanX - Catalin Portan
Sole proprietorship (Einzelunternehmen)
Proprietor: Catalin Ionut Portan
Registered address: Flurstrasse 24, 3014 Bern, Switzerland
Swiss UID: CHE-373.501.736
CH-ID: CH-036-1108540-6
Commercial Register: Handelsregisteramt des Kantons Bern
Corporate website (informational): portanx.com
Telephone: +41 78 310 33 17
Contact (privacy, support, legal and general): contact@scriptumpdf.com

Privacy requests and communications concerning the controller should be sent to the privacy address above.

1.1 Roles when you process other people’s data

When you use the local App tools to process personal data contained in your own documents, PortanX does not receive that content and does not determine why you process it. You or the organisation for which you act remain responsible for having a lawful basis, providing any required notices, respecting professional secrecy and responding to the rights of the people identified in those documents. Where you deliberately submit document content to Scriptum Cloud AI on behalf of an organisation, that organisation may be the controller and PortanX may act as its processor for the content while remaining an independent controller for security, entitlement, billing-status and service-administration data. Business users that require a data processing agreement may contact contact@scriptumpdf.com.

This Policy does not transfer responsibility for third-party data to PortanX. You must not scan, sign, redact, translate, share or otherwise process a document unless you have authority to do so.

2. Data-processing summary

Context	Data	Purpose and legal basis	Storage
Core App use	PDFs, annotations, handwriting, OCR text, signatures/stamps, measurements, form data, page edits and exports	Provide user-requested editing functions. These operations are performed on-device and are not collected by PortanX.	On your device or at a file location you select, until you delete the data.
Local preferences and caches	Language and appearance settings, recent-file references/security bookmarks, locally saved signatures, document history/backups, translation output cache and cloud-consent setting	App functionality and your requested settings; where GDPR applies, performance of the service (Art. 6(1)(b)) and legitimate interests in a reliable App (Art. 6(1)(f)).	On-device until cleared in the App, deleted by you, removed with the App, or superseded.
Local device transfer	Peer display name and the document you choose to send	Deliver the user-requested LAN transfer (GDPR Art. 6(1)(b)).	Encrypted peer-to-peer transfer through Apple Multipeer Connectivity; not stored on PortanX servers.
Optional Scriptum Cloud AI	Selected PDF text and the text of pages you send for translation, including OCR text of those pages; the question or prompt; text submitted for neural speech. The PDF file itself stays on the device.	App Functionality only: produce the summary, answer, translation or spoken result you request after consent for that function (GDPR Art. 6(1)(a); Art. 9(2)(a) where special-category data is included).	Not kept by PortanX as a document. No fixed retention period is stated in this Policy. See section 8.
Subscription check for Cloud AI	The StoreKit signed transaction (JWS): product identifier, transaction identifier and original transaction identifier. Not the payment card, Apple Account password or billing address.	App Functionality: confirm an active Scriptum Pro subscription before the gateway calls the model (GDPR Art. 6(1)(b)).	Used to authorize the request. PortanX does not build a purchase archive from it. See section 8.
Rate-limit key	A one-way HMAC derived on Cloudflare from the StoreKit identifiers above and the current rate window. The raw transaction identifier is not the stored key.	App Functionality: limit abuse of the gateway. Not used for advertising or tracking across apps.	Deleted by the gateway when that rate window ends. This Policy does not state a longer backup period.
StoreKit purchases	Product identifier, entitlement status, subscription expiry/revocation status and signed transaction information	Activate Pro features, prevent fraud and provide purchase restoration (GDPR Art. 6(1)(b) and 6(1)(f)).	Apple processes payment and billing data. The App stores only the entitlement state needed to provide Pro access.
Website	IP address, request time, requested URL, browser/device headers, referring URL and security/error events	Deliver and secure the Website, diagnose faults and prevent abuse (GDPR Art. 6(1)(f)).	In hosting/security logs for a limited period determined by operational, security and legal needs.
Support and legal requests	Name, email address, message, attachments and correspondence metadata you provide	Respond to you, perform pre-contractual/contractual steps, establish or defend legal claims, and comply with law (GDPR Art. 6(1)(b), (c) and/or (f)).	Until the matter is resolved, then only as required for limitation, accounting or legal obligations.

3. Core on-device processing

Core document operations use native Apple technologies, including PDFKit, PencilKit and Vision, and the locally bundled PDFium framework. PortanX cannot access documents that remain on your device. No Scriptum account is required. The App does not provide proprietary cloud document storage.

Local files may nevertheless be included in your own device backups or third-party storage if you independently enable Apple iCloud Backup, iCloud Drive, Time Machine, another storage provider, or share/export a file. Those services are controlled by you and their own terms apply.

3.1 Apple permissions and protected resources

The App requests access only when a feature needs an Apple-protected resource. Camera access is used to scan paper documents into PDF pages on the device. Local Network access is used to discover compatible nearby devices and transfer the document you select. File or folder access is initiated through Apple system pickers and security-scoped permissions so the App can open or save the locations you choose. Denying a permission prevents the corresponding feature but does not disable unrelated local tools. PortanX does not use these permissions for advertising, profiling or background surveillance.

3.2 Local security material

If you choose to save a PDF password, the App may store it in Apple Keychain on your device. PortanX cannot read or recover that password remotely. Saved signatures, stamps, recent-file references and history copies are also local. Anyone who can unlock your device or access an unencrypted backup may be able to reach local App data; use device encryption, a strong passcode and appropriate account controls.

4. LAN device sync

Device Sync discovers nearby Scriptum PDF peers on the local network using Apple Multipeer Connectivity. A transfer occurs only after a user action and uses an encrypted session. The selected PDF travels directly between the participating devices; PortanX does not receive a copy. The visible device/peer name is disclosed to nearby peers while discovery is active.

5. Optional Scriptum Cloud AI

5.1 Inventory of data that can leave the device

Cloud AI is off until you consent to the specific function. The App then sends encrypted HTTPS to the Scriptum gateway at api.scriptumpdf.com, which runs on Cloudflare. The gateway forwards a rebuilt request to OpenAI. The App does not ask you for an OpenAI key. The inventory is:

Selected PDF text and OCR page text. Summary and document questions send extracted text (the summary sample is limited in the App to the first 15 pages and 15,000 characters). Phrase translation sends the selection. Document translation and illustrated translation send the text of the pages being processed, including text recognized on those pages. Neural speech sends the text to be spoken, not a recording of your voice. The PDF file is not uploaded.
StoreKit JWS. The App sends the signed StoreKit transaction in the Authorization header so Cloudflare can check the Scriptum Pro subscription. OpenAI does not receive that JWS. The gateway uses PortanX’s own provider credential for the model call.
Derived rate-limit identifier. Cloudflare computes an HMAC from the StoreKit transaction identifiers and the current rate window. That HMAC, not the transaction identifier, is what the gateway stores for rate limiting. It is not an account ID and it is not sent back to the App.

Cloudflare receives the JWS and the text of the request. OpenAI receives the rebuilt text or speech input. Neither party is used for tracking. Purpose: App Functionality only.

5.2 Consent and control

Each cloud transmission is triggered by a discrete user action. Before cloud AI is enabled, the App displays an opt-in describing the relevant content and purpose. The consent choice is stored locally on the device and may apply to later user-initiated AI operations. You may decline without losing the core local tools. You may withdraw consent at any time by emailing contact@scriptumpdf.com and by ceasing to invoke Cloud AI features; no document content is transmitted automatically. Withdrawal does not affect processing already completed.

5.3 Providers, training and sensitive content

Scriptum Cloud AI is routed through PortanX infrastructure and may use contracted infrastructure and AI subprocessors, including Cloudflare for network delivery/security and OpenAI for model inference. PortanX requires providers handling App data to apply protection equivalent to this Policy and applicable law. Content submitted through the Services is used only to provide and secure the requested feature and is not used by PortanX to train public AI models. PortanX contractually restricts service providers from using submitted document content to train public models.

PortanX does not store submitted document text as a document archive. Cloudflare and OpenAI process the request in order to return the result. This Policy does not state a fixed number of days for any processor copy. No contract in the product repository sets such a period, and this Policy does not claim Zero Data Retention.

Do not submit confidential, privileged, special-category or third-party personal data to Cloud AI unless you are authorised to do so and the transmission is necessary. AI output can be inaccurate and should be independently reviewed.

5.4 Data minimisation and purpose limitation

PortanX designs cloud requests to send the content needed for the selected function rather than uploading the user’s entire file by default. Cloud content is not repurposed for advertising, user profiling, credit decisions, employment decisions or unrelated model training. If PortanX wishes to use personal data for a materially different purpose, it will provide additional information and obtain consent where required before doing so.

5.5 Special-category, criminal-offence and privileged material

PDFs can contain health data, biometric information, political or religious views, trade-union information, information about sex life or orientation, criminal allegations, legal privilege, professional secrecy or other highly sensitive data. PortanX does not ask for such content. If you choose to submit it to Cloud AI, you represent that you have the authority and an applicable legal condition for the transmission. Organisations should apply their own access controls, confidentiality rules and data protection impact assessment before enabling cloud processing for sensitive workflows.

6. Payments and Apple services

Scriptum Pro purchases and subscriptions are processed exclusively by Apple through StoreKit and the App Store. PortanX does not receive or process your full payment-card number, Apple Account password or billing address. Apple acts under its own privacy terms for App Store transactions. The App receives entitlement and signed transaction information needed to unlock Pro, verify access and restore purchases.

If you have opted in to sharing diagnostics with app developers at the Apple operating-system level, Apple may make aggregated or de-identified crash and performance information available to PortanX. PortanX does not include third-party advertising or analytics SDKs in the App.

7. No sale, advertising or cross-app tracking

PortanX does not sell or rent personal data, does not use document content for advertising, does not operate a data-broker business, and does not track users across apps or websites owned by other companies. The App contains no AdMob, Meta/Facebook SDK, third-party advertising SDK, third-party behavioural analytics SDK or tracking domain. PortanX follows Apple App Store Review Guidelines 5.1.1 and 5.1.2, including transparency, data minimisation, consent, retention/deletion disclosure and equivalent protection by service providers.

7.1 Website cookies and local storage

The Website does not use advertising cookies or cross-site behavioural tracking. It may use strictly necessary browser storage to remember your selected language and essential Cloudflare security or network-delivery mechanisms to protect and serve the Website. These mechanisms are not used by PortanX to build an advertising profile. If non-essential analytics or marketing technology is introduced in the future, this Policy and any legally required consent mechanism will be updated before activation.

7.2 Do Not Track and Global Privacy Control

Because PortanX does not sell personal data or engage in cross-context behavioural advertising, there is no advertising sale/share to opt out of through a browser signal. Where an applicable law requires recognition of a valid Global Privacy Control signal, PortanX will treat it accordingly. Browser “Do Not Track” signals do not have a universally agreed technical standard, but the Website’s no-tracking design applies regardless of the signal.

8. Retention and deletion

Local data: controlled by you and retained until you delete it, clear the relevant cache/history/signature, or uninstall the App. Exported files remain wherever you placed them.
AI request content: used to complete the request you started. PortanX does not keep it as a stored document. The gateway is configured not to write request or response bodies, the StoreKit JWS, or prompts into Workers Logs or traces. This Policy does not give a day count for copies that Cloudflare or OpenAI may hold under their own terms.
Rate-limit HMAC: deleted by the gateway when the rate window for that key ends. The stored value is the HMAC and request timestamps, not the PDF text and not the raw transaction identifier. This Policy does not add a day count for platform backups.
Gateway and Website logs: the AI Worker does not enable Workers Logs or traces. Website hosting logs, if any, are kept only for security and operation. This Policy does not state a numeric retention period for them.
Support records: retained while handling the request and thereafter for applicable limitation and statutory duties.

Because no Scriptum account is required and most data remains only on your device, PortanX may have no server-side data that can be linked to you. A deletion request does not delete files stored locally on your devices; use the App/device controls for those files.

9. Recipients and international transfers

Personal data is disclosed only when necessary to: Apple (StoreKit, App Store distribution and opt-in diagnostics); hosting, content-delivery and security providers such as Cloudflare; contracted AI inference providers such as OpenAI when you invoke Cloud AI; professional advisers where necessary; and authorities where disclosure is legally required. Local peers receive only the data you choose to send to them.

Providers may process data in Switzerland, the EEA, the United States or other countries. Where data is transferred to a country without recognised adequate protection, PortanX uses an available lawful safeguard, such as the revised EU Standard Contractual Clauses together with the Swiss addendum/adjustments, or another mechanism permitted by Swiss FADP Chapter 2 and GDPR Chapter V. You may request information about applicable safeguards.

10. Security

PortanX applies proportionate technical and organisational measures, including HTTPS in transit, encrypted peer-to-peer sessions, platform sandboxing, access restriction and data minimisation. No system is completely secure. You remain responsible for device security, backups, recipient selection, file passwords and keeping original documents before destructive edits.

10.1 Incident response

PortanX maintains procedures intended to assess suspected personal-data incidents, contain them, preserve relevant evidence and determine whether notification is required. Where a breach is likely to result in a high risk or otherwise meets a statutory notification threshold, PortanX will notify the FDPIC, an applicable EEA supervisory authority and/or affected individuals within the period and in the manner required by law. Notifications may be delayed where law enforcement or another competent authority lawfully requires it.

11. Your rights

Subject to the conditions and exceptions of applicable law, you may request access to your personal data and information about processing, rectification, deletion, restriction, data portability, or objection to processing based on legitimate interests. Where processing is based on consent, you may withdraw consent at any time. Under Swiss law, you may also request information under the FADP and, where applicable, correction, deletion or restriction of unlawful processing.

Access and information: obtain confirmation whether PortanX processes personal data about you and receive the information and copy required by applicable law.
Rectification: correct inaccurate data and complete incomplete data.
Erasure: request deletion where the data is no longer necessary, consent has been withdrawn, processing was unlawful, or another statutory ground applies.
Restriction: request that data be preserved but not otherwise used while accuracy, lawfulness or an objection is examined.
Portability: receive eligible data you provided in a structured, commonly used, machine-readable format where the statutory conditions are met.
Objection: object for reasons relating to your situation to processing based on legitimate interests; PortanX will stop unless compelling legitimate grounds or legal claims justify continuation.
Consent: withdraw consent prospectively without affecting processing completed before withdrawal.
Complaint and judicial remedy: contact the FDPIC, the competent EEA authority or a competent court.

Send requests to contact@scriptumpdf.com. PortanX may request proportionate information to verify identity and will normally respond within the period required by applicable law. You may complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, CH-3003 Bern, or, where GDPR applies, to the competent EEA data protection authority. You also have the right to an effective judicial remedy.

Rights are not absolute. PortanX may refuse or limit a request where a statutory exception applies, where identity cannot reasonably be verified, where the request adversely affects the rights of others, or where retention is required for legal obligations or legal claims. PortanX will explain a refusal where the law permits. Requests are generally free, but a reasonable fee or refusal may apply to manifestly unfounded or excessive requests as allowed by law.

12. Data not obtained directly from you

PortanX generally obtains data directly from you or your device. StoreKit entitlement information is obtained from Apple. Essential Website security information may be generated by hosting/security infrastructure. If a sender includes another person’s data in a support request or AI prompt, PortanX receives it from that sender and processes it for the same purpose, legal basis, recipients and retention period described above.

PortanX does not purchase marketing lists, enrich user profiles through data brokers or infer sensitive characteristics for advertising. Where Art. 14 GDPR applies to indirectly obtained data, the categories, sources, purposes, legal bases, recipients and retention criteria are those identified in this Policy unless PortanX gives the affected person a more specific notice.

13. Automated decisions and children

PortanX does not make decisions producing legal or similarly significant effects about you solely by automated processing. Scriptum PDF is a general productivity tool and is not directed to children under 13. PortanX does not knowingly solicit children’s personal data. A parent or guardian who believes a child supplied personal data may contact the privacy address.

14. Changes

PortanX may update this Policy to reflect changes in law, technology or the Services. The date above identifies the current version. Material changes will be communicated through the Website, the App, or another appropriate channel before they take effect where required.

15. Contact and deletion

Privacy questions, access requests and deletion requests: contact@scriptumpdf.com. There is no Scriptum account to close. Files that never left the device are deleted with the device controls or by removing the App. A request to this address covers data PortanX or its processors can still associate with you.