Privacy Policy

01Who We Are

CamteX ("we", "us", "our") operates the CamteX web application available at camtex.app. For privacy inquiries, contact us at contact@camtex.app.

02Data We Collect

03How We Use Your Data

• –Authenticate you and maintain your session.
• –Enforce plan limits (scan quotas, session limits).
• –Store and retrieve your projects.
• –Process payments and grant Pro access via Stripe webhooks.
• –Send transactional emails (login codes) via Resend.
• –Analyse product usage to improve the Service (PostHog).
• –Send occasional product newsletters, if you opted in at registration.

04Legal Basis for Processing (GDPR)

For users in the European Economic Area, we process your data under the following legal bases:

• –Contract performance - to deliver the Service you signed up for.
• –Legitimate interests - to secure the Service, detect abuse, and improve the product.
• –Consent - for newsletter communications (you may withdraw at any time).

05Data Sharing & Third Parties

We share data only with the following sub-processors:

• –Vercel - application hosting; server code runs in the Frankfurt region (fra1); after your consent, cookieless visit statistics and page speed measurements (Web Analytics, Speed Insights).
• –Supabase - database and file storage (EU region available).
• –Stripe - payment processing.
• –Resend - transactional email delivery.
• –Cloudflare - domain DNS and network infrastructure; forwarding of emails sent to our contact address; Turnstile, which checks browser signals and the IP address to protect free trial scans without an account from bots.
• –Google Gemini / Mathpix - AI image recognition.
• –PostHog - product analytics.
• –TeXLive.net - server-side LaTeX-to-PDF compilation (your document code is sent for the duration of the request).
• –OpenAI - voice-to-LaTeX transcription (audio is sent for the duration of the API call).
• –Sentry - error monitoring and crash reporting.
• –Upstash - rate-limiting and session-cache infrastructure (Redis).

The database, files and server code all run inside the European Union (Supabase and Vercel, Frankfurt region). Some subprocessors listed above may nevertheless process data outside the European Economic Area, in particular in the United States. Those transfers rely on Standard Contractual Clauses or on an adequacy decision (Articles 45 and 46 GDPR). We provide a copy of the safeguards on request.

We do not sell your personal data to any third party.

06Data Retention

• –Account data is retained for as long as your account is active.
• –Sessions expire after 30 days of inactivity (90 days after sign-in at the latest) or upon logout.
• –OTP codes expire after 5 minutes and are deleted after use.
• –You may request deletion of your account and all associated data at any time (see Section 7).
• –Deleting your account removes projects, versions, comments and stored files from the service immediately. Copies of the database remain only in backups kept for disaster recovery, which are deleted automatically after 14 days.
• –A record of payments remains after deletion, because accounting law requires it. The legal basis is that obligation, not your consent (Article 17(3)(b) GDPR).
• –To stop free limits from being reset, and so that a referral reward and a survey answer count only once, for up to 90 days we keep a one-way hash of your email address: after account deletion (with the number of scans used in the current month), for accounts signed in from a given device, after sign-up through a referral link and after a survey answer. The address cannot be recovered from it.
• –If a message from us bounces permanently or the recipient reports it as spam, for up to 90 days we keep a one-way hash of that address so that we stop sending codes and reminders to it. Resend notifies us of such events.

07Your Rights

Under GDPR and other applicable laws, you have the right to:

• –Access - request a copy of the personal data we hold about you.
• –Rectification - correct inaccurate data.
• –Erasure ("right to be forgotten") - request deletion of your account and data.
• –Portability - receive your data in a machine-readable format.
• –Objection - object to processing based on legitimate interests.
• –Withdraw consent - unsubscribe from newsletters at any time.

To exercise any of these rights, email us at contact@camtex.app. We will respond within 30 days.

08Cookies

We use two essential cookies: camtex_session - an HTTP-only, Secure session token required for authentication, and camtex_trial - a random device identifier (kept for up to 400 days) used to enforce the free trial scans and the limit of 2 accounts per device. Neither is used for advertising.

PostHog analytics does not start until you consent in the banner shown on your first visit. Refusing takes a single click and does not limit the service in any way. Your choice is kept in your browser under the key camtex-consent; clearing site data makes us ask again.

09Children's Privacy

The Service is not directed to children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

10Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated by email or a notice in the application. Continued use of the Service after the effective date constitutes acceptance of the revised policy.

11Contact & Supervisory Authority

For privacy questions, contact contact@camtex.app.

If you are located in the EU/EEA and believe your rights have been violated, you have the right to lodge a complaint with your local Data Protection Authority. In Poland, this is the Urząd Ochrony Danych Osobowych (UODO) at uodo.gov.pl.