Privacy Policy

1. Who we are

Vitrus BV, a private limited company organized under the laws of Belgium, with registered office at Vossekotstraat(Z) 117, 3271 Scherpenheuvel-Zichem, registered with the Crossroads Bank for Enterprises under number 0785.610.126 ("we," "us," or "our") operates the Saro iOS application (the "App") and the public collection viewer at https://saro.gallery (the "Website," and together with the App, the "Service" or "Saro") and acts as the controller of your personal data.

This Privacy Policy explains what information we process when you use the Service, for what reason, and what rights you have. This policy applies to all users of the Service.

2. The short version

• Saro is local-first. Your collection (items, categories, photos, notes) lives on your iPhone unless you opt in to cloud backup or sharing.
• We don’t require an account. Saro identifies your installation through a random identifier stored in your iOS Keychain.
• Photos and item details are sent to our AI provider (Anthropic) only when you tap an AI feature ("Identify and value," "value refresh," "suggested fields," "listing drafts").
• Cloud backup is opt-in. In case you opt in, your backup zip is stored in a private Supabase Storage bucket, keyed to the same identifier.
• No advertising. No analytics SDKs. No data sold to anyone.

3. Scope of the Privacy Policy

This privacy policy (hereinafter "Privacy Policy") applies to you for your personal data that we collect and process through Saro. It contains important information on how and for what purposes we collect and process personal data and clarifies which rights you can exercise as a data subject. Therefore, please read this Privacy Policy carefully.

We are committed to protecting your (personal) data with the utmost care and to process it only in a fair and lawful manner in accordance with the provisions of the GDPR (Regulation (EU) 2016/679), including any current national or international act or regulation in execution or future act or regulation in replacement of the GDPR (hereinafter together referred to as "Applicable Data Protection Law").

4. Information we process

4.1 Personal data

Personal data can be defined as any information by which a natural person can be directly or indirectly identified. You may provide us with your personal data in the context of the following activities, for the corresponding purposes and based on the stated legal basis:

Contact form / correspondence

• Data: name, email address, and the query or message you send us.
• Purpose: to handle your question or message.
• Legal basis: necessity for performance of a contract, or to take steps at your request prior to entering into a contract.
• Source: provided by you when you decide to contact us.

Device identifier (random UUID)

• Data: a random UUID generated on first launch and stored in your iOS Keychain. The identifier does not reveal your name or contact details, but it is treated as personal data.
• Purpose: to associate your cloud backup and share-link records with your installation.
• Legal basis: necessity for performance of a contract, or to take steps at your request prior to entering into a contract.
• Source: automatically generated upon use of the App.

Name (optional)

• Data: your first name, when you decide to include it in your profile.
• Purpose: managing your on-device personalization.
• Legal basis: consent.
• Source: provided by you.

In-app preferences

• Data: Collection view mode, AI cost-prompt setting, disabled filter fields, Add-item view preference, and similar UI-state values.
• Purpose: to provide you with the requested in-app experience.
• Legal basis: necessity for performance of a contract, or to take steps at your request prior to entering into a contract.
• Source: provided by you and communicated through our systems.

The following categories apply to anyone who opens a share link, whether or not you use the Saro app. When you open a link, our hosting provider processes the technical data needed to deliver the page and to keep the Service secure, and we count the number of views for the benefit of the person who created the link. We do not identify individual visitors and we do not tell the person who created the link who has viewed it.

Delivering the shared collection page

• Data: IP address, request date and time, URL requested, HTTP status, browser type and version, operating system, referring URL.
• Purpose: to display the page you requested and make it work correctly.
• Legal basis: necessity for the performance of a contract or based on our legitimate legal interest.
• Source: provided automatically by your browser when you open a share link.

Aggregated view counts

• Data: number of times the page has been opened, and the time of the most recent view.
• Purpose: to know how often the page has been opened.
• Legal basis: necessity for the purposes of our legitimate interests, namely providing the sharing feature that our users request and expect.
• Source: generated by our systems when the page is opened.

Cookies and similar technologies

We do not use cookies or similar technologies on saro.gallery.

4.2 Other information

We also process other information through our app, such as:

Non-personal information you choose to put into Saro

• Items and metadata you add or import: item names, categories, photos, notes, purchase price, current value, condition, custom fields, marked-for-sale status, and the date the entry was created.
• Photos you take inside the app or pick from your iOS Photos library. Stored locally in Saro’s app sandbox; camera-captured photos are also copied to your iOS Photos library when you grant permission, as a safety-net backup.
• Stored locally; included in cloud backup if enabled.

Information processed by AI features

When you tap an AI feature (Identify and value, value refresh, suggest fields with AI, draft listings, bulk-draft listings), the relevant inputs are sent to our AI provider, Anthropic, for inference. Specifically:

• "Identify and value" and value refresh send the relevant photo(s) and (when available) the category context.
• "Suggest fields with AI" sends the category name and (for sub-categories) the parent’s existing schema.
• Listing drafts (single or bulk) send the item’s name, category, notes, current value, purchase price, custom fields, and photo count; the photos themselves are not sent for listing drafts.

Each AI request includes the device identifier so our backend can apply per-installation rate limits. We do not store the photo or text content of these requests on our own infrastructure beyond what is needed to return the response.

Information processed when you opt in to cloud backup

If you enable Cloud Backup in Settings, Saro periodically uploads a ZIP archive of your collection (items, categories, photos as bytes) to a private Supabase Storage bucket. The associated metadata record stores the device identifier, the item and photo count, the backup size in bytes, the Saro app version, and the timestamp of the upload.

Only the most recent backup is retained: each upload replaces the previous one. The archive is accessible only via short-lived signed URLs minted by our backend on request from the same device identifier.

You can delete your cloud backup at any time via Settings → Data → Delete cloud backup. Doing so removes both the backup zip and the associated metadata record from our infrastructure. Your on-device collection is untouched.

Information processed when you publish a share link

When you tap "Share this collection" in Settings, Saro creates a public, read-only snapshot of your collection (limited to the fields and items you have on the device) and stores it in our database keyed to a random 8-character token. The link expires automatically thirty (30) days after creation. You can revoke a share link at any time before the 30-day expiry via Settings → Data → Manage sharing; the URL stops working immediately for anyone still holding it.

• Prices (purchase price, current value) are hidden by default in the shared snapshot. You can opt in to including prices on a per-share basis.
• Anyone with the link can view the snapshot. Treat the link like an email attachment: share it with the people you want to see your collection.
• Saro logs a view count for your reference. We do not log who viewed the link.

5. How we use this information

We use the information (including personal data) you have uploaded for the following purposes:

• To provide the catalog, search, valuation, and listing-draft features.
• To respond to your AI requests (forwarding inputs to Anthropic and returning the result to your device).
• To maintain your optional cloud backup so you can restore your collection after deleting and reinstalling the App, or on a replacement device that signs in to the same iOS Keychain.
• To rate-limit AI usage per installation, so abuse on one installation does not degrade service for everyone.
• To diagnose and fix bugs in the Service when you choose to send error reports or contact us.

6. Third-party service providers

We use the following processors to deliver the Service. Each acts as a data processor on our behalf under a written agreement, and (where applicable) we rely on the EU Standard Contractual Clauses or equivalent transfer mechanisms for international transfers. See also section 12.

6.1 Anthropic

• Purpose: AI inference (image recognition, market-value estimation, schema suggestion, listing drafts).
• Data sent: the inputs described in section 4.2: photos, item metadata, category context, plus the device identifier for rate limiting.
• Retention by Anthropic: governed by Anthropic’s data usage policy for API requests. Anthropic does not use API inputs to train its models without explicit opt-in. See https://www.anthropic.com/legal.

6.2 Supabase

• Purpose: backend hosting for our edge functions, database storage for backup metadata and share-link records, and object storage for backup zip files.
• Data sent: backup archives, device identifier, share-link records (your collection snapshot when you choose to publish one), and the request payloads to our edge functions.
• Region: Supabase is operated by Supabase Inc.; our project is hosted in Central EU (Frankfurt, Germany, eu-central-1). See https://supabase.com/privacy.

6.3 Apple

• Purpose: App Store distribution, iOS Keychain (where we store the device identifier), iOS Photos library (when you grant permission), and in-app purchases for Saro Pro.
• Data sent: handled by iOS and Apple under their own privacy policy. We receive no personal data from Apple in connection with App Store distribution beyond transactional data necessary for purchase processing.

6.4 RevenueCat

• Purpose: managing in-app subscription entitlements. RevenueCat receives subscription identifiers from the App so it can confirm Pro entitlement.
• Data sent: a subscription identifier and (from Apple) the receipt for the purchase. See https://www.revenuecat.com/privacy.

7. What we do NOT do

• We do not sell your (personal) information.
• We do not use advertising SDKs or display third-party ads.
• We do not embed analytics SDKs (e.g., Firebase Analytics, Mixpanel, Segment) in the App.
• We do not share your collection with anyone unless you explicitly create a share link or hand someone a backup zip you exported.
• We do not use your inputs to train AI models. Anthropic’s default API policy is no-training; we have not opted in to any training program.

8. Data retention

• On-device data (items, photos, categories): retained until you delete it, reset the app via Settings → Reset my data, or uninstall the App.
• Cloud backup: only the most recent backup is retained for your installation. Each upload replaces the previous one. We delete the backup and its metadata when you exercise your deletion right (section 9) or use Settings → Data → Delete cloud backup.
• Shared collections: deleted automatically at the configured expiry (default thirty days) or earlier if you revoke the link via Settings → Data → Manage sharing.
• AI request payloads on our backend: not retained beyond what is needed to compose the response.
• Device identifier in your Keychain: persists across App reinstalls until you reset it by signing out of iCloud Keychain or by erasing the device. You can also clear it by running Settings → Reset my data.

9. Your rights

Subject to the conditions and limitations set out under Applicable Data Protection Law, you may exercise the data subject rights set out below.

To exercise any of these rights, contact us at [email protected]. Because Saro does not require an account, the easiest way for us to find your cloud-backup or share-link records is for you to also include the device identifier shown in Settings → About → Diagnostics. Without that identifier, we may be unable to locate your records.

Subject to legitimate exceptions under Applicable Data Protection Law, we undertake to respond to your request within one month of receipt. We may first request additional information to confirm your identity and ensure that the request comes from you.

9.1 Right of access to your personal data

The right to request access to your personal data, to request a copy of the personal data that we collect about you, and to additional information on how we process your personal data.

9.2 Right to rectification

The right to have incorrect personal data corrected or incomplete personal data we hold about you completed.

9.3 Right to data erasure ("right to be forgotten")

The right to have your personal data deleted from our systems.

The request to erase your personal data cannot always be granted due to e.g. contractual or legal obligations. We will observe these obligations when responding to your request.

9.4 Right to object

The right to object to the processing of your personal data if the processing is based on our legitimate interest or on grounds of public interest. We will stop processing unless we can demonstrate compelling legitimate grounds for further processing or for the exercise of legal claims.

You may also object in case we process your data for direct marketing purposes, so that personal data will no longer be processed for these purposes.

9.5 Right to withdraw your consent

For the processing of your personal data collected by us with your consent, you may withdraw your consent at any time. However, withdrawing your consent does not affect the lawfulness of the processing based on consent before its withdrawal.

9.6 Right to restriction of processing

In certain cases, you have the right to obtain the restriction of the processing of your personal data. If you successfully exercise this right, we will continue to store your data, but we will limit its use. For example, you can make this request if you believe your personal data is inaccurate or if the processing by us is not justified. We only have to fulfil these requests in specific cases, as stipulated by law.

9.7 Right to data portability

The right to obtain the personal data concerning you processed by us in a structured, commonly used and machine-readable format and/or to have such data transmitted or copied to another controller.

9.8 Right to lodge a complaint

If you believe that we are infringing your data protection rights, you have the right to lodge a complaint with the Belgian Data Protection Authority: Data Protection Authority, Rue de la Presse 35, 1000 Brussels, Tel +32 (0) 2 274 48 00, e-mail: [email protected].

10. Security

• On your iPhone, Saro’s app sandbox is protected by iOS sandboxing and file-system encryption.
• The device identifier is stored in the iOS Keychain (hardware-backed where available).
• All communications with our backend use HTTPS / TLS 1.2 or higher.
• Cloud backup zips are stored in a private Supabase Storage bucket and accessed only via short-lived signed URLs minted on request from the same identifier.
• No system is perfectly secure. If we become aware of a personal data breach that affects you, we will notify you through an in-App communication and the relevant supervisory authority in accordance with applicable law.

11. Children

You must be at least 13 to use Saro, and at least 18 to enter into our Terms of Service. If you are under 18, you may use Saro with the involvement and consent of a parent or guardian, who is responsible for your use of the Service. Users under 18 cannot publish a share link.

Where a parent or guardian consents on behalf of a child, we rely on that consent and will make reasonable efforts to verify it. If you believe a child has provided us with personal data without the required consent, contact us at [email protected] and we will delete it.

12. International transfers

Some of our processors (Anthropic, Supabase, Apple, RevenueCat) may process your information outside the EEA, the UK, or your country of residence. We will comply with Applicable Data Protection Law in terms of providing adequate protection for the transfer of personal data to recipients in countries outside of the European Economic Area ("EEA").

In case we transfer your personal data to a third country or international organization outside the EEA, we will make sure that your personal data is either transferred to third countries that are deemed to be offering an "adequate" level of protection by the European Commission, or, alternatively, where your personal data is not sent to a country that provides an adequate level of protection, we will put in place appropriate safeguards with the entity receiving your personal data (e.g. the EU standard contractual clauses or binding corporate rules, taking into account additional requirements regarding international transfers such as supplementary measures) to ensure that your personal data remains protected in accordance with Applicable Data Protection Law.

If you wish to receive more information or a copy of these safeguards, please contact us at [email protected].

13. Retention of your personal data

We will retain your personal data for no longer than is strictly necessary to fulfil the purposes for which we received the data. The retention periods differ in terms of the type of processing activity and the purpose for which the personal data was collected.

Personal data that we collect based on your consent is retained by us for as long as your consent remains valid.

In all cases, personal data may be retained for a longer period if there is a legal or regulatory reason to do so, or for a shorter period if you object to the processing of your personal data and there is no longer a legitimate reason to retain it. We guarantee that your personal data will be deleted or anonymised once the retention period has expired.

If you wish to receive more information about the retention periods we apply, please contact us at [email protected].

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices regarding the processing of your personal data or changes in applicable law. We will do so by posting the updated version on the App. If we make material changes, we will notify you in-App or by another reasonable means before the change takes effect, and we will update the Effective Date at the top of this document.

15. Contact us

Questions, requests, or complaints about this Privacy Policy:

• Email: [email protected]
• Post: Vitrus BV, Vossekotstraat(Z) 117, 3271 Scherpenheuvel-Zichem, Belgium