Privacy in the test version (Closed Beta Test)

Text version: `testphase-datenschutz-v3-2026-10-22` · as of 22 Oct 2026 · applies only to the closed test phase from 19 Oct 2026 until approx. 2026-11-16

---

1. Who is responsible?

Leo Probst, Hornstein, Austria, email: kontakt@pantoplus.at (subject “Privacy test”).

I run this test as a private individual to prepare my planned business PantoPlus. No trade licence is registered yet and there is no data protection officer. Once I register the business as a sole proprietorship, I remain the controller myself; the only change is that I then act as an entrepreneur. I will inform you by email or at your next login.

2. What this is about

A small group of invited people tries out the website and the scan app: as a customer (scan an insole, view the DigiSole, place a test order) or as a retailer (test shop, products, footbed scans). There are no real purchases and no real payments. The aim is to find bugs and improve the method. Participation from age 18 only.

3. Which data, for what, on which legal basis?

What	Examples	Purpose	Legal basis
Test account	username, password hash (never in plain text), chosen role, nickname, email if you wish	access to the test, contact in case of problems	Art. 6(1)(f) GDPR (running the test you voluntarily take part in)
Server and security logs	full IP address, time, requested URL, status code, user agent	operation, defence against attacks, debugging	Art. 6(1)(f) GDPR (secure operation)
Test logs	clicks and steps in the flow (e.g. “scan started”, “test order completed”), app error messages, load times, device type, operating system, browser, screen size, camera details, truncated IP address; stored under a test ID	finding where the flow breaks and on which devices errors occur	your consent (Art. 6(1)(a) GDPR; for reading device information § 165(3) Austrian TKG 2021)
Scans of your insole	photos of the insole on A4 paper, capture data (phone position and motion, quality values), the resulting DigiSole with dimensions	calculate and show the DigiSole, test order, improve calculation and fitting (finding errors, testing new versions against old scans, tuning settings)	your explicit consent (Art. 9(2)(a) and Art. 6(1)(a) GDPR), see 4
Test shops and products (retailer role)	shop name, texts, product photos, test prices, photos and scans of shoe footbeds	testing the retailer area; other testers see your test shop	Art. 6(1)(a) GDPR
Test orders	items, size, name and address (please use test data), “test payment” without payment data, the print file for a sole based on a scan	testing the order flow; the test shop operator sees the order	Art. 6(1)(a) GDPR; print file: Art. 9(2)(a) GDPR (separate box per order)
“Report a problem”	your text, page, device, time, optionally a screenshot you choose yourself	understanding and fixing bugs	Art. 6(1)(a) GDPR
Proof of consent	which boxes, when, which text version	proving your consent	Art. 6(1)(c) with Art. 7(1) GDPR

No payment data: the “test payment” does not ask for card or account details. Never enter real payment data there.

4. Why insole scans are specially protected

Insoles are often prescribed by a doctor, so the shape and dimensions of your insole may allow conclusions about your health. I therefore treat scans and DigiSoles as health data (Art. 9 GDPR) and process them only with your explicit consent, given separately before your first scan.

I do not ask about illnesses, diagnoses or prescriptions. Please do not include such information in feedback, shop texts or DigiSole names either.
I do not need photos of your feet. Keep people, faces, ID documents, letters and payment cards out of the picture.
Location and camera data (EXIF/GPS) are removed on upload.
Scans of other people (e.g. family members) only if they are invited testers themselves and have consented. No scans of children.

Photos and scans of shoe footbeds (retailer role) are not health data as long as no person is visible.

5. What I do not do

No sharing with AI services. Your data never goes to external AI providers, chatbots or coding assistants and is not used to train third-party AI. Analysis happens only on my own server and my own PC.
No third-party analytics or tracking tools, no advertising, no advertising cookies, no embedded third-party services.
No selling and no disclosure to third parties other than those listed in 6.
No automated decision about you (Art. 22 GDPR).

6. Who receives the data?

Recipient	Purpose	Location
Hetzner	encrypted scan object storage	Hetzner, Deutschland (DE, EU)
my own PC	calculating DigiSoles and analysing test data	Austria; encrypted, separate user account for PantoPlus only, no third-party access
other testers	see test shops and products; a shop operator sees test orders in their shop and, only with your consent per order, the print file	within the test

No transfer to countries outside the EU/EEA.

7. How long?

Data	Deletion
Server and security logs with full IP address	after 14 days (individual entries about a security incident until it is closed)
Test logs, error reports, device information, “Report a problem” incl. screenshots	90 days after collection
Test account, test shops, products, test orders, print files	30 days after the end of the test
Scans of your insole (photos, capture data, DigiSole, quality values per scan)	90 days after the end of the test; longer only with your optional additional consent, at most 36 months after the scan
Backups	no later than 30 days after deletion in the system
Proof of consent	3 years after the end of the test

Aggregated results without personal reference (e.g. “error rate per phone model”, improved settings) are kept.

8. Security

Encrypted connection (HTTPS), encrypted storage of scans, access only with a personal account, access to scans only by me, logs without scan content and without passwords, encrypted disk and separate user account on my PC.

9. Your rights

Withdraw any consent at any time, informally by email to kontakt@pantoplus.at or in your account under “Consents”. I will then delete the data concerned within 30 days. Processing before withdrawal remains lawful.
Access, rectification, erasure, restriction, data portability and objection to processing based on legitimate interests (server logs).
Complaint to the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.

10. Voluntary participation

Participation is voluntary; not taking part has no disadvantages at all. Without consent to the test logs, participation makes little sense, because the test exists for exactly this analysis. Without the scan consent you can still try the retailer area and the example shops.

11. Not a medical service

The DigiSole is a digital copy of the shape of your insole, not an examination, not a diagnosis and not a substitute for medical advice or a prescribed insole. No soles are sold during the test phase.

5a. Scan help

Scan help sends only after a new explicit click: whole images including surroundings, one per second since scan start, at most the last ten minutes / 600 images / 25 MiB, long side at most 640 px, no audio, EXIF or location; check history, device information and optional description. Preview and deselection are optional; sending without images is equivalent. Memory is discarded at scan end, navigation and after 60 seconds in the background. Cases are encrypted separately, founder-only, deleted after 90 days or earlier via My reports; optional reply email is stored separately and deleted with the case. Replies also appear in the account. Diagnostic images are never training data. Your feedback, recordings and scans are not analysed with any external AI service; no such consent is offered to testers. Should I want to make this possible later, I will ask you separately and voluntarily beforehand, with its own information on recipient, location and retention; without that consent everything stays as described here.

5b. Training our own recognition models (B6)

Only with B6: insole and footbed photos and labels, trained on the founder's encrypted computer outside cloud sync, stored encrypted in the EU. No access by external AI services to training data. B6 is separate and requires B2, covers only subsequent scans of other testers, and may cover earlier own scans of the founder. Raw data and labels expire 90 days after test end, or at most 36 months per scan with separate B3. Withdrawal: copies/labels deleted within 30 days, backups unreadable within another 30 days; models retrained within six months without the data and old models deleted. Every model version references an immutable dataset manifest and withdrawal blocklist. Models trained with real scans reach browsers only after documented membership-inference and extraction testing; until then browser models use synthetic training data only.

5c. Full recording in the test (only with T1)

If you take part under T1, the test app records while it shows the red “● Recording” indicator and transmits it automatically to my server: camera images (several per second, also between scans – showing the insole or footbed, sheet, surface, hands and whatever else is visible around them), the app’s screen and AR displays, instructions, your inputs and clicks, motion and orientation sensors, device model, operating system, browser, camera settings, performance and error data, timestamps and the shortened IP address. No audio, no location, no other apps. “Pause” stops the camera.

Purpose and legal basis: finding and fixing errors, improving flows and recognition; explicit consent T1 (Art. 6(1)(a) GDPR; for device and sensor access § 165(3) TKG 2021). Scans of your own insole only with additional B2 (Art. 9(2)(a) GDPR); without B2 you use a test insole from me. People who happen to be in the picture: Art. 6(1)(f) GDPR, deleted as soon as I notice.
Where and by whom: exclusively on my own systems – app server and object storage (section 6, EU) and my encrypted computer – and only by me. No external AI services, no transfer to countries outside the EU/EEA. Training of own models only with B6 (5b).
How long: camera images, screen and AR displays, sensor and interaction data 90 days after recording; individual sessions in which I am still investigating an error until it is resolved, at most until 30 days after the end of the test. Analysis copies on my computer 90 days.
Deletion and leaving: under “My recordings” you can delete any session yourself. If you withdraw T1, your participation ends immediately, recording stops and I delete your recordings within 30 days (backups no later than 30 days after that).
Voluntary: because the test consists of the recording, taking part under T1 is not possible without it. Not taking part or leaving has no disadvantages at all. B2, B3 and B6 remain optional.

netcup GmbH, Emmy-Noether-Str. 10, 76131 Karlsruhe, Deutschland – Server-Hosting inkl. Datenbank und Objektspeicher (Standort Wien, AT) sowie E-Mail-Versand (Webhosting)