Privacy Policy for RoadScan and Dashboard

RoadScan (accessible via https://www.roadscan.ai and the SaaS dashboard https://dashboard.roadscan.ai/) is a cloud-based B2B service developed and operated by Enzoft AB (corporate identity no. 559161-3731). The Service is designed for municipalities, contractors, and infrastructure organizations to inventory and analyze road networks and infrastructure using vehicle-mounted camera systems and AI-powered computer vision.

The Service is built upon the principles of Privacy by Design and data minimization. All image processing incorporates Edge masking, meaning automated de-identification (blurring/masking of license plates and faces) is performed locally in real time on the camera device hardware before any footage is transmitted or stored within the SaaS environment.

This Privacy Policy explains how Enzoft AB collects and processes personal data regarding visitors to our website and authorized users who log in and use the dashboard at https://dashboard.roadscan.ai/.

2.1 Enzoft AB as Data Controller

Enzoft AB acts as Data Controller pursuant to Article 4(7) of the General Data Protection Regulation (GDPR) for the processing of personal data concerning:

Registered user accounts on https://dashboard.roadscan.ai/ (names and email addresses).

Business contact representatives, technical support tickets, and ongoing commercial communications regarding the Service.

Technical operations, login security, session telemetry, and audit logs within the dashboard.

2.2 The Customer as Data Controller (Road and Video Capture Data)

For road footage, location telemetry (GPS coordinates, vehicle speed, heading), timestamps, and operational vehicle data captured by mounted camera devices on the road network, the respective subscribing customer acts as the Data Controller. Enzoft AB processes such data solely as a Data Processor on behalf of the customer, governed by an executed Data Processing Agreement (DPA / PUB-avtal).

We collect and receive personal data through the following methods:

Data provided directly by you or your organization:

When a user account is provisioned with your name, email address, and credentials.

When you submit a inquiry to our technical support desk or contact us via email with general inquiries.

Data collected automatically when accessing https://dashboard.roadscan.ai/:

Audit logs: The system automatically logs events and actions performed within the dashboard (such as authentication events, settings changes, and data export activity associated with your account profile).

Cookies and browser storage: Information used for authentication, security, dashboard maps and, with your consent, saved dashboard preferences, as described in section 8 and the accompanying inventory.

Data collected via vehicle-mounted hardware (in the capacity of Data Processor):

Cameras capture road footage sequences. Any personal data in the form of faces or vehicle license plates is automatically masked at the edge directly in hardware prior to storage or cloud transmission.

In compliance with the principle of data minimization, video and image captures are primarily transmitted and retained where AI detection models flag specific road defects or asset anomalies (e.g., damaged traffic signs, pavement distress, clearance profile obstructions), as well as during pre-scheduled, contractual sampling intervals.

We collect and process the following categories of data regarding dashboard users:

(We do not collect or process special categories of personal data pursuant to GDPR Art. 9, consumer marketing contact numbers, personal identification numbers/SSNs, or payment card information within the dashboard.)

We utilize personal data strictly for the following legitimate business purposes:

Delivering and administering the Service: Authenticating user sessions at https://dashboard.roadscan.ai/, configuring access privileges, and granting access to the organization's road analysis assets.

System and administrative communications: Dispatching operational announcements, maintenance windows, security notices, and material service terms updates.

Information security and platform integrity: Preventing brute-force attacks and unauthorized access, investigating security anomalies, and maintaining traceability logs.

Technical support: Resolving customer support tickets, debugging unexpected application behavior, and addressing platform defects.

No third-party marketing: We do not sell or lease user data to third parties, nor do we utilize dashboard account details for unsolicited marketing or advertising campaigns.

Enzoft AB applies rigorous technical and organizational measures for data storage, retention, and disposal in accordance with Article 32 of the GDPR:

Storage location and infrastructure: All platform databases and assets are hosted on secure servers located within the EU/EEA (primarily Sweden). Storage is safeguarded through network segmentation, firewalls, role-based access, encryption at rest, and transport-layer encryption (TLS).

Third-party security and mapping services may process and retain technical information, including logs, elsewhere, as described in sections 7 and 8.

Retention periods for RoadScan-managed records:

User account records: Retained for the duration of the active subscription agreement. Upon customer contract termination or account deactivation, credentials and user metadata are permanently deleted within thirty (30) days, unless longer retention is required by statutory legal mandates.

Security and access logs: Technical connection and access logs are retained for a limited period of six (6) to twelve (12) months for forensic and security monitoring purposes, after which they are purged or permanently aggregated.

Support tickets: Retained for as long as necessary to resolve and document the incident, up to a maximum of twenty-four (24) months post-closure.

Disposal procedures: Upon the expiry of applicable retention thresholds, data is permanently and irreversibly destroyed across live production datastores and progressively aged out of encrypted backup snapshots in alignment with our backup lifecycle schedules.

We never sell, trade, or commercialize user data. Disclosures are limited strictly to verified subprocessors and service vendors operating under binding data protection commitments:

Hosting and Cloud Infrastructure Providers: Providers hosting our platform databases and assets in the EU/EEA. Google Cloud also receives IP addresses and image requests when dashboard images are loaded directly from its storage services.

Security and Mapping Providers: Google or Mapbox receives coordinates through our backend to return addresses; Mapbox also receives road-matching coordinates through our backend. Browser map requests disclose IP addresses, browser information, the viewed map area and service identifiers to Mapbox for map delivery, usage reporting and billing. Cloudflare Turnstile processes IP addresses and browser, device and security information to protect dashboard login.

Backup and Disaster Recovery Partners: Swedish and European cloud services delivering encrypted data backups and disaster recovery capabilities.

IT Engineering and Maintenance Contractors: Vetted technical engineers in Sweden bound by statutory and contractual non-disclosure agreements for support and quality assurance.

Competent Public Authorities: Information is disclosed to judicial or law enforcement authorities (e.g., the Swedish Police Authority or IMY) only when strictly mandated by applicable statutory law or enforceable court order.

All subprocessors are bound by written Data Processing Agreements pursuant to GDPR Article 28.

International transfers: Google, Mapbox and Cloudflare may process and retain some personal data outside the EU/EEA, including in the United States. Transfers rely on the European Commission's EU-US Data Privacy Framework adequacy decision where applicable, or EU Standard Contractual Clauses under the providers' data-protection terms. Details and copies of safeguards are available from info@roadscan.ai.

The website uses no cookies. The dashboard uses necessary cookies and browser storage for login, security, requested downloads and remembering cookie choices. Cloudflare Turnstile protects login and may use security-related browser storage. Mapbox processes technical information and uses service identifiers and map caching to provide and bill for dashboard maps. Optional Mapbox performance reporting is disabled.

Saved preferences (filters, map settings, report colours and cached results) stay off until you consent. Use Cookie Settings in the account menu or on the login page to accept, reject or withdraw preference consent. Rejection or withdrawal clears saved preferences; maps and login remain available. Choices are remembered for 180 days. Withdrawal does not affect earlier lawful processing.

The Cookies and Browser Storage Inventory at https://roadscan.ai/cookies lists items, providers, purposes, data and storage periods. You can also block or delete site data in your browser; blocking necessary storage may prevent requested functions. See section 7 for international processing. Contact info@roadscan.ai with questions.

Under Chapter III of the GDPR, individuals have the following rights regarding personal data for which Enzoft AB acts as Data Controller:

Right of Access (Art. 15): Request confirmation of whether we process personal data concerning you, and obtain a copy along with supplementary processing details.

Right to Rectification (Art. 16): Demand the correction of inaccurate or incomplete personal records without undue delay.

Right to Erasure / "Right to be Forgotten" (Art. 17): Request the permanent erasure of personal data when no longer necessary for the purposes collected, or where processing lacked lawful grounds.

Right to Restriction of Processing (Art. 18): Request that processing be restricted while accuracy or legitimate balance disputes are evaluated.

Right to Data Portability (Art. 20): Receive personal data you provided in a structured, commonly used, and machine-readable format.

Right to Object (Art. 21): Object at any time to data processing carried out under the legal basis of legitimate interest.

Automated Decision-Making (Art. 22): You have the right not to be subject to decisions based solely on automated processing or profiling that produce legal consequences.

Right to Lodge a Complaint: You maintain the right to lodge a complaint with your supervisory authority. In Sweden, this is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten - IMY), Box 8114, SE-104 20 Stockholm, www.imy.se.

Notice regarding road footage: Inquiries concerning roadway imagery or location data captured in transit must be directed to the contracting road authority/customer who acts as the Data Controller for that dataset. To exercise your rights regarding dashboard accounts, contact support@roadscan.ai. We address requests without undue delay and within one month of receipt.

The Service and dashboard at https://dashboard.roadscan.ai/ are exclusively professional enterprise (B2B) software tools intended for working professionals and are strictly not directed to individuals under 18 years of age.

We do not knowingly collect, request, or process personal data from minors or children under 18 years of age (incorporating requirements under GDPR Article 8 and the U.S. Children's Online Privacy Protection Act, COPPA).

If we obtain actual knowledge that personal data belonging to an individual under 18 has been inadvertently gathered via the Service, we will take prompt operational measures to permanently expunge such records from our databases and server infrastructure. If you believe a minor has supplied personal information to us, please notify us immediately at info@roadscan.ai.

Certain web browsers offer a Do Not Track (DNT) preference that transmits a signal to visited sites indicating a desire not to be tracked across third-party websites. RoadScan does not track users over time across third-party web destinations for targeted advertising or user profiling. Because no universal technological standard has been adopted for interpreting DNT signals, the Service does not alter its operational behavior upon receiving a DNT transmission. Nevertheless, the Service does not harvest information for behavioral profiling regardless of signal status.

Enzoft AB enforces robust technical and organizational safeguards in accordance with GDPR Article 32:

Edge Anonymization: Automated masking (blurring) of faces and license plates is processed in volatile device memory directly on field capture hardware prior to persistent storage or transmission.

Encryption and Access Controls: All external and internal transmission is protected with modern transport encryption (TLS). Dashboard access requires authenticated, role-based authorization.

Resilience and Backup Integrity: Production environments and system logs are systematically backed up using encryption and protected against tampering.

We reserve the right to amend this Privacy Policy to reflect technical architectural updates or legal developments. The prevailing version is always hosted on our website and accessible via the dashboard. In the event of material changes, registered account holders will be notified via email or dashboard notification banners.

For questions concerning this Privacy Policy, your statutory data rights, or our Privacy by Design implementation, please contact us at:

Entity: Enzoft AB

Org. no: 559161-3731

Email: info@roadscan.ai / support@roadscan.ai

Websites: https://www.roadscan.ai | https://dashboard.roadscan.ai/