SafeReach app privacy notice
Version 1.1 · 3 October 2026 · SafeReach for iPhone
Processing takes place on the iPhone. Machinery photographs, protective-structure images, survey data and reports are stored on the device and are not uploaded to the developer. No SafeReach account or developer-operated cloud archive is required. The app communicates with Apple for purchases and with RFC 3161 time-stamp providers. The latter receive file fingerprints and technical connection data, including the IP address, rather than photographs or reports. There is no advertising or tracking. Photographs must not show identifiable people; users are responsible for what they capture.
1. Scope, controllers and contacts
CE4U S.r.l., trading as RAVENG, supplies SafeReach. CE4U, Italian tax and VAT number 04731920239, REA VR-444364, Via G. Rossini 29/2, 37012 Bussolengo (VR), Italy, is controller for processing through its support, contact and testing channels. Contact info@raveng.it or certified email posta@pec.ce4u.it; use “SafeReach Privacy” in the subject.
The controller for survey photographs and reports is the party that actually determines the purposes and means of the activity, such as the manufacturer, employer, commissioning company or appointed professional. A software licence does not automatically assign that role or give the developer access to local files. Apple and time-stamp providers process their service data under their own notices. Website browsing is covered separately by the website privacy notice and cookie policy.
2. Data on the device
SafeReach processes and stores locally:
- photographs of openings, protective structures, scale references, instrument readings and machinery nameplates, captured or selected by the user;
- machinery manufacturer, model, serial number, year and location; protective-structure and reference-plane information;
- readings in millimetres, uncertainty budgets, image segments, scale, device inclination, LiDAR readings and known-length checks, and declared instrument data;
- required values declared after consultation, with source reference, date and confirmation;
- access-case choices, risk-level reasons and applicability confirmations;
- calculations, comparisons, warnings, reports, revisions, file fingerprints and received time-stamps;
- preferences and learning progress.
Photographs should show machinery, structures, openings and references, rather than people. Avoid recognisable faces or bodies, badges, names, readable screens and documents. SafeReach neither identifies people nor automatically redacts them. Delete and retake a photograph containing identifiable people or third-party personal data before generating a report. Users are responsible for their photographs.
There are no fields for worker data. The assessor's name and optional organisation are declared by the user. The controller of the actual survey activity is responsible for personal data entered in free-text fields.
Local acceptance receipts include a random identifier, declared name, organisation and capacity, device-clock date, app version, and version and fingerprint of the accepted terms. Receipts are not sent to CE4U and do not authenticate identity. Accepting terms is not general privacy consent.
File fingerprints are transmitted for time-stamping. A fingerprint normally cannot reconstruct a file, but can be compared with an already available file; it is not described as necessarily anonymous.
3. Time-stamps and technical communications
The app requests RFC 3161 time-stamps without an additional charge for survey-package objects: PDF reports, package manifests and original photographs. Requests may be retried when connectivity returns and during background activities permitted by iOS. Local availability of a survey does not prove that a time-stamp was obtained; the app displays its state.
An HTTPS request carries the file's SHA-256 fingerprint, algorithm and random checking nonce. Providers also receive the public IP address, request time and app name and version. Through this protocol they do not receive photographs, PDF contents, assessor names, machinery data, advertising identifiers or persistent device identifiers. The transport does not use cookies or a persistent web session.
| Provider | Service and sources | Retention and information limits |
|---|---|---|
| Sectigo | https://timestamp.sectigo.com/qualified; privacy notice; service policies | Provider policies govern technical records, security, obligations and retention. Deletion of every item by a single deadline is not promised. |
| FreeTSA | https://freetsa.org/tsr; published contact busilezas@gmail.com; CPS | The CPS states that information is not required or saved, but does not specify separate periods for every possible technical log. No undocumented deletion or location guarantee is added. |
Providers are listed in the app's configuration. Their linked policies may change. An endpoint name does not establish qualification or evidential value of a particular token. Commercial-use availability of Sectigo's free service is not independently verified in the configuration.
IP addresses and request data are not anonymised in advance by the app. The developer does not receive photographs or reports through time-stamping. App Store privacy details separately describe the actual app flows.
4. Apple purchases
Apple handles purchases, subscriptions, renewals, refunds and restoration under its privacy notice. SafeReach does not receive payment-card numbers. StoreKit verifies transactions on the device. Transaction and product identifiers, dates, environment, state and access rights are stored locally, including in the iOS Keychain. There is no CE4U purchase-verification server.
Only Base monthly and Base annual are offered, both including all functions and reports. No separate report purchase is sold. Deleting the app or a survey does not cancel a subscription; restoring purchases does not recreate deleted files.
5. Permissions and choices
| iOS capability | Purpose |
|---|---|
| Camera | Photographs of openings and protective structures with a scale reference; ARKit camera use for LiDAR readings. |
| Photo Library, addition | Saving original survey photographs to the user's library. |
| Photo Library, selection/read access | Analysing previously captured survey images selected by the user. |
| ARKit / LiDAR | Reading centre-frame distance on supported devices, on-device, under camera authorisation. LiDAR is optional and unavailable on unsupported devices. |
CoreMotion reads device inclination for perpendicularity checks and distance projection. The project supplies a motion-use description; the exact permission prompts depend on the APIs used and iOS. Microphone, contacts, calendar and location are not required. Photographic metadata and library or backup behaviour follow the device and selected services. Manage permissions in iOS Settings; refusing a permission limits the functions that need it.
Refusing the declarations required for Measure and Calculate leaves Learn and archive consultation available. It does not cancel a subscription. There is no separate switch to disable only time-stamp requests: they form part of the stated workflow and may retry when connectivity returns.
6. Sharing and security
Share, AirDrop, Mail, Files and other user-selected services deliver exported contents to chosen recipients. A package can include photographs, reports, revisions, survey data, declarations, receipts and terms. Check for identifiable people, personal data and confidential machinery or site information before sending. Selected recipients and services apply their own rules.
The archive and access rights use iOS app-container and Keychain protections. Set a device passcode and protect backups. Fingerprints and technical signatures assist integrity checks without guaranteeing absolute immutability or verified assessor identity. Exported copies are no longer under the app's exclusive control.
7. Purposes and legal bases
| Activity | Purpose and basis |
|---|---|
| Requested software functions and associated technical flows | Supplying functions, managing purchased access and requesting survey time-stamps: GDPR Article 6(1)(b), to the extent necessary for the requested service. Providers state their own legal bases for processing under their responsibility. |
| Support and contact with CE4U | Responding and carrying out requested pre-contractual or contractual activities: Article 6(1)(b). Unnecessary attachments, especially photographs of people, should not be sent. |
| TestFlight testing, when active | Participation and reported-error management: Article 6(1)(b). Necessary security and establishment, exercise or defence of rights: Article 6(1)(f), limited to relevant data. |
| Surveys organised by a company or professional | The actual controller determines purposes, legal basis, notices and retention, including workplace rules. This notice does not replace notices to people at the site. |
App data are not used for advertising, commercial profiling or sale to data brokers. An iOS permission does not replace any authorisation required to photograph another party's facilities or workplace.
8. Retention and deletion
Local machinery records, structures, surveys, photographs and reports remain until deletion through available functions. Uninstalling removes the app container but does not guarantee deletion of Keychain items, backups, Photo Library images, exports or data already received by others. There is no universal automatic-deletion period.
Backups and libraries follow device and service settings, including iCloud or computer backups. Manage copies separately. Subscription expiry does not automatically delete the archive.
Support and testing data are retained to handle and close requests or testing and, where necessary, document activities or manage disputes, limited to what the purpose requires. Statutorily retained records follow their applicable periods without indiscriminately extending retention to photographs and attachments. Contact CE4U to request review of deletion.
Apple applies its own retention rules. Time-stamp providers follow section 3. Deleting a local file does not automatically delete a provider's existing records.
9. Recipients and international transfers
Authorised personnel and relevant email, hosting and support suppliers may access support and testing data; authorities may receive data where law requires. Website channels are described in the website notice. Support requests are not published.
Apple and time-stamp providers may use infrastructure outside the EEA. Their notices describe transfers and channels for information on applicable safeguards. FreeTSA's CPS does not document a specific hosting-location guarantee or transfer agreement with the developer; this notice does not attest that one exists. HTTPS protects transport but is not itself a legal safeguard for an international transfer.
10. TestFlight and external websites
When TestFlight is used, Apple may make service data available to the developer: invitation information, device and system details, installations, sessions, crashes, comments and submitted screenshots. These are used to manage testing and correct issues. See Apple's TestFlight privacy information.
Source, contact and legal links open in the browser. Website cookies and statistics are separate from the app. No third-party advertising or analytics SDK is integrated into SafeReach.
11. Rights
Where applicable, rights include access, rectification, erasure, restriction, portability and objection under GDPR Articles 15–22. Consent-based processing consent may be withdrawn without affecting prior lawfulness. For CE4U processing, contact info@raveng.it or posta@pec.ce4u.it with “SafeReach Privacy” in the subject. Identity verification may be proportionate; do not send identity documents, photographs or complete reports unless requested.
For local content, contact the controller of the actual survey activity and use the app's functions. The developer has no remote archive access. For provider data use their notice contacts. You may lodge a complaint with the Italian Data Protection Authority or the competent authority.
12. Adults and updates
SafeReach is intended for adults. It calculates geometric quantities and does not make decisions about people with legal effects. Avoid unnecessary photographs and personal data. Changes to data flows require an updated notice. Date and version identify this text; it does not imply that unimplemented cloud services or functions are active.