Privacy and Security Statement

This statement describes how information in connection with the SCANNER Analytics service is handled, including what the Service does, the information it holds, where that information is stored and processed, the security measures that apply and the service providers involved.

This statement is provided for information. It is intended for Researchers, the ethics committees and data protection officers who review their studies, and Partner Institutions that share data with SCANNER Analytics.

In this statement:

• Inference Engine means the software and hardware that analyse Research Media, described in clause 3.3;
• Partner Institution means an organisation that collaborates with Deakin on a SCANNER project;
• Participant means an individual who takes part in a study and may appear in Research Media;
• Research Media means images and videos uploaded to the Service, and the results, annotated videos and exports derived from them;
• Researcher means a person who holds an account on the Service;
• Service means SCANNER Analytics, comprising the Web App, the storage and databases described in Schedule 1, and the Inference Engine; and
• Web App means the website at smart-scanner.com through which Researchers use the Service.

The Service analyses images and videos to detect pre-defined categories of marketing content, such as brand logos and vape or tobacco products.

The Service operates as follows:

• a Researcher creates a dataset and uploads images or videos through the Web App;
• each file is placed in a processing queue;
• a processing machine at Deakin retrieves the file, splits videos into frames, and analyses each image or frame using the recognition models selected for the dataset;
• the Service produces structured results (the detected brand or category, its location in the image, the time in the video and a confidence score) and, for videos, a copy of the video with the detections drawn on; and
• the Researcher reviews the results, may include or exclude detections and add comments, and may export a spreadsheet of the reviewed results.

The Inference Engine uses the following recognition models:

• brand detection: an object-detection model trained to find brands, supported by text recognition (OCR) that reads brand names shown on screen; and
• vape and tobacco detection: an object-detection model and text recognition (OCR) that find vape and tobacco products and related keywords, together with an open-weight vision-language model that classifies whether an image or frame shows vape or tobacco content.

All recognition models run on Deakin-managed hardware. Research Media is not sent to any external artificial intelligence or machine-learning service.

In relation to the operation of the models:

• the models are pre-trained and fixed, and do not learn from or retrain on uploaded data;
• the Service is deterministic: given the same input, model versions and configuration, it produces the same output; and
• results are reviewed by Researchers, who decide which detections are used in their analysis.

The Service does not perform facial recognition, biometric identification, emotion recognition or profiling, is not designed to identify individuals or track their activities, and makes no decisions about individuals.

Service accounts are held by Researchers. The categories of information we hold are set out in Schedule 2 and comprise:

• Researcher account information (first name, last name, email address and account settings);
• dataset and task details (such as dataset names, file names, file sizes and processing status);
• Research Media; and
• operational logs.

Research Media may include images of Participants. Researcher account information, dataset details and operational logs are not intended to contain information about Participants.

The Web App does not use advertising, analytics or tracking cookies. It sets only the cookies necessary to keep a Researcher signed in and to remember display preferences.

Researchers are asked to de-identify data before uploading it wherever possible.

Uploaded images are re-encoded when stored, which removes embedded metadata such as camera details and GPS location. Videos are stored as uploaded.

The Service does not link Research Media to Participant names or other identifiers. Researchers are asked not to include Participant identifiers in dataset or file names.

Information for Participants, including what is collected, how long it is kept and how consent is obtained, is set out in each study's Participant Information and Consent Form.

The components of the Service, the information each holds and their locations are set out in Schedule 1.

Research Media is stored in Microsoft Azure in the Australia East (Sydney) region.

Research Media is analysed only on Deakin University–managed servers in Victoria and is not analysed on cloud servers.

Research Media moves only between:

• the Researcher's browser and Azure storage in Sydney, for upload, viewing and download;
• Azure storage and the Deakin processing servers in Victoria, for analysis; and
• Azure storage and the Web App in Sydney, for thumbnails, downloads and spreadsheet exports, in memory only.

Research Media, results and dataset details are stored and processed in Australia only.

The Web App runs on Microsoft Azure Container Apps in the Australia East (Sydney) region, within the same Azure environment as file storage. The Web App's software is built and stored in Deakin's internal code registry.

In relation to Research Media, the Web App:

• issues short-lived, single-file upload links that allow videos to be uploaded directly from the Researcher's browser to Azure storage;
• receives, resizes and stores uploaded images;
• provides access to stored files through short-lived signed links or by streaming them to the Researcher;
• builds spreadsheet exports and saves them to the Researcher's storage;
• handles Research Media in memory only, and does not retain copies on its own storage; and
• does not run the recognition models.

Earlier versions of the Web App were hosted on Vercel. The Vercel deployment was shut down on 11 October 2026. Vercel is no longer part of the Service and does not host, cache or process any information for the Service.

SCANNER Analytics applies the following measures to protect information held in connection with the Service:

• encryption in transit: every network connection between browsers, the Web App, storage, the databases and the processing servers uses TLS 1.2 or higher, and Azure storage accepts HTTPS connections only;
• encryption at rest: stored files are encrypted with AES-256 by Microsoft Azure, and the databases are encrypted at rest by their hosting providers;
• private storage: storage containers are private and never publicly accessible, each Researcher's files are kept in a separate area, and the Web App verifies that the signed-in Researcher owns a file before granting access;
• time-limited access links: upload and viewing links are signed and expire automatically;
• account security: email addresses must be verified before an account can be used, passwords are stored only as secure hashes, and sign-in links expire after 24 hours;
• role-based access: Researchers can access only their own datasets, and the Service's administration console, which is available to a limited number of staff to manage accounts and the processing queue, does not display Research Media;
• secure processing: the processing servers are managed by Deakin, are located on the Deakin network and are operated in accordance with Deakin's ICT (Information and Communication Technology) security policies;
• no external AI services: Research Media is not sent to third-party artificial intelligence or machine-learning services; and
• staff access: administrator access to the Azure and Google Cloud accounts is limited to the SCANNER development team, who access a Researcher's Research Media only at that Researcher's request or where necessary to resolve a fault affecting it.

Research Media is retained in the Researcher's account until the Researcher deletes it.

When a Researcher deletes a file or dataset, the associated stored files, results and exports are deleted. Deleted files remain recoverable by the SCANNER development team for 7 days, to allow recovery from accidental deletion, and are then permanently removed.

A Researcher may request deletion of their account. On deletion, we delete the Researcher's account information and all of their datasets, Research Media and queued processing.

Uploads that are started but not completed are deleted automatically.

Web App operational logs are retained for 30 days.

The application database is backed up weekly, and each backup is retained for 60 days.

Information deleted from the Service may remain in these backups until they expire. Backups are encrypted, are not used for any other purpose, and are restored only to recover the Service from a fault.

SCANNER Analytics uses the service providers listed in Schedule 3 to host parts of the Service. None of these providers analyse the content of Research Media.

SCANNER Analytics will update this statement if the service providers listed in Schedule 3 change.

Each research team is responsible for:

• obtaining and complying with its own ethics approvals and governance arrangements;
• providing Participant information and obtaining consent;
• entering into any Agreement required for its project;
• de-identifying data before upload wherever possible; and
• not including Participant identifiers in dataset or file names.

Participants should first refer to their study's Participant Information and Consent Form or contact the research team that invited them.

Other enquiries about privacy or security may be made through our contact us page.