Privacy policy

This policy explains what personal data Scanteo processes, why, for how long and what rights you have. Scanteo is operated by , (), the controller of the data described below. Contact: .

1. Our approach

We collect as little as we can. Our website and the redirects of your QR codes use no advertising or analytics cookies, and we never store the IP address of people who scan a code.

2. Account holders

When you create an account and use the service we process:

• your name, email address, password (stored only as a one-way hash), language and, if you enable it, your two-factor authentication secret;
• the content of your workspaces: QR codes and their destinations, designs, logos and files you upload, tags and settings;
• billing status received from Stripe (customer and subscription identifiers, plan and renewal dates, invoice numbers and amounts, card brand and last four digits). We never see or store full card details;
• technical logs needed to keep the service secure (for example failed sign-in attempts).

Legal bases: performance of our contract with you (Art. 6(1)(b) GDPR), our legitimate interest in security and preventing abuse (Art. 6(1)(f)) and legal obligations such as accounting (Art. 6(1)(c)).

3. People who scan a code

When someone scans a dynamic code we redirect them and record the scan for the owner of the code. For this data our customer is the controller and we act as their processor. We record: the time, the code, the device type, operating system and browser derived from the user agent, the referring website, the preferred language and, where our content delivery network provides it, the country and city. To count unique visitors we compute a hash of the IP address with a random key of the day; the key is deleted after two days, after which the hash can no longer be linked to anyone. The IP address itself is never written to our database or logs. A second hash used to ignore repeated scans within an hour is kept in memory for at most two hours. If the owner runs an A/B test, the variant is chosen from a keyed hash of the IP address computed during the redirect and not stored; only the variant letter is recorded.

Visitors of hosted pages and forms

Mobile pages are served without cookies or scripts. We count visits and button clicks per page and per code without storing IP addresses. When a visitor sends a page form (an inquiry, an RSVP or feedback), we store what they typed, encrypted, for the owner of the page, who is the controller; we only process it on their behalf. A keyed hash of the IP address of the day is used for one hour to limit spam. If the owner enables Cloudflare Turnstile, Cloudflare checks the visitor to tell people from bots.

Integrations our customers turn on

If a customer connects Google Analytics 4, webhooks or conversion tracking, we send scan or form data to the destination they chose (their Google Analytics property or their server), on their instructions. Scans sent to Google Analytics contain no IP address or user agent, only the code, country and device category, with a pseudonymous identifier that changes every day. Conversion tracking adds a signed click identifier to the destination address; the customer's site stores it in the visitor's browser only after the visitor agreed to it on that site.

Safety checks

To protect people from phishing and malware, we send the destinations of dynamic codes and the links on hosted pages to Google's Web Risk service, and we request those addresses from our servers to check that they still work. Reports sent through our abuse form are kept to handle them; the optional email address is stored encrypted.

4. Website visitors

Our marketing pages set no cookies. When you sign in, we set strictly necessary cookies for your session and for protection against cross-site request forgery. Shared analytics links work without cookies.

5. Processors we use

• Stripe (Stripe Technology Europe, Limited and its affiliates, which operate Link), our merchant of record, for payments, invoices and taxes (an independent controller for payment data);
• [Hosting provider and region];
• Google Ireland Ltd (Web Risk), to check links against lists of unsafe sites, and Google Analytics only when a customer connects it;
• Cloudflare, Inc. (Turnstile), only when spam protection is turned on;
• [Email delivery provider], for account and limit notification emails;
• [Content delivery network], for fast and secure delivery of redirects.

6. How long we keep data

• Account and workspace data: while your account exists, then deleted within [30] days unless the law requires us to keep it longer;
• Scan statistics: while the related account exists; daily visitor keys are deleted after two days;
• Raw scan exports you request: seven days;
• Page form responses: until the page owner deletes them or their account;
• Workspace activity log: one year; webhook delivery history: 30 days;
• Invoices and accounting records: as required by tax law.

7. Your rights

You may ask for access to your data, correction, deletion, restriction of processing, data portability, and object to processing based on legitimate interest. You may also lodge a complaint with your data protection authority. If you scanned a code of one of our customers, please contact that customer first; we will help them answer your request.

8. Security

Traffic is encrypted, passwords are hashed, administrative access requires two-factor authentication and every administrative action is logged. Hosted files and shared pages run on a separate domain from the application.

9. Changes

We will announce material changes to this policy by email or in the application before they take effect.