Privacy Policy: How Scanqur Handles Your Data

This policy explains what data Scanqur collects, why, how long it is kept, who processes it on our behalf, and the rights you have. Scanqur, published by AFIF Mariem EI SCANQUR, a sole trader (SIREN 130 418 882, MTE DES MAURUCHES, 06220 VALLAURIS, FRANCE), is the data controller for the accounts of businesses and their teams, and for visitors to scanqur.com. For the data of a business's own customers (bookings, orders, reviews, optional identity), the business is the controller and Scanqur processes that data on its behalf (section 7).

Information We Collect

Your account: your email address and a hashed version of your password; if you join a business's team, the invitation sent to your address. Your business: the details you enter (name, address, phone number, business type, opening hours, logo and photos) and your menu (categories, products, prices, descriptions and translations). Your subscription: the plan, its dates and the status of payments, never your card details. Your use of the service: your conversations with the support assistant, the push-notification subscription of each device on which you turn notifications on, and the messages you send through the contact form. Technical data: standard server logs (pages requested, times, browser and device information) and, when something breaks, an error report. The data of your customers is covered in section 7.

How We Use Your Data

We use your data only to run and improve Scanqur, and each use rests on a legal basis under the GDPR. To provide the service you signed up for (performance of the contract): your account, your public menu, bookings and orders, translations and the AI features you choose to use, payments, and the emails the service needs, such as confirmations, password resets and booking notifications. On our legitimate interest: securing the platform and fixing errors, the consent-free visit statistics described in section 8, and a few emails about using Scanqur (getting started, a feature you have not tried yet, the end of a trial), each with a way to stop them. With your consent, which you can withdraw at any time: Google Analytics cookies (section 8) and push notifications. We never use your data for advertising, and we never sell or rent it.

Data Sharing and Third-Party Services

Your data is stored in the European Union: Supabase hosts our database, authentication and files in Ireland. A small number of processors handle only what their task requires: Resend, which sends our emails; DeepL, which translates menus; Google, which hosts the website, runs the AI features and, only if you accept it, Google Analytics; Stripe, which takes card payments for the Pro plan, and PayPal, for the subscriptions taken with it, so that we never see or store your card details; Sentry, which receives error reports on servers in Germany; Cloudflare, when you serve your menu on your own domain; Web3Forms, which forwards the contact form to us; and Trustpilot, whose review widget appears in the dashboard, and which receives your name and email address once, when your first menu is published or the Pro plan is switched on, so that it can invite you to review Scanqur. Videos on the site are played from YouTube in its privacy-enhanced mode, and only once you click them. Your browser's push service (from Google, Apple or Mozilla) delivers the notifications you turned on. Some of these providers are based in the United States; those transfers rely on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses. We may also disclose data when the law requires it, or to protect the rights, property or safety of Scanqur, its users or others. The AI features deserve a word of their own, because they send content to Google: scanning a photographed menu sends that photo; writing a product description or a social post sends what you have typed and a few facts about your business; translating a menu into a language DeepL does not cover sends the menu's text; rendering a floor plan sends the plan; and the support assistant sends your question, the recent messages of that conversation and the settings of the business you are asking about. They never send your customers' personal data, and they only run when you use them.

Data Retention

Your account, your business and your menu are kept as long as your account is active. When you delete your account from the Settings page, your account, your businesses and everything attached to them, your customers' data included, are deleted at once, and disappear from our backups within 30 days. A subscription paid through PayPal must be cancelled first; payment records are kept by Stripe and PayPal under their own legal obligations. Your conversations with the support assistant are kept with your account and deleted with it. Error reports are deleted automatically after a limited period, and contact form messages are kept only as long as needed to answer them. A business's visit statistics are daily totals linked to no one, kept as long as the business exists; the site's own statistics are kept 25 months at most (section 8).

Your Rights (GDPR)

Under the GDPR you may access your personal data, have it corrected or deleted, receive a portable copy, restrict its processing, object to processing based on our legitimate interest (including the emails about using Scanqur and the visit statistics), and withdraw a consent at any time, without affecting what was done before. To exercise these rights, write to contact@scanqur.com; we answer within one month. If you are a customer of a business, you can also contact the business directly, and we will help it answer. If you believe your rights are not respected, you can lodge a complaint with the CNIL (www.cnil.fr) or with the data protection authority of your country.

Security

We apply industry-standard security measures to protect your data. Passwords are stored using strong one-way cryptographic hashing and are never readable by anyone, including us. Access to our production database is restricted to authorised personnel. While we make every reasonable effort to secure your information, no online service can guarantee absolute security. We encourage you to use a strong, unique password for your account.

Customers of Businesses

When you use a business's menu, the business decides what is collected and is the data controller; Scanqur stores and processes this data on its behalf. Depending on what the business offers: a booking keeps your name, phone number, email address, party size and any note; an order keeps the dishes, the table and any note; a review keeps the name you give, your rating and your comment; a call to the waiter keeps the table and the time; a like is recorded for your device, with no identity. The business keeps this data as long as its account exists, unless it deletes it sooner. On the menu of a business on the Pro plan, you may also choose to confirm your email address with a one-time code, to keep your loyalty stamps, orders and bookings on every device. We then keep that address, the date it was confirmed, and your choice about receiving the business's offers, which is separate and off by default. This identity belongs to one business only and is never shared with another Scanqur business. The code is stored in hashed form and expires after 10 minutes. You can at any time sign out, withdraw your consent to offers, or permanently erase your identity from the business's menu; the order history is then kept by the business with no link to you. Your guests do not have to read this policy: the footer of your menu, the booking form and the review forms link to a privacy notice in the name of your business, which lists only what your menu records and gives your contact details for their requests.

Cookies and audience measurement

On scanqur.com, Google Analytics cookies (_ga, _ga_*) are set only if you accept them in the banner. They give your browser a random identifier so we can measure visits and how the site is used; they are never used for advertising and we never combine them with other data. Google Analytics is provided by Google, which may process this data in the United States under the EU-US Data Privacy Framework. Your choice, whether you accept or refuse, is kept in your browser for 6 months; you can change it at any time with the “Cookie settings” link at the bottom of the page or in your account settings. If you withdraw your consent, measurement stops at once and the Google Analytics cookies are deleted. To count every visit, including those of visitors who refuse these cookies, we also use our own audience measurement, with no advertising cookie and no identifier. It only records daily totals: pages viewed, landing page, referring site, search engine or e-mail, language, device type, time zone and number of signups, with no IP address and nothing that could identify you or link a visit to an account. Two technical markers kept in your browser avoid counting the same visit twice. Business menus, which do not use Google Analytics and show no banner, are measured the same way. These totals are kept for 25 months at most. Limited to visit statistics, this measurement is exempt from consent under the CNIL's guidelines; you can still object with the setting below, which applies to this browser on scanqur.com, and we honour your browser's Global Privacy Control signal everywhere. Other items stored in your browser are strictly necessary for the service to work (signing in to your account, language, theme, cart, remembering your choices) and need no consent.

Count my visits in Scanqur's statistics

On: your visits are counted anonymously, in daily totals.

Contact

If you have any questions, concerns, or requests regarding this Privacy Policy or the way your data is handled, please contact us at contact@scanqur.com. We aim to respond to all privacy-related enquiries within 30 days.

Back to home Terms of Service