Privacy policy

Last updated: September 6, 2026

Who is responsible

SARL Jérémy DEVOS, publisher of Scanolo, is responsible for the data processing described here. Contact: [email protected].

Account holder data

To create an account, we collect your email address, a password (stored hashed, never in plain form) and, if you provide them, your name and billing information. This data is used to provide the service, to send you account-related emails (verification, password reset, billing, security alerts) and, only if you turn it on, a weekly summary.

Legal basis: performance of the contract (article 6.1.b of the GDPR) and, for the weekly summary, your consent. Retention: for the lifetime of the account, then permanent deletion seven days after your deletion request.

Data of people who scan a code

When someone scans a dynamic code, we log the date and time, the country and, when the network provides it, the approximate city, the device type, the OS and the browser. The IP address is used only to compute a non-reversible daily fingerprint (unique visitors) and isn't kept in plain form. No cookie is placed on destination or redirect pages.

Legal basis: the code owner's legitimate interest in measuring how their materials are used, with minimized data. Retention of detailed scan rows: depending on the owner's plan (30 days to 5 years) plus 30 days; daily aggregates with no personal data are kept.

Payment

Payments are processed by Stripe. We don't store card numbers. Stripe processes your data under its own privacy policy.

Emails

Transactional emails are sent through a European sending provider. No marketing email is sent without your agreement.

Subprocessors

Hetzner (hosting, Germany), Cloudflare (content delivery network and protection), Stripe (payment), Brevo (email sending, France). No data is sold or shared for advertising purposes.

Your rights

You can access your data, correct it, export it and delete your account from the app's settings. For any other request (objection, restriction), write to [email protected]. You can lodge a complaint with the CNIL (French data protection authority) if you believe your rights aren't being respected.

Cookies

The app uses a strictly necessary session cookie and a form-protection cookie. Public pages may use an anonymized audience measurement tool described below when it's enabled. Code destination pages use no cookie at all.

Audience measurement

Public pages use Google Analytics 4 with anonymised IP addresses and no advertising signals. The application (logged-in area) and the codes' landing pages embed no third-party tracker: key actions (sign-up, code creation, subscription) are counted server-side and sent to Google Analytics under a non-reversible technical identifier, without IP address or email.