Privatlivspolitik

Who we are

Scanay is run by Informacijske storitve, Davor Pečnik s.p., Troblje 44C, 2380 Slovenj Gradec, Slovenia (registration no. 8394709000, VAT ID SI26715147), the controller of the personal data described here. Write to [email protected] with any question about your data.

Data about you, the merchant

• Account: your name, e-mail address and a hashed password.
• Billing: company name, address, country and VAT ID, and whether the VAT ID passed the EU VIES check. Card details go straight to Stripe; we never see them.
• Store: your Shopify store address, its name, contact e-mail, currency and time zone, and the app keys or webhook signing key you give us, which are stored encrypted.
• Bank details: the IBANs, recipient names and reference settings you enter for each country.
• Security records: sign-in sessions with IP address and browser, and a log of important account events. The log is kept for one year.

We use this to run the service, bill you, keep your account secure and answer you when you ask for help. The legal bases are our contract with you, our legal duty to keep invoices, and our legitimate interest in preventing abuse.

Data about your customers

To make a payment code, Shopify sends us each order. From it we keep only what the code needs: the order number and date, the shipping country, the currency, the amount due and whether the order is paid or cancelled. We do not store your customers' names, addresses or e-mail addresses. The code image and these order fields are deleted 30 days after the order last changed.

For this data you are the controller and we process it on your behalf, as described in our terms.

Payment codes you create

In the app you can make a payment code for any invoice or payment. We store what you enter (recipient name, address, IBAN, amount, reference and description) and the code. All codes expire after 30 days. After that the code, its links and this data are deleted automatically. You can delete a code yourself at any time, and deleting your account deletes all of them.

Each code has a link for the people who should pay. Anyone who has the link can open it without signing in and sees the payment details you entered. The link is long and random, it is not listed anywhere, and the pages and images are marked so that search engines do not index them. Share it only with people who should see these details. Do not enter personal data of third parties that you do not need in the payment description. For these details you are the controller, and we process them for you as described in our terms.

The pages that show a code carry a "Made with Scanay" link and a link to report abuse. If a code is reported, we may look at it and switch it off. We log that decision and tell the owner why.

Who else processes data

• Stripe handles subscription payments and invoices.
• Brevo sends our e-mails, such as confirmation links and payment notices.
• Our hosting and database providers store the service's data.
• Google provides website analytics, only if you accept analytics cookies.
• Shopify sends us your store's orders, under your own agreement with Shopify.

We send the full, current list of providers and their locations on request. Where data leaves the EU, the provider is covered by the EU standard contractual clauses or an adequacy decision.

Website visitors

If you accept analytics cookies, Google Analytics (Google Ireland Limited) receives an anonymised IP address, the pages you view, your browser and device type and the referring site, so we can see which pages help. We use this only for statistics, on the basis of your consent, and you can withdraw it at any time. We also use Google Search Console and Bing Webmaster Tools, which give us search statistics about the site and do not receive data from your visit. Our web host keeps ordinary server logs (IP address, page, time) for security.

Cookies and local storage

The Scanay app keeps your sign-in token in your browser's local storage so you stay signed in; signing out removes it. Analytics cookies are set only if you accept them. The details are in the cookie policy.

How long we keep data

• Payment codes and their links: 30 days, then deleted automatically.
• Order QR images and order fields: 30 days after the order last changed, then deleted automatically.
• Account and store data: while your account exists. You can delete your account yourself in the app under Account, Your data. We first charge any amount you still owe, cancel your subscription, then delete your account, store connection and settings, codes, setup requests, activity log and the e-mails we hold about you. We send you one last e-mail to confirm it.
• Invoices and billing records: ten years, as Slovenian tax law requires, even after you delete your account. Stripe keeps the customer record that belongs to them. We keep a record that your account was deleted, without your name or e-mail address.
• Security log: one year.

Your rights

In the app, under Account, Your data, you can download a copy of your data and delete your account yourself. You can also ask to see, correct, export or delete your data, to restrict how we use it, or object to a use based on legitimate interest. Write to [email protected] and we reply within one month. You may also complain to the Slovenian Information Commissioner (Informacijski pooblaščenec, ip-rs.si).

Changes

If we change this policy in a way that matters, we tell you by e-mail before the change applies.