Privacy Notice

1. Data we collect and why

• Account data (name, email, login credentials, authentication identifiers from Google sign-in) — to create and secure your account. Legal basis: performance of a contract.
• Content you create (event pages, text, images, themes, QR codes) — to provide the service. Legal basis: performance of a contract.
• RSVP and guest data (name, attendance, guest count, messages submitted on your event pages) — to deliver responses to the page owner. Legal basis: contract (owner) and legitimate interests / consent of the guest.
• Usage and telemetry (page views, QR scan counts, device type, browser, IP address, approximate location derived from IP) — for security, abuse prevention, analytics and product improvement. Legal basis: legitimate interests, and consent where optional analytics cookies are used.
• Support messages — to answer your questions. Legal basis: legitimate interests.
• Subscription records (plan, status, renewal dates) — to give you access to paid features. Legal basis: contract and legal obligation.

We do not collect or store card details. Payment data is collected and processed by Paddle, our Merchant of Record.

2. Who we share data with

• Service providers / subprocessors — hosting, database and authentication infrastructure, email delivery, error monitoring and analytics tooling.
• Paddle.com Market Ltd — our Merchant of Record, for the sale of subscriptions, payments, subscription management, invoicing, tax compliance and fraud prevention.
• Professional advisers — legal, accounting and audit advisers where necessary.
• Authorities — where required by law or to protect our legal rights.

We do not sell personal data.

3. International transfers

Our providers may process data outside the UK/EEA. Where that happens we rely on adequacy decisions or Standard Contractual Clauses together with appropriate technical and organisational safeguards.

4. Retention

Account data and pages are kept while your account is active and for up to 90 days after deletion to allow recovery, unless you ask for immediate erasure. RSVP data is kept until the page owner deletes the page or the RSVP. Billing and tax records are retained for the period required by law (typically 6–10 years). Logs and telemetry are kept up to 12 months. After these periods data is deleted or anonymised.

5. Your rights

Depending on where you live you have the right to access, rectify, erase, restrict or object to processing of your personal data, to data portability, and to withdraw consent at any time without affecting prior processing. You can also lodge a complaint with your supervisory authority. We respond to requests within one month.

6. Security

We apply appropriate technical and organisational measures, including encryption in transit, encrypted storage, row-level access controls in our database, least-privilege access for staff and regular review of our infrastructure.

7. Cookies

We use essential cookies (sign-in session, security, load balancing) that are always on, and optional analytics and marketing cookies that are only set once you consent. You can change or withdraw your choices at any time.

8. Contact

For privacy questions or to exercise your rights, contact us at privacy@scanlet.app.