Privacy Policy

1. Who operates Scanvoya

Scanvoya, available at scanvoya.com, is operated by Frank as an individual. Frank is responsible for the personal information described in this policy. Contact: newlifebirdstudio@gmail.com.

This policy covers visitors, account holders and people who open links or files hosted by Scanvoya. Websites you reach through a code or smart link have their own privacy practices.

2. Information we use

• Account information. Your email address, display name, account creation details, workspace membership and permissions. Email sign-in uses a temporary verification code. If you choose Google sign-in, Google provides your account identifier, verified email address and name. We do not request access to your Gmail, Drive or contacts, or store your Google password.
• Content you save. QR and barcode contents, destination links, designs, uploaded images and documents, labels, folders, routing rules and sharing settings. Content may include contact details or other information you choose to enter. Any supported account or link passwords are stored as hashes.
• Service and security information. Session identifiers, temporary sign-in challenges, delivery results and support messages. Our servers and hosting providers receive network information such as IP addresses, request paths and browser information to deliver and secure the service. Infrastructure logs may contain this information.
• Billing information. Creem processes subscription payments and handles card details. We store subscription identifiers, billing cycle, payment status and paid access dates to manage your membership. We do not store full card numbers or security codes. Creem processes payment information under its own privacy policy.
• Hosted-link visits. For dynamic links, we store the visit time, code identifier, device category, browser category and referring website hostname when available. The application does not store visitors’ IP addresses in these scan records or currently derive their precise location. Link owners and authorized workspace members can view the resulting analytics.

A static code that links directly to another website does not send its scans through Scanvoya. A code pointing to a Scanvoya-hosted file or page still makes a request to our service.

3. Why we use information

We use information to provide accounts and workspaces, save and deliver your content, redirect hosted links, enforce passwords and schedules, display visit statistics, respond to support requests and protect the service against abuse.

Where a legal basis is required, we rely on providing the service you request, legitimate interests in security and service operation, compliance with legal obligations, or your consent for optional Google Analytics. You can withdraw analytics consent at any time.

4. Cookies and website analytics

Essential cookies keep you signed in and protect authentication. The account session lasts up to 30 days; temporary email and Google sign-in cookies last up to 10 minutes. Browser storage preserves your analytics preference.

Our own website statistics contain daily aggregate counts of pages and actions, device categories, referral hostnames and campaign labels. They do not contain analytics visitor IDs, form contents, full destination URLs or IP addresses. These aggregate counts are retained for 365 days. Do not place personal information in UTM campaign labels.

Google Analytics loads only after you allow it. Google then processes browser and cookie identifiers and technical information to measure visits, sources and actions. We send normalized page names and action types, not your QR contents, destination URLs, email address or passwords. Advertising signals and personalization are disabled in our integration.

Use Analytics preferences in the footer to allow or decline Google Analytics. Your choice and our configured analytics cookies expire after 180 days. Withdrawing consent stops future collection through our integration and clears its accessible analytics cookies; it does not automatically delete information Google already received. We honor Do Not Track and Global Privacy Control for website analytics. Hosted dynamic-link statistics are separate.

Read Google’s Privacy Policy and how Google uses information from partner services.

5. Sharing and service providers

Railway hosts the application and saved data. Resend processes your email address and message contents to send requested sign-in and service emails. Google processes information when you choose Google sign-in or allow Google Analytics. We may also disclose information when legally required, to protect people or the service, or at your direction.

We do not sell personal information or use it for cross-context behavioral advertising. We do not send saved content to an AI provider in the currently deployed version.

Workspace collaborators can access information allowed by their roles. Anyone with an uploaded file’s public share URL may open that file. A password on a dynamic link does not protect a separately accessible file URL. Only upload content you intend to share with the relevant audience.

6. Retention and security

We retain accounts and saved content while needed to provide the service, unless you remove content or request deletion. Scan records remain associated with their saved code and are removed from the active database when that code is deleted. New uploads that are not attached to saved content are eligible for deletion after 24 hours. Replaced files used by dynamic QR codes or Smart Links are eligible for deletion after 7 days when no saved content uses or retains them. Static QR code replacements keep old files by default to support printed codes. When deleting saved content, you can choose to keep its attachments or schedule unused attachments for deletion after 7 days; file links and printed codes pointing to deleted files will stop working. Legacy uploads are protected from automatic cleanup unless you explicitly include them in file deletion. Cleanup runs periodically and failed removals are retried. Contact us to request account deletion or removal of separately retained files.

Sign-in challenges expire after 10 minutes; expired challenge and rate-limit records are cleaned up during subsequent authentication requests. Some records may need to be retained for security, dispute handling or legal obligations. Copies in provider logs or any backups follow their applicable retention and removal processes.

We use HTTPS, hashed credentials and access controls. No storage or transmission method is completely secure. Keep your own copies of important source files and exported artwork.

7. International processing and your choices

Scanvoya serves users internationally. Hosting and email or analytics providers may process information outside your country. Where applicable law requires safeguards for an international transfer, those safeguards must apply to that processing.

Depending on your location, you may have rights to access, correct, delete or receive a copy of your information, restrict or object to processing, withdraw consent, or complain to your local data protection authority. Contact newlifebirdstudio@gmail.com to make a request. We may need to verify your identity and will handle requests subject to applicable law. Declining optional analytics does not prevent you from using the QR tools.

8. Children and policy updates

Scanvoya is not intended for children under 16. If you believe a child has provided personal information, contact us so we can investigate and remove it as appropriate.

We may update this policy when the service or its practices change. The updated date appears above. We will provide additional notice or seek consent where required by applicable law.