Skip to content

Privacy Policy

Last updated August 2026

Draft — not yet reviewed

This is a working outline, not legal advice. Have it reviewed and fill in your entity details before taking real customers.

This explains what we collect, why, and how long we keep it. It covers the website, the dashboard, and the short links we resolve.

What we collect

When you create an account: your email address, and your name if you give one.

When you create a dynamic code: the destination you choose, the name you give it, and the history of destinations it has pointed at.

When someone scans your code: the time, an approximate country, and the kind of device. We do not store the visitor's IP address. It is hashed with a salt that rotates daily, used only to tell repeat scans from new ones on the same day, and then discarded.

Static codes collect nothing at all. They are generated entirely in your browser and never reach our servers, so there is nothing for us to store.

What we never do

  • Sell or rent personal data
  • Store raw IP addresses of people who scan codes
  • Track you across other websites
  • Put advertising or third-party trackers in a redirect

Why we are allowed to hold it

Account data is processed to provide the service you asked for. Scan data is processed on the basis of legitimate interest in giving you analytics for your own codes and in detecting abuse of ours.

How long we keep it

  • Account data — while your account exists
  • Scan events — 90 days on the free plan, 400 days on paid plans
  • Codes and their destination history — retained after deletion, because a printed code must never be reissued to someone else
  • Security logs — kept for abuse investigation

Who else sees it

  • Google Safe Browsing — destination URLs are checked against known-malicious lists
  • Our email provider — to deliver confirmation and security emails
  • Our payment provider — on paid plans. Card details are entered on their page and never reach us.

Your rights

You can ask for a copy of your data, correction of it, or its deletion. Under India's DPDP Act and the GDPR you may also object to processing or withdraw consent. Email us and we will respond within 30 days.

One limit worth stating plainly: deleting your account does not delete the short codes themselves. They are retired permanently so they can never point at someone else's content, but the slug stays claimed.

Questions? support@scanivo.cloud