Privacy Policy

Sign-in

You sign in with Google or Sign in with Apple. From Google we receive your email address. From Apple we receive your email address or an Apple private relay address (@privaterelay.appleid.com). We accept both.

What we store

• The restaurant name, menu, tables, and orders you create
• Email addresses of staff you invite to your workspace
• Order details: items, table number, status, timestamps, totals
• A phone registration used to send you push notifications about orders and tables

Push notifications

You can pause alerts for one restaurant without silencing others. Signing out or uninstalling the app removes that registration from our servers.

Staff invitations

When you invite staff, we send an invitation email and store the invitee address until the invite is accepted, revoked, or expires after 7 days.

Diners

If diners place orders through your QR codes, we store the order contents, table number, timestamp, and IP address for fraud prevention and to show you the order. We do not create diner accounts.

Account deletion

You can delete your account from the app at Settings > Delete account, or on the web at https://scascan.com/account/delete. Deletion cancels any active subscription, unpublishes your restaurants, removes you from any restaurant you joined as staff, and signs you out. Billing records are retained for 7 years to meet tax requirements.

Data controller

RAYNETIC SOLUTIONS PTY LTD
Brisbane, Queensland 4014
Australia
privacy@scascan.com

Legal basis for processing

We process your personal data on these legal bases:

• To perform our contract with you (Article 6(1)(b)): providing the ScaScan Restaurant workspace, orders, tables, staff invitations, and billing.
• To comply with legal obligations (Article 6(1)(c)): retaining billing records for tax.
• For our legitimate interests (Article 6(1)(f)): securing the service, preventing fraud, and improving the product.
• With your consent (Article 6(1)(a)): push notifications. You can withdraw at any time in Settings.

International transfers

We use Paddle (United Kingdom) for payments and Firebase (Google, United States) for realtime updates and notifications. Data may be transferred outside the EU. These transfers use Standard Contractual Clauses approved by the European Commission.

Retention periods

• Account email, name: until you delete your account.
• Restaurant, orders, tables, sessions: until you delete your account or the restaurant.
• Staff invitations: 7 days, or until accepted or revoked.
• Billing records: 7 years, to meet tax requirements.
• Push notification registrations: until you sign out or uninstall the app.

Your rights under GDPR

If you are in the EU, you have the right to:

• Access your personal data (Article 15)
• Correct inaccurate data (Article 16)
• Erase your data (Article 17) — use Delete account in Settings
• Restrict processing (Article 18)
• Data portability (Article 20)
• Object to processing (Article 21)
• Withdraw consent at any time (Article 7)

To exercise any of these, email privacy@scascan.com.

Right to lodge a complaint

You have the right to lodge a complaint with your local data protection authority.

EU Representative

We do not currently appoint an EU representative under Article 27 of the GDPR because our processing is occasional and does not include large-scale monitoring of EU data subjects. We will update this policy if this changes.