Privacy policy

This policy explains what data Scan2Review ("we", "us") collects when you use scan2review.in, our mobile apps, and the QR-code review pages we generate for businesses, and how that data is used, stored, and protected.

Information we collect

From business owners

• Account details: name, email address, and hashed password.
• Business details you provide: business name, address, phone, website, Google review link, business type, city, services, and keywords used to generate review suggestions.
• Billing information processed by our payment providers (Stripe or Razorpay) — we do not store full card numbers ourselves.

From customers scanning a QR code

• Anonymous interaction events: scan, copy, edit, redirect, or skip, along with a timestamp, IP address, and user agent, used to power the business owner's analytics dashboard.
• We do not require customers to create an account or provide personal information to leave a review.

How we use information

• To operate the core product: generating QR codes, review suggestions, and analytics.
• To authenticate accounts and keep them secure (see Security below).
• To process subscription payments and send billing-related emails.
• To respond to support requests submitted through our contact form.
• To send transactional email such as password reset links — we do not send marketing email without consent.

How we share information

We do not sell personal data. We share data only with the service providers required to run the product: our database and hosting provider, our email delivery provider (used to send transactional email such as password resets), and our payment processors (Stripe and Razorpay) for billing. Each of these providers is only given the data necessary to perform their function.

Your rights and data controls

Business owners can export a copy of their account and business data, or request full deletion, at any time from Profile → Privacy & data in the mobile app or the equivalent section of the web dashboard. Deletion requests remove your account, business profile, QR codes, and associated analytics; some records may be retained briefly where required for fraud prevention or legal compliance.

If you are located in the EEA, UK, or another jurisdiction with data protection laws, you have the right to access, correct, export, or delete your personal data, and to object to certain processing. Contact us at our contact page for any request not covered by the in-app tools above.

Data retention

Account and business data is retained for as long as your account is active. Password reset tokens expire after one hour and are single-use. Analytics events are retained for the life of the account to power historical reporting, and are deleted along with the account on request.

Security

Passwords are hashed with bcrypt and never stored in plain text. Authentication uses signed JSON Web Tokens with short-lived access tokens and separate refresh tokens. See our security page for more detail.

Cookies

We use essential cookies/local storage to keep you signed in and to remember basic preferences. We do not use third-party advertising trackers on scan2review.in.

Changes to this policy

We'll update the date at the top of this page whenever this policy changes materially, and will notify active business owners by email for significant changes.

Contact

Questions about this policy or your data can be sent through our contact page.

This page is a general template and is not a substitute for legal advice specific to your jurisdiction or business.