Privacy policy

1. Who we are

Scanlexa (“we”, “us”) operates this website and the short-link service used by dynamic QR codes. We are the data controller for the personal data described here. You can contact us about privacy at support@scanlexa.com.

2. What we collect

• Account details: your email address and, if you sign in with Google, your name and profile picture. Authentication is handled by Supabase; we never see your Google password.
• Saved codes: when you save a code, we store its name, its content (for example a link, Wi-Fi name and password, or contact details you typed), its design, folders and tags. Until you save, none of this leaves your device.
• Logos: a logo you add stays on your device until you save the code to your account. Then we store it privately so you can edit and re-download the code.
• Dynamic code settings: the destination link, schedule, scan limit and, if you set one, a password (stored only as a one-way hash).
• Scan analytics (dynamic codes): when someone scans a dynamic code we record the approximate country and city, device type and operating system, the time, and the referrer. We use the IP address only to work out the approximate location and then discard it. We never store full IP addresses.
• Purchases: payments are processed by Flutterwave. We receive the transaction reference, amount, currency and status. We never receive or store your full card details.
• Hosted pages and files: if you create a menu, PDF, photo gallery, social links, app or bank details page, we store its content and files privately and show them to anyone who scans the code while it’s active. Don’t put private information on a hosted page unless you protect the code with a password (Lifetime).
• File tools: most tools run entirely in your browser and never upload your files. Word to PDF and Compress PDF send the file to our conversion service over HTTPS; it’s deleted as soon as the result is sent back and is never stored or looked at.
• Abuse reports: if you report a code, we keep what you tell us, your email address if you give one, and a one-way hash of your IP address (to stop report spam). We use this only to review the report.
• Technical data: limited server logs and error reports (for security and fixing bugs), and essential cookies that keep you signed in. We don’t use advertising or cross-site tracking cookies.

3. Why we use it (legal bases)

• To provide the service you asked for (contract): your account, saved codes, short links, downloads and analytics.
• To keep the service safe (legitimate interests): preventing abuse, fraud and phishing. Every dynamic-code destination is checked against malware and phishing blocklists before it’s saved. The link’s domain name is looked up with Cloudflare’s and AdGuard’s security DNS services, and, where enabled, the full link is sent to Google Web Risk.
• To meet legal obligations: for example keeping payment records for tax purposes.
• With your consent, where required, for example any future marketing emails. You can withdraw consent at any time.

4. Who processes data for us

We use trusted providers that process data on our behalf, under contracts that require them to protect it:

• Supabase: database, sign-in and file storage
• Vercel: website hosting
• Cloudflare: the short-link service that redirects dynamic codes, security DNS link checks, and cookieless visit statistics (Web Analytics)
• AdGuard: security DNS link checks (the link’s domain name only)
• Upstash: counting scans before they’re added to your analytics
• Google: sign-in with Google, and Web Risk link checks where enabled
• Flutterwave: payments
• Resend: account and receipt emails
• Sentry: error monitoring

Some of these providers process data outside Nigeria and the EU/UK. Where that happens we rely on appropriate safeguards, such as standard contractual clauses and adequacy decisions, as required by the NDPA and GDPR.

5. How long we keep it

• Account details and saved codes: for as long as your account exists.
• Deleted codes: removed straight away, including their short link and any logo no other code uses.
• Scan analytics: stored as daily totals, never as a log of individual people.
• Payment records: for as long as tax and accounting law requires (typically six years).
• Server logs and error reports: kept for a short period, normally no more than 30 days.
• Files uploaded for a hosted page but never saved to a code: deleted automatically after 24 hours.
• Abuse reports: kept for up to 2 years after they’re resolved, to spot repeat abuse.

6. Your rights

Under the Nigeria Data Protection Act 2023 and, where it applies, the EU or UK GDPR, you have the right to access your data, correct it, delete it, restrict or object to how we use it, receive a copy in a portable format, and withdraw consent. You can also complain to the Nigeria Data Protection Commission (NDPC), or to your local supervisory authority in the EU or UK (in the UK, the Information Commissioner’s Office).

7. Deleting your data

You can delete any saved code yourself, at any time, from My codes. To delete your whole account, contact us at support@scanlexa.com. We’ll confirm it’s you and complete the request within 30 days. We delete your account, codes, logos and analytics. We keep only what the law requires us to keep, such as payment records.

8. Lifetime accounts and fair use

Lifetime accounts are subject to fair-use limits (500 active dynamic codes, 100,000 scans a month and 500 MB of file storage). We process scan counts and file sizes to apply these limits, as described in our terms.

9. Cookies and similar storage

We use only essential cookies, to keep you signed in and to protect sign-in. We also store a few preferences on your device (such as the currency you chose and your light or dark theme) and, if you install Scanlexa as an app, cached copies of public pages so the generator works offline. We don’t use advertising, analytics or tracking cookies, so we don’t show a cookie banner. If that ever changes, we’ll ask for your consent first.

10. Rate limiting and security logs

To prevent abuse (for example password guessing on protected codes, or automated sign-ups), we count requests using a salted, one-way hash of your IP address that can’t be reversed to the address. These counters expire automatically within hours.

11. Children

Scanlexa isn’t intended for children under 13, and we don’t knowingly collect their data.

12. Security, breaches and changes

We protect data with encryption in transit, access controls and row-level security in our database. Passwords for protected codes are stored only as salted one-way hashes. If a personal data breach is likely to put your rights at risk, we’ll notify the Nigeria Data Protection Commission within 72 hours, as the NDPA requires (and the relevant authority under the GDPR where it applies), and tell affected users without undue delay.

If we change this policy in a meaningful way, we’ll update the date above and, where appropriate, let you know by email.