Privacy Policy

Who we are

Scansational (scansational.com) is a platform for turning physical objects and places into interactive digital experiences with QR codes. It is a product by Xorvia, which is based in Australia and serves customers internationally. This policy explains what we collect, why, and the choices you have. Because the operator is Australian, we handle personal information in accordance with the Australian Privacy Principles, and we also aim to respect the privacy rights available to you under the laws where you live.

What we collect

Account data: your email address, display name and sign-in provider, managed through Firebase Authentication. If you choose to sign in with Google (or another sign-in provider we offer), that provider shares only your name, email address and an account identifier with us — never your contacts, posts, emails, calendar or files — and signing in this way doesn't sign you up to marketing emails. Product data: the dynamic QR codes you create — their names, destinations, designs, hosted page content and uploaded files. Billing data: payments are processed by Stripe; we never see or store your full card or bank details. Scan analytics: when someone scans a dynamic QR we record the country, region, device type, browser and operating system of the scan. We do not permanently store scanners' IP addresses — unique-visitor counts use a rotating, privacy-preserving hash that cannot be reversed to an IP. Acquisition data: when you create an account we record a small amount of first-visit information — the referring site's domain (e.g. google.com), campaign parameters if you followed a marketing link, and the page you landed on — so we can tell which channels bring genuine customers. We do not store full referrer URLs, browsing history, or any device fingerprinting data. Public form submissions: some Scansational-powered pages (equipment fault reports, feedback and issue-reporting forms, visitor and site sign-in) let someone without a Scansational account submit information by scanning a QR code — their message or form answers, an optional name or contact detail if they choose to provide one, and an optional photo. This information is visible only to the Scansational account that created the form, never published publicly, and the person submitting it is never required to identify themselves unless the form owner has chosen to require it. Business records: if you use Clients & CRM, Jobs & Scheduling or Sites & Compliance, we store the records you and your team enter — for example customer and contact details, locations, notes, jobs, checklists, inspection results, compliance documents and the photos and files you attach. These are your records: they are visible only to people you give access to in your workspace, photos and documents are never publicly accessible, and we use them only to provide the service to you (including the reminder emails you and your team receive).

What we deliberately don't collect

Static QR codes (including Wi-Fi passwords and vCard contact details) are generated in your browser. Their contents are never transmitted to or stored on our servers.

How we use information

To operate the service (redirects, dashboards, analytics), process payments, prevent abuse (destinations are checked against Google Web Risk), and communicate service messages. We also measure, in aggregate, which features are used so we can improve them — for this we record that an action happened (for example, a first job created) against your workspace's internal identifier, never the content of your records, and we set no tracking cookies for it. We do not sell personal information.

Where your data is stored

Accounts, dynamic QR codes, analytics and uploaded files are stored on Google Cloud (Firebase) in the United States. Because we serve customers worldwide, your information may be processed in countries other than your own, including the United States and Australia, by us and the providers listed below. We use providers that protect data with industry-standard security and contractual safeguards for international transfers.

Email communications

We send operational emails about your account — sign-up verification, password resets, billing receipts and plan changes, and service notices for features you use (for example, an equipment fault report or feedback submission, if you've enabled that notification). These are not optional and are not marketing.

New accounts also receive a small number of onboarding emails about the product you already have: a welcome, a note when your first dynamic QR goes live, scan milestones, and a reminder if you haven't activated your free dynamic QR. They never pitch a paid plan, and each one has a one-click “Unsubscribe from onboarding emails” link that doesn't require logging in.

Promotional emails (offers and plan suggestions) are sent only if you opt in — this is off by default. You can turn it on or off anytime in Settings → Email preferences, and every such email includes a one-click unsubscribe link. Unsubscribing never affects the operational emails above.

Outbound email may be sent on our behalf by a third-party delivery provider (currently Resend). That provider sees the email content and recipient address needed to deliver the message; it does not have access to your Scansational account or QR data otherwise.

Third parties we rely on

Google Cloud and Firebase (hosting via App Hosting, Authentication, the Firestore database and Cloud Storage for uploaded files), Stripe (payments), Google Web Risk (destination safety checks), an email delivery provider (see above), Google Analytics for aggregate site statistics (only after you accept analytics cookies) and, if enabled, Google Ads conversion measurement, which uses Google cookies and the ad-click identifier Google adds to ad links to tell us whether an ad led to a sign-up or purchase. The conversion details we send Google are limited to the conversion type, an approximate value and a one-way hashed order reference — never your QR content, email or payment details.

If enabled, we also use the Meta (Facebook/Instagram) Pixel for advertising measurement. It sets a Meta cookie and shares your browser's IP address and standard technical details with Meta, plus the same limited conversion signals as above (page views, sign-up, checkout start and purchase — never your QR content, email or payment details). If we ever enable Meta's Conversions API (a server-side counterpart to the Pixel), any email address it receives is one-way hashed before it leaves our servers and is never sent in readable form.

Cookies

We use cookies and similar storage that are needed to sign you in and keep the site secure. Analytics and advertising cookies load only after you choose “Allow analytics” in the cookie banner; if you decline, they are not set. You can change your choice anytime with “Cookie settings” in the site footer.

Retention & deletion

Analytics are retained according to your plan (30 days on Free). You can delete individual QR codes, files, or your whole account from Settings. After account deletion we retain only what we must: financial records required by law and QR short-link tombstones (so a deleted code's link can never be taken over by someone else).

Your rights

Wherever you live, you can ask us to access, correct, export or delete your personal information, or object to how we use it, by emailing support@scansational.com. If you are in the European Economic Area or the United Kingdom, we rely on these lawful bases: performing our contract with you (running your account and codes), legitimate interests (security, abuse prevention and improving the service), consent (analytics cookies and promotional email, which you can withdraw anytime) and legal obligations (financial records). You also have the right to complain to your local data protection authority. If you are a California resident: we do not sell or share your personal information as those terms are defined under California law.

Children

Scansational is not intended for children under 16, and we do not knowingly collect their personal information. If you believe a child has given us personal information, contact us and we will delete it.

Contact

Privacy questions or requests: support@scansational.com. For how Scansational is actually built to protect your account and data, see Security & Privacy Practices.