Privacy policy

Who we are

ScanMosaic is operated by ScanMosaic, United Kingdom. Contact: [email protected].

What stays on your device

Static QR codes are made in your web browser. What you type into a free static code (links, WiFi names and passwords, contact details, messages) and any logo you upload are not sent to our servers.

Pro files

When you download a Pro file (SVG, 4096 px PNG or a batch ZIP), the content to encode and your design settings are sent to our server, which draws the file and keeps nothing. Your logo image is never uploaded: only its width and height are sent, and your browser adds the logo to the finished file.

Dynamic codes

For each dynamic code we store its name, destination link and design, linked to your account. When someone scans it we record the time, country (from the network, not GPS), device type, operating system and browser. We don't store IP addresses, set cookies or identify the person scanning. Scan records are kept for 13 months, then deleted. Deleting a code deletes its scan records straight away. Codes stay in your account after Pro ends so you can renew; ask us to delete your account at any time.

AI art

When you generate AI art, your description and the link to encode are sent to Replicate, Inc., which runs the image model and returns the image. We don't keep the image. To apply the free daily limit we keep a keyed one-way code made from your network address and the date, which changes every day and is deleted after 30 days.

Your account

You sign in with your email address: we email a one-time code or link, so there are no passwords. We store your email address, the workspaces you belong to and your role in each, and a one-way hash of each sign-in session. Sessions not used for 180 days end automatically, and you can sign out every device from Settings. If someone invites you to a workspace, we store the invitation and their email address until it is accepted or expires after 7 days. Workspace owners and admins can see the members of their workspace and an activity log of changes made in it.

Data we do process

• Payments. Stripe processes your payment and receives your email address and payment details. We receive the plan you bought, its status and Stripe's customer and checkout references. We never see your card number. See stripe.com/privacy.
• Providers. Stripe (payments), Cloudflare (hosting, database, analytics), Replicate (AI images) and Google (Web Risk, which checks dynamic code destinations against lists of unsafe sites) act as our processors.
• Abuse limits. To stop abuse we count requests per network, using a keyed one-way code made from the network address. These counts are deleted after 48 hours.
• Hosting and analytics. Cloudflare processes basic request data such as IP address and browser type to deliver and protect the site. We use Cloudflare Web Analytics, which counts visits without cookies and without tracking you across sites.
• Email. If you email us, we use your message to reply and keep it as long as needed for support and our records.

Cookies and local storage

We don't set advertising or tracking cookies. Your browser's local storage keeps your design settings and your sign-in session. These are needed for features you asked for.

Legal bases

We process payment and account data to perform our contract with you, and hosting, security, abuse-prevention and analytics data for our legitimate interest in running a safe, reliable site.

How long we keep data

Payment records: as long as tax and accounting law requires, usually 6 years. Scan records: 13 months. Abuse counters: 48 hours. AI limit codes: 30 days. Sign-in sessions: until you sign out, or after 180 days without use. Sign-in codes: 24 hours. Support emails: up to 2 years.

Your rights

You can ask to access, correct, delete or restrict the personal data we hold, object to processing, or request a copy. Email [email protected]. You can also complain to your data protection authority; in the UK that is the ICO (ico.org.uk).

International transfers

Stripe, Cloudflare, Replicate and Google may process data outside your country under safeguards such as the UK International Data Transfer Addendum and EU standard contractual clauses.

Changes

We'll update this page if our practices change and revise the date at the top.

Referral program

Each account has a referral code. When someone opens a referral link, their browser's local storage keeps the code (no cookies) for up to 60 days, and we add one to a visit counter for that code; we don't store anything about the visitor. If they create an account, we record who referred them. Referrers see their referrals' email addresses only partly (like j•••@example.com), the plan bought and the commission. To pay commissions we store the referrer's PayPal email address. Commission and payout records are kept as long as accounting law requires.

Contact form

When you use the contact form we store your name (if given), email address, topic and message, and email them to our support team, to answer you. Messages are kept for up to 2 years. To stop spam we count messages per network and per email address for 48 hours.

Downloading and deleting your data

Signed-in users can download a copy of their data, or delete their account, at any time from Privacy & data in the dashboard. Deleting an account removes the account, its sessions and every workspace you alone own, with its codes, scan records and files. Payment records are kept for tax reasons but are no longer linked to you.

Hosted pages and files

When you make a hosted page (such as a PDF, menu, gallery, contact card or form), we store its content and any files you upload (PDFs, pictures, audio and video) with your workspace. Files are stored with Cloudflare R2, run by Cloudflare, Inc. as our processor. Before a photo is uploaded, your browser re-saves it, which removes location and camera data. Hosted pages and files are public: anyone with the code or link can open them, so don't upload anything you want to keep private.

Files stay while the page that uses them exists. When you replace or remove a file and save the page, or delete the code, the file is deleted straight away. Files uploaded but never saved to a page are deleted after 24 hours. Copies kept by visitors' browsers may remain for up to a day.

Form and feedback answers

When someone answers a hosted form or feedback page, we store their answers, the time and the country (from the network, not GPS), and show them to the workspace that owns the page. We don't store the IP address and don't set cookies; to stop spam we count submissions per network with a keyed one-way code that is deleted after 48 hours. If the owner switched on notifications, the answers are also emailed to them through our email provider, Resend, as our processor.

For these answers, the page owner decides what to ask and what happens to the answers; we process them on the owner's behalf. Answers are kept until the owner deletes them or the code, or the account is closed. If you answered a form and want your answers changed or deleted, contact the business that made it; if you can't reach them, email us and we'll help.

Visitors to hosted pages

Opening a hosted page counts as a scan, recorded the same way as for other dynamic codes (see above). Hosted pages set no cookies and load nothing from other sites, except a YouTube or Vimeo video the owner added, which loads from that service (YouTube's privacy-enhanced mode) when the page is opened.

Abuse reports

When you report abuse we store your email address, your name if you give it, the address you reported, the reason and your message, and email them to our trust and safety team. We use them to investigate and to reply to you, and keep them for up to 2 years. We don't tell the owner of the reported code who reported it, unless the law requires it.

Google Analytics integration

If a workspace connects Google Analytics 4, we send each scan or click of its codes and links to that workspace's own GA4 property: the code's name, ID and campaign, the country, device type, operating system, browser, language, routing rule and the daily-changing visitor key. We never send IP addresses or cookies. The workspace decides this and is responsible for it under its agreement with Google.