Privacy Policy

Last updated October 28, 2026

Scanly gives restaurants a digital menu, QR codes, loyalty cards, reviews and table ordering. This policy explains what we collect from restaurants (our customers) and from guests who open a restaurant's menu, and what we do with it. We keep it short because we collect little.

Guests

You don't need an account to read a menu, order, collect stamps or leave a review. We store only what you give:

• Orders and table calls: table number, dishes, your note and the language you read the menu in, so the restaurant can serve you.
• Loyalty card: a random card code and your stamps, points or spend at that restaurant. No name, email or phone. If you add it to Apple Wallet or Google Wallet, your device registers for card updates.
• Reviews: your rating and comment, and an email or phone only if you choose to leave one for a reply. Public reviews you post on Google or Tripadvisor are governed by those services.
• Technical data: your IP address is used for a few minutes to stop abuse (rate limiting), then discarded. Your cart and loyalty card are remembered in your browser's storage and cookies.

The restaurant decides why this data is collected and sees it in its dashboard; Scanly processes it on the restaurant's behalf. We don't show guests ads, sell data or track you across sites.

Restaurants

• Account: your name, email and a hashed password; team members you invite (name and email).
• Content: menus, prices, photos, logos, translations, settings, and menu files you upload for import.
• Billing (Pro): handled by our payment provider; we don't store card numbers.
• Usage: menu views and orders, aggregated in your analytics.

Service providers

We use a small set of providers to run Scanly, each only for its task:

• Hosting and database: Vercel and our own database server.
• Images: Cloudflare R2.
• AI menu reading and translation: Google Gemini (menu files and menu text only, never guest data).
• Email: Twilio SendGrid (invitations, password resets, notifications).
• Wallet passes: Apple Wallet and Google Wallet.
• Payments, when enabled: Polar (subscriptions) and Stripe (guest payments).

How long we keep data

Restaurant data is kept while the account exists and deleted within 30 days after the account is closed. Orders and table calls are kept for the restaurant's records and analytics; reviews and loyalty cards until the restaurant deletes them or closes its account. Rate-limit records expire within an hour.

Your rights

You can ask to see, correct, export or delete your data, or object to how it is used. Guests: the quickest route is the restaurant itself, but you can also write to us. Write to privacy@scanly.app and we answer within 30 days. If you are in the EU or UK you can also complain to your data protection authority.

Cookies

We use only cookies needed for the service: the sign-in session, your theme and last opened restaurant in the dashboard, and the loyalty card and cart on menus. No advertising or third-party analytics cookies.

Changes

If we change this policy in a meaningful way we update the date above and tell restaurant owners by email before it takes effect.