Privacy notice
Last updated 29 October 2026
1. Who is responsible
The controller for personal data processed through scanefy.com is:
XBORDER TRADE (OPC) PRIVATE LIMITEDPlot No. 73–74, Sector-IIDC SIDCUL, Sector-III BHEL
Haridwar, Uttarakhand 249403
India
- Represented by
- Satish Krishnan (Director)
- satish.krishnan@gmail.com
- Telephone
- +49 15210686415
Contact in Germany
Satish KrishnanStartRaum
Rheinisch-Bergisches TechnologieZentrum GmbH
Building 7
Friedrich-Ebert-Straße 75
51429 Bergisch Gladbach
Germany
- Telephone
- +49 15210686415
- satish.krishnan@gmail.com
For privacy questions and data requests, write to satish.krishnan@gmail.com or use the contact form and choose "Privacy or data request". No data protection officer has been appointed.
2. What we process and why
| Data | Purpose | Legal basis (GDPR) | Kept for |
|---|---|---|---|
| Account data: name, email address, whether the email address is confirmed, password hash, language | Providing your account | Art. 6(1)(b) contract | Until you delete the account |
| Content you create: codes, profiles, vehicles, items, pets, uploaded images, NFC tag records | Providing the service | Art. 6(1)(b) | Until you delete it or your account |
| Sessions: session token, browser user agent, IP address at sign-in | Keeping you signed in, account security | Art. 6(1)(b), 6(1)(f) | Until the session expires (max. 30 days) |
| Sign-up and sign-in protection: keyed hash of the IP address, held only in the server's memory | Preventing automated sign-ups, password guessing and spam | Art. 6(1)(f) | At most 24 hours; cleared on every restart |
| Messages through contact codes: text and chosen category; optionally the visitor's name, a reply email, and callback phone number or email that the visitor explicitly chose to share with the owner | Relaying messages between visitor and owner | Art. 6(1)(b) for owners; Art. 6(1)(a) consent for shared callback details; 6(1)(f) otherwise | Until the owner deletes the conversation or account |
| Alert destinations: an alternative alert email address or a mobile number, verified with a one-time code and stored encrypted | Telling owners about new messages | Art. 6(1)(b) | Until you remove them or delete the account |
| Email delivery records: recipient, type of email, delivery status. One-time codes, confirmation links and password-reset links are never stored | Delivering emails, handling failures | Art. 6(1)(b), 6(1)(f) | 30 days |
| Pseudonymous security data: keyed hash of the IP address on contact messages | Rate limiting, abuse prevention, sender blocking | Art. 6(1)(f) | 90 days |
| Visit statistics for dynamic codes: time, device type, operating system, browser family, scan or tap, a daily-rotating hash | Showing owners how their codes are used | Art. 6(1)(f) | Raw events 13 months, daily totals while the code exists |
| Abuse reports and contact form messages | Handling reports and enquiries | Art. 6(1)(f) | As long as needed to resolve them |
| Security log (sign-ins, changes to codes, with a keyed IP hash) | Detecting misuse, accountability | Art. 6(1)(f) | 12 months |
Your account works straight after sign-up. An email address only counts as confirmed once you open the link in our confirmation email; until then we send no message alerts to it.
3. People who scan Scanefy codes
You do not need an account to scan a code. When you open a dynamic code, we record a visit as described above. We do not store your IP address for statistics; the unique-visitor hash uses a random value that exists only for one day and is never stored, so visits cannot be linked across days. Static codes do not contact our servers at all.
If you send a message through a vehicle, item, pet or profile code, the owner sees your message (phone numbers and email addresses you type into the message are hidden automatically) and the optional name you entered. You can stay anonymous: the owner sees a callback phone number or email address only if you enter it and tick "Share my callback details with the owner". An optional reply email address that you do not share is never shown to the owner; we use it only to tell you that a reply exists. The owner's email address and phone number are never shown to you.
4. Cookies and similar technology
We use only cookies that are necessary for the service: a session cookie when you sign in, and preference cookies for theme and language. Your browser's local storage keeps the install-prompt choice, drafts (without Wi-Fi passwords) and view preferences on your device. We use no advertising or tracking cookies and no third-party analytics. See the cookie notice.
5. Recipients and processors
- Hosting: Hostinger International Ltd. (Cyprus) provides the virtual private server that runs Scanefy and its database. According to its IP registration, the server is in a data centre in the United Kingdom, which is covered by an EU adequacy decision. Processing is governed by Hostinger's Data Processing Agreement, which forms part of Hostinger's terms of service (Art. 28 GDPR).
- Email: Newfold Digital, Inc. (Bluehost, USA) hosts the scanefy.com mailboxes and the mail server that sends confirmation emails, password-reset links, message alerts and contact-form notices. The mail server is in the USA. Processing is governed by Newfold's Data Processing Addendum, which forms part of Newfold's terms of service and incorporates the EU Standard Contractual Clauses for transfers outside the EU (Art. 28, 46 GDPR).
- Link safety checks (optional): if we enable automatic checks of destinations, only the destination URL of new dynamic codes is sent to Google Safe Browsing (Google Ireland Ltd.).
The controller is a company registered in India. We do not sell personal data and do not share it for advertising.
6. Your rights
You have the right to access, rectification, erasure, restriction, data portability and objection (Art. 15 to 21 GDPR). You can withdraw consent at any time with effect for the future. Account holders can export all their data and delete their account directly in Account settings. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live.
7. Security
Connections are encrypted (HTTPS). Passwords are stored only as salted hashes. Uploaded images are re-encoded to remove hidden data such as GPS location. The database is not reachable from the internet. Daily database backups are kept for 14 days on the same server, readable only by the operator account. One-time codes are stored only as keyed hashes and expire after 10 minutes; confirmation links are signed and expire after 24 hours.
8. Changes
We will update this notice when the service changes and show the date at the top. A German version with the same content is available.