Privacy policy

The short version

• We collect what we need to run ScanSync: your account details, the events and attendee lists you upload, and check-in records.
• Attendee lists belong to you, our customer. We process them on your behalf and only to provide the service.
• We don't sell personal information, and we don't use advertising or tracking cookies.
• You can ask us to export or delete your data at any time.

Who we are

ScanSync ("we", "us") provides event check-in software at scansync.io and through our mobile app. This policy explains how we handle personal information when you use our website, web app, mobile app, and API (together, the "Service").

What we collect

Information you give us

• Account information: your name, email address, and password (stored only as a secure hash).
• Organization information: your organization's name, the staff you invite, and their roles.
• Event content: event details, attendee lists you import or create, custom fields, and check-in history.
• Messages: what you send us through the contact form or by email.

Information collected automatically

• Usage and device information: IP address, browser or device type, and the time of requests, kept in server logs for security and troubleshooting.
• Check-in records: when a ticket is scanned, by which staff member, and from which device.

Payment information

Payments are processed by Stripe. We receive your billing status and plan, but never your full card number.

Attendee data

When you upload attendee lists, you are the controller of that data and ScanSync acts as your processor. We use attendee data only to provide the Service to you: storing it, showing it to the staff you authorize, and recording check-ins. You are responsible for having a lawful basis to collect attendee information and to share it with us, and for any notices your attendees need.

If you're an attendee and want to access or delete your information, please contact the event organizer who holds your ticket. We'll help them respond to your request.

Staff with the scanner role see only what's needed at the door: names, ticket codes, check-in status, and the custom fields an organizer chooses to collect. Email addresses, phone numbers, and addresses are not sent to scanner devices.

How we use information

• To provide, maintain, and secure the Service.
• To process payments and manage subscriptions.
• To send service emails, like staff invitations, password resets, and important account notices.
• To respond to your messages and support requests.
• To understand and fix problems, and to prevent abuse or fraud.
• To comply with legal obligations.

We don't sell personal information or use it for advertising.

Who we share it with

We share personal information only with service providers who help us run ScanSync, under agreements that require them to protect it:

• Hosting and databases (Heroku / Salesforce) to run the application and store data.
• Payments (Stripe) to process subscriptions.
• Email delivery to send invitations, password resets, and replies.

If you connect your own systems using our API or webhooks, we send data to the endpoints you configure. We may also disclose information if required by law, or to protect the rights and safety of our users or the public. If ScanSync is involved in a merger or acquisition, information may be transferred as part of that transaction under this policy's protections.

Cookies

We use a small number of essential cookies to keep you signed in and to protect forms from forgery. We don't use advertising or third-party tracking cookies.

The mobile app

• Camera: used only to read ticket codes while you're on the scan screen. Images are not stored or uploaded.
• On-device storage: the app keeps a copy of the attendee lists for your events so scanning works offline. Your sign-in token is stored in the device's secure storage. Signing out deletes this data from the device.

How long we keep information

We keep account and event data while your account is active. Uploaded CSV files are deleted once the import finishes (or after 7 days if an upload is never confirmed), and only the resulting attendee records are kept. When you delete an event or attendee, it's removed from our active systems. Contact form messages are kept as long as needed to handle your request. If you close your account, we delete your data within a reasonable period, except where we need to keep it for legal, tax, or security reasons.

Security

All traffic uses HTTPS. Passwords are stored as salted hashes, and API keys and device tokens are stored as hashes, never in plain text. Access to data inside an organization is limited by role. No system is perfectly secure, but we work to protect your information and will notify affected customers of a breach as required by law.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To make a request, use our contact form and choose "Privacy & data requests". We'll verify your identity and respond within the time required by applicable law. You can also export your attendee lists as CSV from the dashboard at any time.

Children

The Service is meant for event organizers and their staff, and is not directed to children under 16. We don't knowingly collect personal information from children for our own purposes.

Changes to this policy

If we make material changes, we'll update the date above and, where appropriate, let account owners know by email before the changes take effect.

Contact

Questions or requests about privacy? Send them through our contact form.