Privacy policy

Who is responsible

ScanPay operates the service and is the controller of the data needed to run your account. A restaurant that uses ScanPay is the controller of the data about its own guests, staff and sales; ScanPay processes that data on its behalf and on its instructions.

For any question about this policy or your data, write to [email protected].

What we collect

Accounts: your name, email address, phone number when you sign in by WhatsApp, your language and a hashed password. We never see your password itself.

Restaurant operations: menus, orders, bills, payments, cash drawer movements, stock and the hours worked by staff. This is the restaurant's data, entered by its staff or by its guests.

Guests: what you order at a table, how you pay, and your phone number if you choose to receive a code or a receipt by WhatsApp. Card payments are handled by our payment providers; ScanPay never stores a card number.

Face punch (till app only, and only where the restaurant switches it on): when a staff member enrols their face, the tablet turns a few camera frames into a list of numbers (a face template). Only that template is sent to our servers, linked to the staff member's profile; no photo or video is saved or sent. Each punch attempt is logged with its time, the tablet and the match score, so a manager can check it.

Devices: an identifier for each tablet registered as a till or punch post, and crash reports and performance traces (device model, system version, app version, the error) used to fix bugs.

Device permissions

Camera: used only by the punch clock, to read the face of the staff member standing in front of the tablet. Frames are processed on the tablet and discarded.

Bluetooth and local network: used only to find and talk to the receipt and kitchen printers you pair. On Android 11 and older, the system requires the location permission for a Bluetooth scan; ScanPay never reads or stores your location.

Why we use it

To provide the service you or your restaurant signed up for: taking orders, printing tickets, collecting payments, keeping the cash and stock records, and recording working hours.

To secure it: signing you in, telling a real face from a photograph, and preventing fraud.

To keep it working: diagnosing crashes and slow screens. We do not use your data for advertising, and we do not sell it.

Biometric data and consent

A face template is biometric data. It is collected only after the staff member has read an explanation on the tablet and agreed to it, and after a manager has confirmed with their code. Staff who do not agree can be clocked in another way chosen by the restaurant.

A template is used for one purpose only: recognising that staff member at their own restaurant's punch posts. It is deleted when a manager removes it from the back office, when the staff member's profile is deleted, or on request.

Who we share it with

Only with the providers that run parts of the service for us, under contracts that limit them to that job: cloud hosting and storage, card and e-wallet payment processors (Stripe, Xendit), the WhatsApp Business platform (Meta) for sign-in codes and receipts, an email provider, Sentry for crash reports, and Google's ML Kit, which detects faces on the tablet and sends Google anonymous usage statistics.

We disclose data to the authorities only when the law requires it.

How long we keep it

Account data is kept while the account exists. Sales, payment and cash records are kept for as long as the restaurant's tax and accounting obligations require. Face templates are kept until they are deleted as described above. Crash reports are kept for 90 days.

Security

All traffic between the apps and our servers is encrypted (HTTPS). The till app keeps its offline copy in an encrypted database and its keys in the device's secure storage. Access inside a restaurant is limited by roles and, for sensitive actions, by a manager code.

Your rights and deleting your data

You can ask to access, correct or delete your data, or object to its use, by writing to [email protected]. A staff member can also ask their manager, who can delete their face template or their profile from the back office.

To delete your ScanPay account and the data linked to it, email [email protected] from the address of the account with the subject "Delete my account". We answer within 30 days. Records the restaurant must keep by law (such as issued receipts) are kept for that period, without your name where possible.

Children

The ScanPay till app is meant for restaurant staff and is not directed at children.

Changes

If this policy changes, the new version is published here with a new date. A significant change is announced in the app or by email.