Privacy Policy

Last updated: July 10, 2026

This Privacy Policy explains how Atlodin LLC ("we", "us", or "our") collects, uses, and protects personal data when you use Scanlayer (the "Service"), including our website, dashboard, guest pages, and APIs.

1. Who we are

Scanlayer is a smart QR and NFC placement analytics platform operated by Atlodin LLC.

• Controller (GDPR Art. 4(7)): Atlodin LLC
• Address: 30 N Gould St, Ste N, Sheridan, WY 82801, United States
• Product website: https://scanlayer.io
• Company website: https://atlodin.com/
• Privacy contact: [email protected]

2. Data we collect

Depending on how you use the Service, we may collect:

• Account data: name, email address, password (stored hashed), profile details, and authentication identifiers when you sign in with email or OAuth providers (such as Google or X).
• Workspace and team data: workspace name, business profile (name, phone, fax, email, logo), team member roles, invitation records, and agency pool allocations when you use an Agency plan.
• Smart link and placement data: link names, destinations, routing rules, placement labels, NFC/QR configuration, and downloadable asset metadata.
• Template and content data: menus, monthly menus, events, appointments, contact cards, lost-and-found tags, feedback pools, product catalogs, Google Review settings, and other template-specific content you publish.
• Billing data: subscription plan, workspace and template entitlements, billing address (street, city, state or region, postal code, country), billing country, billing currency, Stripe customer and subscription identifiers, invoice references, promotion redemptions, and payment status. Card details are processed by Stripe; we do not store full card numbers.
• Usage and analytics data: scan and tap events, timestamps, placement identifiers, device type, browser user agent, referrer, approximate location derived from IP (when available), and rule outcomes for smart routing.
• Guest interaction data: form submissions (contact, appointment booking, lost-item reports, menu subscriptions, event photo uploads), when visitors use your published pages.
• Support and communications: messages you send to us and records of support requests.
• Technical data: IP address, cookies, session identifiers, and server logs needed to operate and secure the Service.

3. How we use your data

• Provide, operate, and improve the Service, including workspace plans, template modules, smart routing, and analytics.
• Process subscriptions and payments through Stripe, including workspace plans (Free, Starter, Pro, Business, Agency), template subscriptions, bundles, extra link slots, and limited-time free promotional offers.
• Track promotional redemptions (for example, one free bundle per account), subscription periods, and entitlement expiry where applicable.
• Display prices in USD, EUR, or TRY based on billing country, billing currency settings, or locale where applicable.
• Authenticate users, manage team access, and enforce plan limits and entitlements.
• Send transactional emails (account, billing, team invitations, notifications) and optional product communications where permitted.
• Monitor performance, prevent abuse, and maintain security.
• Comply with legal obligations and respond to lawful requests.

4. Legal bases (where applicable)

If you are in a jurisdiction that requires a legal basis (such as the EU/UK), we rely on: contract performance (providing the Service); legitimate interests (security, analytics, product improvement); consent (where required for cookies or marketing); and legal obligation.

5. Sharing and subprocessors

We do not sell your personal data. We share data with trusted providers who process it on our behalf, including:

• Stripe — payment processing, subscription management, and customer billing portal
• Hetzner Online GmbH (Germany) — application hosting, databases, and background job processing
• Hetzner Online GmbH (object storage, Nuremberg) — media uploads, QR assets, event photos, and workspace logos
• Amazon Web Services (Amazon SES, Frankfurt) — transactional and notification email
• Google — OAuth sign-in, Google Places data when you use the Google Reviews template, and Google Tag Manager when you allow analytics cookies or configure tags on smart links
• X Corp. — when you choose to sign in with X
• Meta — conversion measurement on marketing pages, and only after you allow analytics cookies
• ERPNext — optional accounting mirror of paid Stripe subscription invoices when this integration is enabled

We may also share data when required by law, to protect rights and safety, or in connection with a merger, acquisition, or asset sale, with appropriate safeguards.

6. International transfers

The Service runs on servers in Germany: application and database hosting at Hetzner, uploaded files in Hetzner object storage (Nuremberg), and transactional email through Amazon SES in Frankfurt (eu-central-1).

Some recipients are in the United States, and personal data reaches them there: Stripe (payments), Google (sign-in, Places data, and Tag Manager where you allow analytics cookies), Meta (conversion measurement, only after you allow analytics cookies), and Atlodin LLC itself as the controller. These transfers rely on the EU Commission's adequacy decision for the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the Standard Contractual Clauses. You can request a copy of the safeguards for a specific transfer at the privacy contact below.

7. Retention

Account data is kept while your account is active and deleted when you close it, except where we must keep it longer — invoices, for example, which tax law requires us to retain.

Tracking data has fixed windows, enforced automatically every night:

• Scan and tap events: 395 days, then deleted.
• Visitor sessions: 180 days, then deleted.
• Activity log entries, which carry IP address and user agent: 365 days, then deleted.

Guest data on a host's page — photos, form submissions, lost-item reports — is kept for as long as that host keeps the page, and is deleted when they delete it or their event hosting period ends. You may request deletion at any time; see your rights below.

8. Your rights

If the GDPR applies to you, you have the right to access your personal data, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable, machine-readable format. Where processing rests on your consent, you may withdraw that consent at any time; doing so does not affect the lawfulness of what was processed before. You may object to direct marketing at any time, without giving a reason.

You may also lodge a complaint with a supervisory authority — in Germany, the authority for the federal state where you live or work.

To exercise your rights, contact us at [email protected]. Where we have reasonable doubt about who is asking, we may ask for information to confirm your identity (GDPR Art. 12(6)).

9. Guest data on hosted pages

When a host publishes an event page, a menu, a lost-and-found tag or a booking page, that host decides what to collect and why. For data their visitors submit there, the host is the controller and Scanlayer acts as a processor on their instructions (GDPR Art. 28). We process it to run the page, and not for our own purposes.

If you are a visitor and want your data on such a page corrected or deleted, the host can do it directly; you may also write to us at the address below and we will pass the request on and help carry it out. Business customers who need a data processing agreement can request one at the same address.

10. Cookies and similar technologies

We use cookies, local storage, and session storage for authentication, security, preferences, checkout, and—only with your consent—analytics. See our Cookie Policy to manage preferences.

11. Children

The Service is not directed to children under 16, and we do not knowingly collect personal data from children.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised version on this page and update the "Last updated" date. Material changes may be communicated through the Service or by email where appropriate.

13. Contact

For privacy questions or requests, contact [email protected] or Atlodin LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, United States.