Privacy policy
Last updated: 2 November 2026
The short version. Guests who scan a Scanly QR code stay anonymous: no account, no name, no e-mail, no tracking cookies. Restaurant owners give us an e-mail address and their business details so we can run their account. We do not sell data, we do not show ads, and we only use the services listed below to run Scanly.
Questions or requests: [email protected].
1. Who we are
Scanly is run by CG Labs L.P. (Ε.Ε. under Greek law), Athens, Greece (“we”, “us”). For anything in this policy, including access, correction or deletion requests, write to [email protected]. We usually reply within two business days and always within one month.
2. Our two roles
- Controller for the data of restaurant owners and their team members who use the console, for visitors of scanly.gr, and for billing.
- Processor for the restaurant (“the venue”) when its guests and staff use Scanly at the venue: the orders, notes, ratings and staff details belong to the venue, and we handle them only on its instructions, as set out in our data processing terms. If you are a guest and want to exercise your rights, you can contact the venue or us; we will pass your request on.
3. What we collect
Restaurant owners and console users
- E-mail address, name (optional), business name, country and preferred language.
- A password, stored only as a salted one-way hash (or none, if you sign in with e-mailed links).
- Sign-in records needed to keep the account safe (time of sign-in, failed attempts).
- Everything you put into the console: venues, menus, photos, prices, tables, opening hours, review links, settings.
- Billing: your plan, subscription status and invoices. Card details are entered on Stripe’s pages and never reach our servers.
Staff at the venue
- The name or nickname the owner enters, the role (waiter, kitchen, cashier) and a PIN, stored only as a salted one-way hash.
- Which paired device (by the name the owner gave it) did what, for example who confirmed an order.
Guests
- No account, name, e-mail or phone number.
- A random token for the phone at that table, kept in the browser, so the table’s order and your own cart stay together. It ends when the table is closed.
- What you order, any note you type for the kitchen, the language you read the menu in, a star rating and an optional private message to the venue. Please do not type personal details into notes or messages.
- When you tap a Google or Tripadvisor review button, we count the tap. We never see whether you wrote a review.
- If the venue offers payment in the app, the payment is made with the venue’s own Stripe account. Stripe handles your card; we only learn that a payment succeeded and its amount.
Visitors of scanly.gr and everyone using the service
- Server logs: IP address, time, the address requested, browser type and the response. Used only for security and to fix faults, and overwritten within days.
- Bot protection: on the sign-up and sign-in forms, Cloudflare Turnstile checks that a person, not a script, is filling them in. It looks at signals from your browser and IP address and sets no tracking cookies.
- Visitor statistics: Cloudflare Web Analytics counts page views and load times without cookies and without building a profile of you.
- Language choice: if you tap “EN / ΕΛ”, we store a
langcookie with your choice for one year, so we show you the page in the language you picked. It contains nothing that identifies you.
4. Why we use it (legal bases)
| Purpose | Legal basis (GDPR) |
|---|---|
| Running your account and the service you signed up for, sending sign-in links and service e-mails | Contract, Art. 6(1)(b) |
| Billing, invoices and keeping accounting records | Contract and legal obligation, Art. 6(1)(b) and (c) |
| Security: rate limits, bot protection, logs, preventing fraud and abuse | Legitimate interest in keeping Scanly safe, Art. 6(1)(f) |
| Aggregated, cookie-free visitor statistics to improve the site | Legitimate interest, Art. 6(1)(f) |
| Guest and staff data at a venue | Processed for the venue, on its instructions (Art. 28) |
We do not send marketing e-mails unless you ask for them, and we make no automated decisions with legal or similar effects about anyone.
5. Cookies and browser storage
Scanly uses only what is strictly necessary for the service to work, so there is no cookie banner:
- Console: a session cookie that keeps you signed in and a security cookie that protects forms against cross-site attacks.
- Guest app and staff app: browser storage for your cart, the language you chose, the table token and, on staff tablets, the device pairing.
- Website: the
langlanguage-choice cookie described above.
No advertising or cross-site tracking cookies, and no third-party trackers.
6. Who we share it with
We run Scanly on our own servers in Greece. We use these service providers (sub-processors), each bound by a data processing agreement:
| Provider | What for | Where |
|---|---|---|
| Cloudflare, Inc. | Network delivery and protection of scanly.gr, bot protection (Turnstile), cookie-free statistics | Global network; EU–US Data Privacy Framework and Standard Contractual Clauses |
| Stripe Payments Europe, Ltd. | Subscription billing; guest payments where the venue enables them (on the venue’s own Stripe account) | EU (Ireland), with transfers covered by Stripe’s safeguards |
| Anthropic, PBC | Optional AI features: reading menus from photos and documents, translating menus, suggesting pairings and allergen hints. Only menu content and the files owners upload are sent, never guest data. Anthropic does not use this data to train its models. | USA; Standard Contractual Clauses |
| Papaki Ltd | Sending service e-mails from [email protected] | EU |
Where an AI provider is unavailable, Scanly can use a model running on our own servers instead, in which case nothing leaves them. We may also disclose data where the law requires it, for example to a court or tax authority.
7. How long we keep it
- Account and venue data: while the account is open. When you ask us to close it, we delete it within 30 days, and our backup copies roll over within a further 60 days.
- Invoices and billing records: as long as Greek tax law requires (normally five years after the end of the year they belong to).
- Orders, ratings and messages at a venue: kept for the venue while its account is open, and deleted with it.
- Guest table tokens: end when the table is closed.
- Server logs: overwritten within days.
- Uploaded files for menu import: deleted after the import is finished or abandoned.
- Language-choice cookie: one year.
8. Your rights
You can ask for a copy of your data, have it corrected or deleted, restrict or object to its use, and take it with you (portability). Owners can ask us for a full export of their organisation’s data, or for its deletion, and we do it within 30 days. Write to [email protected]; we may ask you to confirm your identity. You can also complain to the Hellenic Data Protection Authority (www.dpa.gr), Kifisias 1–3, 115 23 Athens.
9. Security
Encrypted connections everywhere, passwords and PINs stored only as salted hashes, each restaurant’s data separated at the database level, rate limits and bot protection on sign-in, signed and scanned software releases, and access to production limited to us.
10. Children
Console accounts are for businesses and people aged 18 or over. The guest app collects no data that identifies anyone.
11. Changes
If we change this policy in a way that matters, we will update the date above and tell account owners by e-mail before the change applies.
CG Labs L.P. · Athens, Greece · [email protected] · Terms