Privacy Policy

1. Data controller

LCDV Limited, publisher of the Onlyscan service, acts as data controller for the personal data described below. Contact: contact@onlyscan.fr.

2. Data collected, purposes, and legal bases

• Identity and account (email, username, Google/Apple sign-in data if you use them) — account creation and management, authentication. Legal basis: performance of the contract.
• Content you create (QR codes, destination URL, uploaded logos, style options) — providing the service. Legal basis: performance of the contract.
• Scan data (date/time, device type, approximate country, referrer, IP address processed transiently) — scan statistics for dynamic QR codes, security, and abuse prevention. Legal basis: performance of the contract and legitimate interest.
• Support (messages, attachments) — handling your requests. Legal basis: performance of the contract / legitimate interest.
• Technical logs (IP address, device identifiers, errors) — security, fraud prevention, product improvement. Legal basis: legitimate interest.
• Marketing communications (email) — sent only with your consent. Legal basis: consent, revocable at any time.

We do not collect or store your card payment data: it is processed directly by our payment provider.

3. Data recipients

• Technical subprocessors: hosting and database, transactional email delivery, monitoring and support tools.
• Merchant of Record — Paddle.com: selling subscriptions, managing payments, subscriptions, billing, and tax compliance.
• Professional advisors: lawyers, accountants, when necessary.
• Authorities: where required by law.

We do not sell your personal data.

4. Transfers outside the EU/EEA

Our application servers and database are located in the European Union. Some providers may process data outside the EU/EEA; in that case, the transfer is governed by the European Commission's Standard Contractual Clauses or an adequacy decision.

5. Retention periods

• Account data and content: for the life of the account, then deleted within 90 days.
• Scan statistics: up to 24 months, then aggregated or deleted.
• Technical logs: up to 12 months.
• Billing data: the statutory accounting retention period (managed by Paddle as the official seller).

Beyond these periods, data is deleted or anonymized.

6. Your rights

In accordance with the GDPR, you have rights of access, rectification, erasure, restriction, portability, objection, and the right to withdraw your consent. Write to contact@onlyscan.fr: we respond within one month. You can also lodge a complaint with the CNIL (or the supervisory authority of your country of residence).

7. Security

We implement appropriate technical and organizational measures: encryption in transit (HTTPS), encryption at rest, per-user access control at the database level, logging, and the principle of least privilege.

8. Cookies

Onlyscan only uses cookies and local storage essential to its operation: keeping you signed in, security, and display preferences. We do not use advertising cookies. If we add analytics or marketing cookies, your consent will be collected beforehand and you will be able to change it at any time. You can also block or delete cookies via your browser settings — the service may then work less well.