1. Who this covers
Business users - owners and staff who create an account and manage a business on Scan To Star.
Customers - people who scan a business's QR code and use the public review page. Customers do not need an account.
2. Data we collect
From business users
- Account: name, email address and/or mobile number, password (stored only as a salted hash), timezone, and - if you sign in with Google - the Google account identifier and email Google shares with us.
- Business profile: business name, category, address, contact details, your Google review link, logo, and the review-page tags you configure.
- Billing: plan, orders, invoices, GST details you enter, payment status and gateway references. Card/UPI details are entered on the payment gateway's (Cashfree) pages and never reach our servers.
- Stand orders: shipping name, address and phone number.
- Usage and security: login times, IP address, device/browser type, session identifiers, and audit logs of admin actions.
From customers who scan a QR code
- The star rating, the tags you tap, and any free-text detail you choose to type.
- The generated review text (so the business can see what was drafted) and basic events such as "page opened", "review generated" and "publish clicked".
- Technical data: IP address (used for rate limiting and abuse prevention), browser type, and an anonymous session id. We do not ask customers for their name, phone number or email.
We never receive or store your Google account details as a customer: posting the review happens on Google's own site, in your own Google account, after you leave our page.
3. Why we use it (purpose and legal basis)
- To provide the service: generating review drafts, showing analytics to the business, running billing and support (performance of the contract with the business).
- To keep the platform safe: rate limiting, fraud and abuse prevention, security logging (legitimate interest).
- To meet legal duties: tax invoices and payment records (legal obligation).
- To send service messages: OTPs, plan expiry reminders, order updates by email or SMS. Marketing emails only with your consent, and you can opt out any time.
4. AI processing
Review drafts are produced from the rating, tags and text a customer provides. When an AI provider is enabled for a plan, that input is sent to the provider (currently Google Gemini) solely to generate the draft; we instruct the provider not to invent facts and we do not send customer contact details. When no provider is configured, a built-in template writer is used and nothing leaves our servers.
5. Sharing
We do not sell personal data. We share it only with:
- Payment gateway (Cashfree Payments) to process payments and refunds.
- Email/SMS providers to deliver OTPs and service messages.
- AI provider as described in section 4.
- Hosting and infrastructure providers that run our servers under confidentiality obligations.
- Authorities where the law requires it.
A business owner can see the ratings, tags, generated text and private feedback left for their own business - not for other businesses.
6. Google sign-in and Google data
If you sign in with Google we receive only your basic profile (name, email, Google ID) to create or link your account. We do not access your Gmail, contacts, or Google Business Profile. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
7. Retention
- Account and business data: for as long as the account is active, then deleted per our Account & Data Deletion process (30-day grace period).
- Customer review submissions and private feedback: kept for as long as the business's account exists so the owner can see their full history; a customer can ask for their own submission to be deleted (see section 9).
- Invoices, orders and payment records: 8 years, as required by Indian tax law, even after account deletion.
- Security logs: up to 12 months.
8. Security
Data is encrypted in transit (HTTPS), passwords are hashed, access to production systems is restricted and logged, and sessions use HttpOnly cookies. No system is perfectly secure; if we learn of a breach affecting you we will notify you as required by law.
9. Your rights
You can access and update your profile and business details in the dashboard. You can ask us to correct, export or delete your personal data, or object to marketing, by emailing support@scantostar.com. We respond within 30 days. Customers who left a review submission can ask for it to be deleted by telling us the business and approximate date.
10. Cookies
We use strictly necessary cookies for sign-in sessions and your active business selection, and browser storage for preferences such as theme and sidebar layout. We do not use advertising cookies.
11. Children
Scan To Star is a business tool and is not directed at children under 18. We do not knowingly collect data from them.
12. Changes and contact
We will post any material change here and update the date above. Questions: support@scantostar.com - Agent WebFlow, [Registered address], Uttar Pradesh, India.