Scan2Eat Privacy Policy

Last updated: 17 October 2026

1. Who we are

Scan2Eat is provided by the provider named in our Legal information ("Azayn", "we", "us"). For the data described in this policy, Azayn is the controller under the General Data Protection Regulation (GDPR).

Privacy contact: privacy@azayn.com

2. What this policy covers, and what it does not

This policy covers the data we handle for our own purposes:

visitors to scan2eat.com and azayn.com/scan2eat;
the businesses that sign up for Scan2Eat and the people they invite (administrators, managers, staff and kitchen users), for account, billing and security purposes;
people who order a QR display device;
people who contact us.

It does not cover guests who order at a venue, or a venue's own staff records. For that data the venue is the controller and Azayn is its processor, under the Data Processing Agreement. Section 9 explains what happens to guest data. This policy also does not cover Stripe, Google, Microsoft or your own email provider, which have their own policies.

3. The short version

Scan2Eat is for businesses (restaurants and hotels). Guests need no account: they get an automatic nickname such as "Happy Panda". We do not collect a guest's name, email address or phone number.
We collect no health data. The guest app tells guests to talk to staff about allergies and not to type health information into notes.
We use no analytics, no advertising trackers, no third-party fonts and no AI service. Only strictly necessary cookies are used (see the Cookie and Storage Policy).
Scan2Eat does not process payments itself. Subscription and device payments go through Stripe, and card data never reaches us.
Data is hosted in the EU. We do not sell personal data.

4. What we process, why, and on what legal basis

Your account

What: your email address, your name if you give one, a hashed password (bcrypt), your role, the businesses you belong to, the Google or Microsoft account identifier if you sign in with them, and sign-in and audit events.
Why: to create and run your account, sign you in, send invitations and reset links, and show you who did what.
Basis: performance of the contract (Art. 6(1)(b) GDPR).
How long: while the account exists. You can delete your own account in the console (section 8).

Security and abuse prevention

What: IP addresses, timestamps and request data in rate-limit, abuse and security logs, and a log of administrative actions.
Why: to protect the service from abuse and to investigate incidents.
Basis: our legitimate interest in a secure service (Art. 6(1)(f)).
How long: IP addresses in rate-limit and abuse logs for up to 30 days. Audit-log entries are kept with the business's records (see the Retention and Deletion Policy).

Subscriptions and invoices (through Stripe)

What: the business name and billing contact, VAT identification number, plan, invoice history and payment status. We do not receive or store card numbers.
Basis: performance of the contract (Art. 6(1)(b)) and legal duties under tax and accounting law (Art. 6(1)(c)).
How long: for the period the law requires. In Germany that is up to 8 to 10 years for invoices and books.

Device orders

What: the contact person, company, shipping address, quantities and order status.
Basis: Art. 6(1)(b) and Art. 6(1)(c).
How long: for the statutory period.

Email

What: your email address and the content of messages we send you (verification, password reset, invitations, low-stock and restock reminders, billing notices) through Resend. If you write to us, we keep the correspondence.
Basis: Art. 6(1)(b), and Art. 6(1)(f) for support correspondence.
How long: support correspondence for up to two years after a case is closed.

The website

What: our servers log technical data when you visit, such as the time, the page requested and your IP address.
Basis: Art. 6(1)(f), to keep the site secure and working.
How long: up to 30 days.

5. Who receives your data

Hetzner Online GmbH hosts the service and stores files and encrypted backups, in the EU.
Stripe handles subscription billing, device checkout and tax.
Resend sends our transactional email.
Google and Microsoft, only if you choose to sign in with them.
Professional advisers, and authorities where the law requires it.

The current list, with locations, is on the Sub-processors page. We do not use any other recipient for the data in this policy.

6. Transfers outside the EU

Hosting is in the EU. Stripe and Resend may process data in the United States or elsewhere. Where they do, the transfer relies on the EU-US Data Privacy Framework if the recipient is certified, and otherwise on the EU Standard Contractual Clauses. You can ask us for a copy.

7. Automated decisions

None that have a legal or similarly significant effect on you.

8. Your rights, and deleting your account

You have the right to access, correct, delete, restrict and port your data, to object to processing based on our legitimate interest, and to withdraw consent you gave. Write to privacy@azayn.com. You may also complain to the data protection authority responsible for your place of residence or for our place of business.

Your own account: a signed-in user can delete their account in the console. It takes effect immediately, and in every business the person belonged to, their membership is anonymised rather than removed, because that business's orders and audit log refer to it. A person who is the only active administrator of a running business must first appoint another administrator or delete the business.
A business: an administrator can export the business's data and then delete the business. The steps and timings are in the Retention and Deletion Policy.
Guests ask the venue they ordered from, which is their controller.

9. Guests who order at a venue

When a guest scans a QR code and orders, the venue is the controller and decides what happens to the data. We process it on the venue's behalf and keep it separate from other businesses.

What the guest app handles:

an automatically generated nickname, the table or room, the shared cart, the orders and bill, and any note the guest writes;
a guest session cookie that keeps the cart and table session (strictly necessary);
technical data (IP address, browser, timestamps) for security.

What it does not handle: a guest's real name, email address, phone number, location or health data. Group tables show the nicknames of the people at the table to each other, not real names.

Retention: free-text order notes are cleared after 30 days, and guest nicknames and session data after 7 days. Orders and bills stay with the venue's records, which the venue controls.

Short notice shown to guests: "This venue uses Scan2Eat so you can order from your table or room. We process your order, your table or room and an automatically generated nickname to prepare and serve it and to settle your bill. No account is needed. Only strictly necessary cookies are used. Please tell staff about food allergies in person, and do not type health information into notes."

Payments: Scan2Eat does not process payments. If a guest pays through a payment link or at the counter, the venue or its payment provider handles that data under its own privacy notice.

Allergies: allergen information in the app is entered by the venue and may be incomplete. Guests who have an allergy should tell staff before ordering.

Venues are responsible for completing their own privacy notice for guests with their details. Guests can exercise their rights with the venue.

10. Security

Traffic is encrypted in transit. Each business has its own database. Access is role-based, passwords are hashed, sign-in attempts are rate limited, and backups are encrypted before they are stored. More detail is in Annex II of the Data Processing Agreement.

11. Children

Scan2Eat is a service for businesses and is not directed at children. Guests are anonymous, so we do not know their age.

12. Changes

We will publish changes here and tell account holders about material ones by email.

Provider details: Legal information · privacy@azayn.com