Azayn

Scan2Eat Data Retention and Deletion Policy

Last updated: 17 October 2026

This policy says how long Scan2Eat keeps data and how data is exported and deleted. It is part of the Terms of Service and the Data Processing Agreement.

1. How long data is kept

  • Guest sessions and nicknames: guest nicknames and session data are removed after 7 days, and sessions that sit idle are closed after one day. A business cannot change this.
  • Free-text order notes (which could contain health information if a guest ignores the warning): cleared 30 days after the order.
  • IP addresses in rate-limit, abuse and security logs: up to 30 days.
  • Orders, bills and the audit log (items, totals, statuses, and who changed orders, prices, roles and settings): kept with the business's records until the business is deleted. The business must keep its own legal records in its fiscal or point-of-sale system, because Scan2Eat's bills are pre-bills.
  • Staff and administrator accounts: while the person is active. A person can delete their own account at any time (section 4).
  • Our billing records (invoices, Stripe records, device orders including the shipping address): for the statutory period, for example 8 years for invoices and 10 years for books under German law.
  • Backups: encrypted backups are kept on a rolling basis for 30 days.

2. Export

Administrators can export the business's menu, orders, bills and settings (JSON or CSV) at any time during the contract and for 30 days after it ends. This also serves a switch to another provider under the EU Data Act.

3. Deleting a business

  1. An administrator asks for deletion in the console and confirms their identity.
  2. The Service offers an export and explains what will happen. The subscription is cancelled.
  3. The business is set to pending deletion for a 14-day cancellation period. Guest ordering is switched off during it, and the administrator can cancel.
  4. After the period, the business's database is dropped, uploaded files (menu photos and videos) are deleted, and device credentials are revoked.
  5. Backups that contain the data are overwritten or expire within 30 days.
  6. The business web address is held back for 90 days to prevent someone else taking it over, and is then released.
  7. We confirm the deletion in writing on request.

Records we must keep by law, such as our invoices, payment records and device orders, stay and are used only for that purpose.

4. People and guests

  • A person's own account. One Scan2Eat account can belong to several businesses. A signed-in user can delete their account in the console: they type their email address and give their password (a Google or Microsoft sign-in needs only the address). It takes effect immediately. The account, the password hash, social sign-in identifiers and emailed tokens and codes are deleted. In every business the person belonged to, their membership is anonymised, not removed: it loses the name, gets a stand-in address, is made inactive and has its assignments and sessions ended, and audit-log entries about them lose their personal fields. This is because orders, stock movements and the audit log refer to the membership. We email the person afterwards. A person who is the only active administrator of a running business must first appoint another administrator or delete the business. A deleted membership no longer appears in the team list or in the business's export.
  • A business removing a person. On a business's instruction, the person's membership in that business is removed or anonymised in the same way, and the account itself stays while the person belongs to any business.
  • Guests. Requests go to the venue, which is the controller. We help with search and deletion tools under section 7 of the Data Processing Agreement.

5. Authorities

If a supervisory authority gives binding guidance or an order that affects these periods, we will follow it and update this policy.

Questions: privacy@azayn.com