Privacy policy.

Scan & Voilà ("we," "us," or "our") operates the Scan & Voilà web application (the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect your personal information in compliance with the Quebec Act respecting the protection of personal information in the private sector (Law 25), the Personal Information Protection and Electronic Documents Act (PIPEDA), and applicable Canadian privacy legislation.

1. Information We Collect

Account Information

When you create an account, we collect your email address and password (hashed: we never store plaintext passwords).

Event Data

Event organizers provide event details (name, date, venue information) and guest information (names, table assignments, meal preferences, notes). This data is entered voluntarily by the event organizer.

Payment Information

Payment processing is handled entirely by Stripe, Inc. We do not store credit card numbers or banking details on our servers. We retain a Stripe customer identifier to manage your subscription.

Messages to Support

The help center’s “Write to us” form asks for your name, your email address and your message; your event’s name and date, and a screenshot, are optional. From an event’s screens in the app, it sends your account’s email address and that event instead. “Did this help?” sends nothing unless you add the optional comment, and never your name or email address. Cloudflare Turnstile checks that a person is writing whenever the form is sent without an event, and on every “Did this help?” comment, in the app too. Both go by email, through Resend (United States), to our support inbox, where we read them to answer you; they are not stored in our database. The form also sends you an automatic reply.

Automatically Collected Information

We collect basic technical data including your browser type, device type, and IP address through standard web server logs.

We use a small number of first-party cookies and services to run the site: a session cookie when you sign in; a language preference; and, the first time you land on the site, a 30-day cookie (sv-attrib) that remembers how you first arrived (campaign parameters, click identifiers such as gclid/fbclid, and the referring site) so we can tell which of our own efforts brought you here. We use Vercel Analytics, which counts page views without cookies or cross-site tracking, Sentry to record application errors, and Cloudflare Turnstile on sign-up, sign-in, the guest RSVP form, and the help center's forms to keep bots out. We do not run advertising pixels today; if we add one, we will ask for your consent first.

2. How We Use Your Information

• To provide and operate the Service (event creation, guest seating lookup)
• To process payments through Stripe
• To communicate with you about your account or changes to the Service
• To ensure security and prevent abuse of the Service

3. Data Storage and Processing

Your account, event, and guest data, including uploaded photos, are stored using Supabase (database, authentication, and file storage) in Canada (Montréal region, ca-central-1). The application itself, its logs, and on-the-fly image resizing run on Vercel in the United States. Email is delivered by Resend (United States), application errors are recorded by Sentry (United States), and bot protection on sign-up, sign-in, the guest RSVP form, and the help center's forms is provided by Cloudflare. The guest lookup page, the event website, and the photo album load one or more fonts directly from Google Fonts, so Google sees the visitor's IP address when they open one of those pages. If a host uses Smart Import to paste a guest list, the pasted text is sent to Anthropic's API to extract guest rows. When a host pastes a menu, or asks for a typed one to be read with AI, its text is sent the same way to lay out the courses and dishes. By using the Service, you consent to the transfer of your data to these providers in accordance with their respective privacy policies.

4. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information. We share data only:

• With Stripe for payment processing
• With Supabase for data storage and authentication
• With Vercel for application hosting, which sees your IP address and requests to serve the site
• With Resend to deliver email, which receives your email address and the message content
• With Sentry to record application errors when something breaks
• With Cloudflare to verify you're not a bot at sign-up, sign-in, when you RSVP, or when you use a help center form
• With Google Fonts, which sees your IP address when the event lookup page, event website, or photo album loads its fonts
• With Anthropic, which receives the guest-list text a host pastes when using Smart Import, and the menu text a host pastes or asks it to read
• When required by law, regulation, or valid legal process
• To protect the rights, safety, or property of Scan & Voilà, our users, or the public

Guest Data Visibility

When an event organizer shares their event link, guests can search for their name to view their table assignment, meal preference, and any notes the organizer has added. Only the minimal information needed for seating lookup is displayed. Guest data is not accessible without the event link.

If you are a guest, the host who invited you decides what to collect through their RSVP and photo wall and is the one to ask to correct or remove your entry; we act on their instructions and delete guest data when they delete it or their event. If you cannot reach your host, write to us and we will help.

5. Data Retention

We retain your account data for as long as your account is active. Event data is retained until the event organizer deletes the event or their account. You may request deletion of your account and all associated data at any time. When an organizer deletes an event, it can be restored on request for 30 days; after that, the event and its photos and videos are permanently deleted.

6. Your Rights

Under Quebec and Canadian privacy law, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your personal information
• Withdraw consent to the processing of your information
• File a complaint with the Commission d'accès à l'information du Québec (CAI)

7. Security

We implement industry-standard security measures including encrypted connections (HTTPS), hashed passwords, row-level security policies on our database, and restricted access to personal information. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

If we learn of a confidentiality incident involving your personal information that presents a risk of serious injury, we will notify you and the Commission d'accès à l'information du Québec without unreasonable delay, and record the incident in our register.

8. Children's Privacy

The Service is not directed to children under 16. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a new "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

10. Who to Contact About Your Privacy

Under Québec's Act respecting the protection of personal information in the private sector, the person responsible for the protection of personal information at Scan & Voilà is David Vo, founder. Write to hello@scanvoila.com with "Privacy" in the subject line for access, correction or deletion requests, or to raise a concern. We answer within 30 days.

11. Contact

For questions about this Privacy Policy or to exercise your privacy rights, contact us at hello@scanvoila.com.