Privacy Policy

1. Who We Are

Scan2Call (scan2call.com.au) is a smart QR tag service operated by ZTEC Group Pty Ltd (ABN 82 697 931 445), an Australian company. In this policy, "Scan2Call", "we", "us", and "our" refer to the Scan2Call service.

We are committed to handling personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains what we collect, why, how long we keep it, and your rights.

2. Information We Collect

We collect the following categories of information:

• Account information: your name, phone number, email address, password (stored as a salted hash), and optional profile details such as a WhatsApp number or avatar.
• Order and payment information: shipping address, order history, and payment records. Card details are processed by Stripe and are never stored on our servers.
• Tag and scan data: when someone scans one of your tags, we record the scan time, approximate location (if the finder chooses to share it), device user agent, and a one-way hashed (SHA-256) version of the finder IP address for scan history.
• Communication relay data: when a finder contacts a tag owner through our anonymous relay (call, SMS, WhatsApp, or location share), we log the communication type, status, duration, and Twilio message references. For fraud and abuse prevention, we also record the finder IP address in raw form, and where available the finder phone number, for a limited period (see section 5).
• Support data: messages you send through our contact form or in reply to our emails.
• Technical data: authentication records including the IP address and browser user agent associated with your login sessions, used to secure your account.

3. How We Use Your Information

We use personal information to:

• Operate the Scan2Call service, including relaying calls and messages between finders and tag owners without revealing either party’s phone number.
• Process orders, payments, tag renewals, and refunds.
• Verify your identity through SMS one-time codes and email confirmation.
• Notify you about scans, found items, order status, and tag expiry (based on your notification preferences).
• Detect, investigate, and prevent fraud, abuse, and misuse of the relay service, including blocking abusive phone numbers or IP addresses.
• Respond to enquiries and provide customer support.
• Comply with legal obligations.

4. Fraud and Abuse Prevention

The anonymous relay is designed to protect the privacy of both finders and tag owners. To keep the service safe and prevent abuse (such as spam, harassment, or automated misuse), we log the IP address of anyone who initiates a relay communication, and where available the phone number used.

This data is visible only to authorised Scan2Call administrators, is used solely for abuse detection and blocking, and is automatically deleted after 90 days. Aggregate, non-identifying statistics may be retained longer.

5. Data Retention

• Account data: retained while your account is active. If you delete your account, your personal details are anonymised.
• Raw finder IP addresses and phone numbers on communication logs: deleted after 90 days.
• Scan history: retained with hashed IP addresses only; raw finder IPs are never stored for scans.
• Order and payment records: retained as required by Australian tax and consumer law (generally 7 years).
• Verification codes and session tokens: short-lived and expire automatically.

6. Third-Party Service Providers

We share personal information only with service providers who help us operate Scan2Call, and only to the extent needed:

• Twilio: powers our anonymous call, SMS, and WhatsApp relay, and SMS verification codes.
• Stripe: processes payments and stores payment methods for renewals.
• Resend: delivers transactional emails such as verification and order confirmations.
• Cloudflare: provides bot protection (Turnstile) and content delivery.
• Cloud hosting and storage providers located in the Asia-Pacific region.

7. Data Residency and Security

Our primary infrastructure and data storage are located in the Asia-Pacific (Sydney) region. Some providers listed above may process data overseas (for example, in the United States); where they do, we rely on their contractual and security commitments consistent with APP 8.

We protect your information with encryption in transit (TLS), hashed passwords, short-lived access tokens, role-restricted admin access, and audit logging of administrative actions.

8. Your Rights

Under the Privacy Act you may request access to, or correction of, the personal information we hold about you. You can update most details directly in your account settings, and you can delete your account from the settings page at any time.

To make a privacy request or complaint, contact us at [email protected]. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

9. Cookies

We use strictly necessary cookies for authentication (a secure, HttpOnly refresh token) and a cookie to remember your consent preferences. With your consent we also use analytics cookies (Google Analytics) to measure site performance, and marketing cookies (the Meta Pixel, provided by Meta Platforms) to measure the effectiveness of our advertising. Analytics and marketing cookies are enabled by default and we tell you so on your first visit; you can turn them off at any time from the cookie preferences panel, and withdrawing marketing consent also deletes the advertising cookies already stored on your device.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be announced on this page with an updated "last updated" date. Continued use of Scan2Call after changes take effect constitutes acceptance of the updated policy.

11. Contact

Privacy enquiries: [email protected]. General support: [email protected]. Postal enquiries can be sent to ZTEC Group Pty Ltd, Sydney, NSW, Australia.