# Scanmelon privacy (English summary)

Canonical legal text (Dutch): https://scanmelon.com/privacy  
Last updated: 16 September 2026.

This is a summary for language models. The Dutch page is authoritative.

## Controller

Scanmelon, operator of scanmelon.com. Privacy contact: hello@scanmelon.com.

## Scope

Covers using the website, designing a QR code on the homepage, email sign-in, stored codes, paid plans, and email contact. There is no contact form.

## QR design data

The generator runs in the visitor's browser until you save. After sign-in Scanmelon stores destination, appearance, and live hop URLs so you can download and edit later. A downloaded or printed code contains the destination the visitor entered; Scanmelon is not the controller of what happens on that destination after a scan.

## Personal data Scanmelon does process

- Technical visit data in server logs (IP address, time, path, status, referrer, user-agent) as part of hosting the site.
- Email address for magic-link sign-in, to attach saved QR codes, and to send service mail when scan limits are nearly used or reached.
- Stripe customer id and plan status for paid plans. Card numbers stay with Stripe.
- Email contact: address, message body, attachments, and email metadata when someone writes to hello@scanmelon.com.
- Scan counts on dynamic codes, used for quotas and the operator board.

No name or phone is requested. No remarketing or profiling. Personal data is not sold.

Legal bases include legitimate interest for hosting/security, answering email, cookieless Vercel Web Analytics, and legal obligation where the law requires keeping correspondence. Account processing (including scan-limit emails) and payment processing use contract performance.

## Cookies

No tracking cookies or advertising cookies. Vercel Web Analytics is cookieless. The site sets `scanmelon-locale` for language and Supabase session cookies after sign-in. No cookie banner for those strictly functional cookies.

## Retention (summary)

- Technical logs: as short as hosting allows for security and incidents (typically days to a few weeks unless an incident needs longer).
- Email: until the request is handled, then up to two years unless law or a dispute requires longer.
- QR design data: not held by Scanmelon; it exists in the browser session unless the visitor downloads a file.

## Rights

GDPR rights apply (access, correction, erasure, restriction, portability where applicable, objection). Send requests to hello@scanmelon.com. Complaints: Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

Scanmelon is not directed at children under 16.