Privacy Policy

ScanDish is owned, operated and governed by Ironic Lab Inc. (“Ironic Lab”, “we”). Ironic Lab is responsible for the personal data described in this policy. Contact us at support@scandish.online.

When your business uses ScanDish we collect:

• Account details — login email and, through our sign-in provider, a securely hashed password (we never see or store your password in readable form).
• Business details — company name, manager name, phone number, email, location, and business registration number or certificate you provide.
• Page content — everything you publish: names, menus, prices, photos, logos, offers, contact and social links.
• Security and activity records — sign-ins, failed sign-in attempts, published changes, uploads and administrative actions, with the date and time, IP address and device/browser type.
• Subscription records — plan, start and end dates, and renewal history.

People who scan a QR code or open a menu page do not create an account. To give businesses useful statistics we record only:

• anonymous counts of page views per day and hour;
• the type of device (mobile, tablet or desktop) and how the visit started (QR code, direct or shared link);
• a small note stored on the visitor's own device (browser local storage) saying the page was already seen that day, so repeat visits are not counted twice. It contains no personal information.

We do not store visitors' names, contact details or IP addresses with these statistics, and we do not use advertising cookies. An IP address is used briefly to stop the same device inflating counts and is then discarded. Maps on menu pages are provided by Google Maps, which may set its own cookies under Google's privacy policy.

Table orders. On menus where the restaurant accepts orders, a guest who sends an order gives the dishes chosen, a table number and/or a phone number, and an optional note. These go only to that restaurant so it can prepare and deliver the order (and call the guest if needed). Orders, including the phone number, are deleted automatically after 30 days. Payment is made at the restaurant; ScanDish does not handle it.

• to create and run your account and publish your menu page;
• to show you visit statistics for your page;
• to manage subscriptions and contact you about your account, renewals and important changes;
• to keep ScanDish secure — detecting suspicious sign-ins, abuse and fraud — and to investigate problems;
• to improve the Service, using aggregated information where possible;
• to meet legal and accounting obligations.

We process personal data in line with applicable data-protection law, including Rwanda's Law N° 058/2021 of 13/10/2021 relating to the protection of personal data and privacy. We rely on the performance of our contract with you, our legitimate interest in running a secure and reliable service, compliance with legal obligations and, where required, your consent.

We do not sell personal data. We share it only with service providers that process it on our behalf, under contract:

• Google Firebase — sign-in and database;
• Cloudinary — storing and optimising images you upload;
• Vercel — hosting and delivering the website;
• Google Maps — maps and directions on menu pages.

Your page content is public by design — anyone with your link or QR code can see it. We may also disclose information when required by law or to protect the rights and safety of our users and the Service.

Our providers may store data on servers outside Rwanda. When they do, we rely on providers with recognised security and data-protection commitments and take reasonable steps so your data receives an adequate level of protection.

• Account, business details and page content — for as long as your account is active, and up to 90 days after it ends so it can be restored or exported.
• Security and activity records — 12 months.
• Anonymous visit statistics — for as long as your account is active.
• Invoices and subscription records — as long as tax and accounting law requires.

We protect data with encrypted connections (HTTPS), access controls that let each business reach only its own data, server-side permission checks, restricted administrator access and regular backups. No system is perfectly secure; if a breach affects your personal data we will notify you and the authorities as the law requires.

You may ask to access, correct, delete or receive a copy of your personal data, object to or restrict certain processing, and withdraw consent where we rely on it. Most details can be updated directly in your dashboard; for anything else contact support@scandish.online. We reply within 30 days.

If you are not satisfied with our answer, you may complain to Rwanda's data-protection supervisory authority, the National Cyber Security Authority (NCSA).

ScanDish accounts are for businesses and are not intended for children. Menu pages do not knowingly collect personal data from anyone.

We may update this policy. For material changes we will notify customers by email or in the dashboard before they take effect. The date at the top shows the latest version. See also our Terms of Service.

Ironic Lab Inc. — ScanDish · Kigali, Rwanda · support@scandish.online · +250781822350 · ironiclab.site