YOUR INFORMATION, EXPLAINED
Privacy Policy
Last updated: 29 October 2026
This policy explains how iGreet Ltd., the provider of scanAR (“we”, “us”), handles personal information on scanar.co, in the scanAR iOS and Android applications, and when you contact us. You can contact the controller through our contact form.
1. Information you provide
When you contact us, submit a support request, provide feedback, or take part in a campaign, we receive the information you choose to provide, such as your name, email address, message and attachments. The website contact form sends your first name, last name, email, optional phone number and question to our iGreet backend. The enquiry is stored there and delivered to our internal Slack workspace so our team can respond. Support problem reports from the mobile apps can also include technical diagnostics. Campaign-specific notices explain any additional information required for a particular promotion or transaction.
2. Camera, microphone and saved media
Camera access enables image recognition, augmented reality, and QR/barcode scanning. The current apps process the live camera view on your device; it is not streamed to us for AR recognition. Photos or videos are saved or shared when you choose those actions. Microphone access is requested for voice interactions such as Talk to Naya. Those voice recordings are processed in temporary local storage for playback and are deleted after playback or stopping the interaction. Saving a capture may require Photos or media-library permission. You can manage permissions in your device settings.
3. Scanning, downloads and local history
The app downloads AR catalogue information and the media needed to display experiences. A scanAR-specific QR code can be sent to our API to resolve its associated content. General QR/barcode results and scan history are stored locally in the current apps; they are not uploaded as scan history or included as raw values in Firebase telemetry. Opening a scanned link, using a search action, or sharing a result sends the information needed for that action to the service you choose.
You can remove scan history using the app’s history controls. Uninstalling removes application storage and caches; media saved to your photo library remains until you delete it there. Our current apps do not request precise device location for AR scanning. A location encoded in a QR code is content you scan, rather than background location collection.
4. Technical data, Analytics and Crashlytics
The current mobile apps use Google Firebase Analytics and Crashlytics to understand feature usage and investigate failures. These services can process app-instance or installation identifiers, device model, operating-system and app versions, interaction events, crash reports and diagnostic data. Current builds enable analytics collection and use automatic crash reporting. Scanner telemetry is designed to exclude raw QR/barcode contents, private capability URLs and user messages.
Requests to our website, APIs and content servers also expose network information such as your IP address and request details to the providers serving those requests. This is used to deliver content, maintain security and diagnose service issues. See Firebase privacy and security information for information about Google’s processing.
5. Website cookies and external services
This website does not install an advertising or analytics SDK and does not set its own analytics or advertising cookies. Hosting and network providers may process technical connection data to serve and protect the website.
YouTube videos load only after you click to play them. Loading a video connects your browser to YouTube, which receives connection information and may use cookies or similar technologies under its own policies. You can unload the video through Privacy settings in the footer; this does not remove cookies already set by an external provider. See Google’s Privacy Policy. The contact form uses our iGreet backend and Slack for internal handling. See Slack’s Privacy Policy. App stores, Facebook and other external links have their own policies.
6. Purposes and legal bases
We use information to deliver requested features, resolve AR content, respond to messages and support requests, maintain and improve the service, detect misuse and meet legal obligations. Depending on the activity, processing relies on performing a contract or steps you request before entering one, legitimate interests in operating and securing the service, legal obligations, or consent where required. Where consent is the legal basis, you may withdraw it without affecting earlier lawful processing. Device permission controls apply to camera, microphone and saved media.
7. Sharing and international processing
We share information with service providers involved in hosting, content delivery, support, contact forms, analytics and crash reporting, where needed for those functions; with recipients you choose when sharing; and where required by law or necessary to protect legal rights. We do not sell personal information. Some providers process information outside your country, including outside the EEA. Where required, transfers must rely on an applicable adequacy decision or other lawful safeguards, such as standard contractual clauses. Contact us for details applicable to your request.
8. Retention and security
Local history and caches follow the app controls described above. We retain messages, support records and related information only for as long as needed to handle the request, maintain relevant business records, resolve disputes or comply with legal obligations. Provider-managed diagnostics follow the applicable service settings and retention rules. We use reasonable technical and organisational safeguards, but no online service is completely secure. Do not include unnecessary sensitive information in messages or attachments.
9. Your rights
Depending on applicable law, you may request access, correction, erasure, restriction or portability of your personal information, object to processing based on legitimate interests, or withdraw consent. Send privacy requests through our contact form. We may need to verify your identity. GDPR requests are generally answered within one month, subject to permitted extensions. You may complain to your local supervisory authority; in Bulgaria, this is the Commission for Personal Data Protection.
10. Children and campaigns
Some AR content may appeal to children. Parents and guardians should supervise use and avoid submitting children’s personal information unnecessarily. If you believe a child has provided personal information without the required authorisation, contact us so we can investigate and take appropriate action. Individual campaigns may provide additional terms and privacy information.
11. Updates and contact
We will publish revisions here with an updated date and provide additional notice where required. For questions about this policy or your information, use our contact form.