Scanlead Privacy Policy

Version dated 30 September 2026. Current effective version, binding on users of the Scanlead service.

1. Identity of the controller

The controller within the meaning of Article 4(7) of the General Data Protection Regulation (GDPR) is:

Quantum Liquid LLC, a Wyoming Limited Liability Company, with its registered office located at 30 N Gould St, Sheridan, WY 82801, United States of America.

Website: https://scanlead.io. Contact address for any request relating to personal data: support@scanlead.io.

Quantum Liquid LLC operates the Scanlead service, hereinafter referred to as "Scanlead" or "the Service".

Quantum Liquid LLC has no establishment in the European Union. If and when it becomes mandatory under Article 27 GDPR, Quantum Liquid LLC will designate an EU representative. As of the date of this policy, the company acts directly through support@scanlead.io, which receives all data subject requests from individuals residing in the EU, EEA, United Kingdom, and Switzerland.

2. Scope

This policy describes the processing of personal data carried out by Scanlead in connection with the use of the scanlead.io website, the Scanlead progressive web application (PWA), and associated services (API, CRM integrations, transactional emails).

It applies to three categories of individuals:

• Registered users ("Users"), who create a Scanlead account to capture contacts at trade shows.
• Individuals whose contact details are captured by a User via the Service ("Captured Contacts").
• Visitors to scanlead.io who do not create an account.

3. Categories of personal data collected

3.1 User account data

When creating an account and during use of the Service, Scanlead collects:

• Email address.
• Password stored as a salted hash (bcrypt or equivalent).
• First name and last name.
• User's company name and industry.
• Language and time zone preferences.
• Sign-in logs (date, IP address, user agent) for account security.

3.2 Contacts captured by the User ("Leads")

When the User uses Scanlead at a trade show, the User records data relating to third parties. This data may include:

• First name and last name of the contact.
• Company and job title.
• Business email address.
• Phone number.
• Free-form notes entered by the User.
• Photograph of the business card taken by the User.
• Timestamp and location (name of the trade show) of the capture.

For this data, the User acts as controller and Scanlead acts as processor within the meaning of Article 28 GDPR. The terms are set out in the Data Processing Agreement (DPA) that supplements the Terms of Service.

3.3 Usage and analytics data

Scanlead uses PostHog (servers in the United States) to understand how the Service is used. Events collected include:

• Pages visited, screens opened.
• Actions in the application (button "new scan", export, CRM connection).
• Device type, operating system, browser.
• Truncated IP address.

A pseudonymous user identifier is associated with these events for signed-in Users. No personal data of Captured Contacts is sent to PostHog.

3.4 Payment data

Payments are processed by Stripe, Inc. (payment processor). Scanlead does not store card details. We only retain:

• The Stripe customer identifier (stripe_customer_id).
• Subscription status (active, paused, canceled).
• Plan and currency subscribed to.
• Invoices accessible via the Stripe customer portal.

3.5 Transactional email data

Transactional emails (registration confirmation, password reset, activity summaries) are sent via Resend. The following data is processed: recipient email address, subject line and message body, delivery status.

4. Purposes and legal bases

In accordance with Article 6(1) GDPR, each processing activity is based on an identified legal ground.

Purpose	Legal basis	Reference
Provision of the Service to registered Users	Performance of contract	Art. 6(1)(b)
Invoicing and compliance with accounting obligations	Legal obligation	Art. 6(1)(c)
Sending essential transactional emails	Performance of contract	Art. 6(1)(b)
Audience measurement and product improvement via PostHog	Legitimate interest, with right to object	Art. 6(1)(f)
Non-strictly-necessary cookies	Consent	Art. 6(1)(a)
Security, fraud prevention, access logs	Legitimate interest	Art. 6(1)(f)
Response to requests from competent authorities	Legal obligation	Art. 6(1)(c)
Processing of Leads captured by the User	Processing on behalf of the User, who is controller	Art. 28

Legitimate interest has been subject to a documented balancing test. Analysis is limited to pseudonymized data, the User can object at any time via account settings, and no automated decisions with legal effect are taken.

5. Retention periods

Scanlead applies the following retention periods.

• User account data: for the entire duration of use of the account, then 3 years after the last activity for commercial follow-up, unless objected to. Data required by law (invoicing) is retained for 10 years in accordance with applicable accounting obligations.
• Captured Leads: controlled by the User. They are retained until the User deletes them. Upon account closure, Leads are deleted within 30 days, unless the User requests an export beforehand.
• PostHog analytics: 12 months rolling.
• Security logs: 12 months.
• Invoices: 10 years (tax obligation).
• Database backups: one full copy every day, compressed, deleted after 30 days. Deleted data may therefore remain in these copies for up to 30 days.

6. Recipients and subprocessors

Scanlead uses the following subprocessors, listed exhaustively as of the date of this version. The up-to-date list is the one on this page, https://scanlead.io/privacy.

Subprocessor	Role	Server location
Replit, Inc.	Application hosting	Region provided on request
Neon (Postgres database managed by Replit)	Main database: accounts, trade shows, Leads	Region provided on request
Supabase Inc.	Account authentication, storage of the daily database backups	Paris, France (EU)
Stripe, Inc.	Payment processing	United States
Resend	Transactional email delivery	United States
PostHog Inc.	Product analytics	United States
Cloudflare	CDN, DDoS protection	Global points of presence, EU termination for EU traffic

Scanlead imposes on each subprocessor contractual safeguards equivalent to those described in this policy, in accordance with Article 28 GDPR.

No data is sold to third parties. Scanlead does not run behavioral advertising.

7. International transfers

Certain subprocessors (Replit, Neon, Stripe, Resend, PostHog) and the company itself are established in the United States. Transfers to these recipients are governed by:

• Standard Contractual Clauses (SCCs) adopted by the European Commission in Decision 2021/914 of 4 June 2021, Module 2 (controller to processor) or Module 3 (processor to processor) depending on the setup.
• Where applicable, the subprocessor's adherence to the EU-U.S. Data Privacy Framework.
• Additional technical measures: encryption in transit (TLS 1.2 minimum), encryption at rest, minimization of transferred data, access segregation.

A Transfer Impact Assessment is available on request at support@scanlead.io.

At Supabase, account authentication and the daily database backups are hosted in the European Union, in Paris (France). The application is hosted by Replit and the main database by Neon, a Postgres database managed by Replit: the region of their servers is provided on request at support@scanlead.io. PostHog analytics data is processed in the United States.

8. Data subject rights

In accordance with Articles 15 to 22 GDPR, every data subject has the following rights.

• Right of access (Art. 15): to obtain confirmation that personal data concerning them is being processed and to receive a copy.
• Right to rectification (Art. 16): to have inaccurate or incomplete data corrected.
• Right to erasure (Art. 17): to obtain deletion of the data, subject to legal retention obligations.
• Right to restriction of processing (Art. 18).
• Right to data portability (Art. 20): to receive the data in a structured, commonly used, machine-readable format.
• Right to object (Art. 21), in particular to processing based on legitimate interest.
• Right to withdraw consent at any time, without retroactive effect, when the processing is based on Article 6(1)(a).
• Right to set instructions regarding the fate of the data after death, where applicable law provides for this.
• Right to lodge a complaint with a supervisory authority, in particular the CNIL in France (www.cnil.fr), the ICO in the United Kingdom, or any other competent supervisory authority in the Member State of habitual residence, place of work, or place of the alleged infringement.

8.1 How to exercise rights

Users can exercise the rights of access, rectification, portability, and deletion directly from their Scanlead account settings.

Any request may also be sent to support@scanlead.io, together with an element allowing verification of the requester's identity. A response will be provided within one month, extendable by two months for complex requests in accordance with Article 12(3) GDPR.

8.2 Captured Contacts (Leads)

When a Captured Contact wishes to exercise their rights, the request may be sent either to the User who recorded them (the controller) or to Scanlead, which will forward the request to the relevant User and assist in handling it in accordance with Article 28(3)(e) GDPR.

9. No automated decision-making and no AI training

Scanlead does not take any decision producing legal effects on individuals or significantly affecting them in an automated manner within the meaning of Article 22 GDPR.

Personal data of Users and Captured Contacts is never used to train artificial intelligence models, whether operated by Scanlead or by third parties. Optical character recognition (OCR) features on business cards rely on local processing or on a third-party service that contractually undertakes not to retain or train models on the images submitted.

10. Cookies and trackers

Scanlead uses two categories of cookies and similar technologies.

• Strictly necessary cookies: session, authentication, language preferences, CSRF protection. They are set without consent, in accordance with Article 5(3) of the ePrivacy Directive as transposed by Member States.
• Analytics cookies (PostHog): set only after explicit consent via the consent banner. Consent can be withdrawn at any time via the "Manage cookies" link in the footer.

No advertising cookies are set.

11. Minors

The Service is not intended for individuals under 16 years of age. No account is knowingly created for a minor under 16. If Scanlead becomes aware that an account has been opened by a minor below this age, the account will be closed and the associated data deleted.

12. Security

Scanlead implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk (Art. 32 GDPR):

• Encryption in transit (TLS 1.2 minimum) and at rest (AES-256).
• Data isolation between workspaces (Row Level Security in Postgres).
• Two-factor authentication available for all accounts.
• One full database backup every day, compressed, kept for 30 days in private storage at Supabase (Paris), then deleted.
• Administrative access logging.
• Vulnerability management policy and incident response procedures.
• Confidentiality commitments signed by any person with access to the data.

In the event of a personal data breach likely to result in a risk to the rights and freedoms of individuals, Scanlead notifies the competent supervisory authority within 72 hours in accordance with Article 33 GDPR, and informs the affected individuals when the breach is likely to result in a high risk (Art. 34 GDPR).

13. Changes to this policy

Scanlead may amend this policy. Any material change will be notified to Users by email and via a banner in the application at least 30 days before it enters into force. Continued use of the Service after this period constitutes acceptance. The current version is always available at https://scanlead.io/privacy.

14. Contact

For any question, request, or complaint regarding this policy:

Quantum Liquid LLC, attention "Privacy", 30 N Gould St, Sheridan, WY 82801, United States of America.

Email: support@scanlead.io.