Privacy Policy

1. Who We Are

Scan2Call BD (scan2call.com.bd) is a smart QR tag service operated in Bangladesh. In this policy, "Scan2Call", "we", "us", and "our" refer to the Scan2Call BD service. (TODO: insert registered company name and address before launch.)

We are committed to handling personal information responsibly and in accordance with the applicable laws of Bangladesh, including the requirements that apply to digital services and electronic transactions. This policy explains what we collect, why, how long we keep it, and your rights.

2. Information We Collect

We collect the following categories of information:

• Account information: your name, phone number, email address, password (stored as a salted hash), and optional profile details such as a WhatsApp number or avatar.
• Order and payment information: shipping address, order history, and payment records. Card and mobile-banking details are processed by SSLCommerz, our payment gateway, and are never stored on our servers.
• Tag and scan data: when someone scans one of your tags, we record the scan time, approximate location (if the finder chooses to share it), device user agent, and a one-way hashed (SHA-256) version of the finder IP address for scan history.
• Communication relay data: when a finder contacts a tag owner through our anonymous relay (call, SMS, WhatsApp, or location share), we log the communication type, status, duration, and provider message references. For fraud and abuse prevention, we also record the finder IP address in raw form, and where available the finder phone number, for a limited period (see section 5).
• Support data: messages you send through our contact form or in reply to our emails.
• Technical data: authentication records including the IP address and browser user agent associated with your login sessions, used to secure your account.

3. How We Use Your Information

We use your information to:

• Provide the service: activate tags, relay anonymous contact between finders and owners, and show your scan history.
• Process orders and deliveries, including sharing your delivery details with our courier partners.
• Send service notifications: scan alerts, order confirmations, renewal reminders, and security notices.
• Prevent fraud and abuse of the anonymous relay.
• Improve the service through aggregated, de-identified usage analysis.

4. Who We Share Data With

We do not sell your personal information. We share data only with service providers who process it on our behalf:

• SSLCommerz - payment processing (card, mobile banking, and internet banking transactions).
• SSL Wireless - SMS delivery, phone verification, and anonymous call/SMS masking.
• Courier partners (such as Steadfast Courier and Pathao) - order delivery; they receive your name, phone number, and delivery address.
• Email delivery provider - transactional emails.
• Cloud hosting and storage providers - infrastructure the service runs on.

5. Data Retention

• Account data: kept while your account is active and deleted or de-identified after account deletion.
• Order and payment records: retained as required by applicable Bangladeshi tax and commercial record-keeping laws.
• Raw finder IP addresses and phone numbers collected for abuse prevention: automatically deleted after 90 days.
• Scan history: retained while the related tag exists.

6. Where Data Is Stored

Our infrastructure and data storage are hosted with reputable cloud providers. Some providers may process data outside Bangladesh; where they do, we rely on their contractual and security commitments. (TODO: confirm final hosting regions before launch.)

7. Your Rights

You may access, correct, or delete your personal information at any time from your account settings, or by contacting us. You can also request a copy of your data or a full account deletion via our data deletion page.

To make a privacy request or complaint, contact us at privacy@scan2call.com.bd. We will respond within a reasonable time.

8. Security

We protect your data with industry-standard measures: encrypted connections (HTTPS), hashed passwords, hashed IP storage for scan history, short-lived access tokens, and least-privilege access to production systems. No system is perfectly secure; if we become aware of a data breach affecting you, we will notify you as required by law.

9. Changes and Contact

We may update this policy from time to time; material changes will be announced on this page with a new "last updated" date.

Privacy enquiries: privacy@scan2call.com.bd. General support: support@scan2call.com.bd. (TODO: add postal address of the registered BD entity.)