Last updated: 28 June 2026
This policy explains how ScanTags ("we", "us", "our") collects, uses, shares and protects your personal data when you use our website, our tags and our service. We are committed to handling your data lawfully, fairly and transparently in line with the UK GDPR and the Data Protection Act 2018.
1. Who we are
ScanTags is the data controller for the personal data described in this policy. We are based in the United Kingdom and are registered with the Information Commissioner's Office (ICO), reference ZC184196. If you have any questions, want to exercise your rights, or wish to request our registered postal address, contact us at hi@scantags.io.
2. The data we collect
Depending on how you use ScanTags, we may collect:
- Account data — your name, email address and a securely hashed password.
- Profile & tag data — the information you choose to add to a tag, such as a pet, child or item name, a photo, a contact phone number, and notes. For medical or care tags this may include health information (e.g. allergies, conditions, medication, next-of-kin) — see section 4.
- Scan data — when a tag is scanned we may record the time, the approximate location (only if a finder chooses to share it), and basic technical information such as IP address and device/browser type.
- Finder submissions — if someone finds your item and contacts you through the tag, the message and any details they provide.
- Payment data — if you buy a paid plan, payment is processed by our payment provider (Stripe). We do not see or store your full card details.
- Communications — messages you send us by email or our contact form.
- Website/usage data — limited information collected through strictly necessary cookies (see our Cookie Policy).
3. How we use your data, and our lawful bases
4. Health & other special category data
If you add health-related information to a medical or care tag, this is special category data under Article 9 of the UK GDPR. We only process it on the basis of your explicit consent, which you give by choosing to add it. You decide exactly what is shown, you can edit or remove it at any time, and you can withdraw your consent by deleting the information or your account.
Emergency information on a ScanTag is intended to assist a finder or responder. It is not a medical record and is not a substitute for professional medical care or the emergency services.
5. Who we share it with
We do not sell your personal data. We share it only with trusted service providers ("processors") who help us run the service, under contracts that require them to protect it:
- Hosting — our website and database are hosted on UK/EU infrastructure.
- Payments — Stripe, to process payments securely.
- Email & notifications — our email/SMTP and push-notification providers, to send the alerts and messages you've asked for.
We may also disclose data where required by law, or to protect the rights, safety and property of ScanTags, our users or the public.
6. International transfers
We aim to keep your data within the UK and EEA. Where a provider processes data outside the UK/EEA, we ensure appropriate safeguards are in place (such as UK adequacy regulations or the International Data Transfer Agreement / Standard Contractual Clauses).
7. How long we keep it
We keep your account and profile data for as long as your account is active. If you delete a tag or your account, we delete or anonymise the associated personal data, except where we must keep limited records to meet legal, accounting or fraud-prevention obligations. Scan and sighting logs are kept only as long as needed to provide the service.
8. Your rights under the UK GDPR
You have the right to:
- Be informed about how your data is used (this policy).
- Access the personal data we hold about you.
- Rectify data that is inaccurate or incomplete.
- Erase your data ("right to be forgotten").
- Restrict or object to certain processing.
- Data portability — receive your data in a portable format.
- Withdraw consent at any time, where we rely on consent.
To exercise any of these, email hi@scantags.io. We will respond within one month. Exercising your rights is free.
9. Complaints & the ICO
If you have a concern, please contact us first and we'll do our best to put it right. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk or on 0303 123 1113. Our ICO registration reference is ZC184196.
10. Security
We protect your data with appropriate technical and organisational measures: encrypted connections (HTTPS), hashed passwords, access controls, and secrets stored outside the public web root. No system is ever completely secure, but we work hard to keep your data safe and will notify you and the ICO of any qualifying breach as required by law.
11. Children
Tags for children are set up and managed by a parent or guardian, who provides and controls the information shown. ScanTags accounts are intended for adults (16+). We do not knowingly collect data directly from children.
12. Changes to this policy
We may update this policy from time to time. We'll change the "last updated" date above and, for significant changes, let you know.
Questions? Email hi@scantags.io and a real person will help.
