Privacy policy
Last updated: 1 November 2026
H-Scan (hscan.site) is a service that event organisers use to send invitations with personal QR codes and to check guests in at the entrance. This page explains, in plain language, what personal data H-Scan holds, why, who it is shared with, and how you can have it removed.
Who is responsible for your data
If you are a guest: the event organiser who invited you decides who is invited and gave us your details. They are responsible for your data, and H-Scan handles it on their behalf, only to run their event. If you have questions about why you were invited, please contact the organiser.
If you are an organiser or check-in staff member: H-Scan is responsible for your account data.
What we hold
About guests, as provided by the organiser:
- Name, phone number and email address
- Ticket details such as ticket ID, ticket type, seat or section, and any extra fields the organiser adds
- The delivery status of your invitation by WhatsApp or email (for example sent, delivered, read or failed)
- Your check-in: the time, the entrance (gate), the staff member, the result of the scan, and whether it was scanned or checked in by hand
About organisers and staff:
- Name, email address, phone number (if given), role and company
- Your password, which is stored only in scrambled (hashed) form that no one can read
- A log of actions in the system, such as scans, check-ins and changes, for security and support
Why we use it
- To send your invitation and personal QR code by WhatsApp or email
- To check you in at the entrance and stop the same invitation being used twice
- To give the organiser the guest list and an attendance report for their event
- To keep the service secure and to help when something goes wrong
We do not sell personal data, use it for advertising, or send marketing messages. Messages are only sent about the event you were invited to.
Who it is shared with
Each organiser sees only their own events and guests. To run the service we use these providers, who process data only on our instructions:
- Supabase: database and logins (hosted in the EU, Frankfurt)
- Vercel: hosting of the website
- Resend: sending invitation emails
- Meta (WhatsApp): sending invitation messages on WhatsApp
Some of these providers may process data outside Egypt. We will not share personal data with anyone else unless the law requires it.
How long we keep it
Guest data is kept for as long as the organiser needs it for their event and its attendance report. When an organiser deletes an event, its guest list, tickets and check-in records are deleted with it. You can also ask us to delete your data at any time (see below). Account data is kept while the account is active and deleted when the account is removed. A separate security log of actions (which can include a guest's name or a staff member's email) is kept to investigate problems and misuse; we remove entries about you from it on request.
Security
Data is sent over encrypted connections (HTTPS). Every invitation link and QR code is unique and can only be used once at the entrance. Access is limited by role, and each company can only see its own events.
Cookies and storage
Guests don't need an account, and the invitation page doesn't use tracking cookies. Signed-in organisers and staff have their login kept in their browser's storage so they stay signed in. We do not use analytics or advertising trackers.
Your rights and data deletion
You can ask to see the personal data we hold about you, to correct it, or to have it deleted. You can also ask us to stop sending you messages. Email support@hscan.site from the email address or with the phone number we hold, and say which event it concerns if you know. We confirm and complete deletion within 30 days. Guests can also ask the event organiser who invited them.
Changes to this policy
If we change this policy, we will update this page and the date at the top.
Contact
Questions about this policy or your data: support@hscan.site