Privacy Policy

01People who scan a code

Scanning a Static Code never reaches us — the phone reads the data straight from the code.

Scanning a Dynamic Code passes through our redirect service, which records a scan event for the code’s owner:

• the time of the scan and which code and short link were used
• the approximate country and city, taken from the network location at our edge provider
• the device type, operating system and browser, read from the browser’s user agent
• a visitor hash — a SHA-256 hash of the IP address, the user agent and a salt that changes every day — used only to count unique devices
• whether the request looks like a bot or a link preview
• only on a code whose owner turned on tags, location or an area limit, and only if you agree at the banner: which choices you made (no name and no identifier), and your position rounded to about 100 metres with its approximate accuracy

We do not store scanners’ IP addresses, and because the salt changes daily the visitor hash cannot be used to follow a device from one day to the next. Redirects and Hosted Pages set no cookies, except the one that remembers your answer on a code that asks for consent (see the Cookie Policy).

The code’s owner decides what the code is for; for these scan events they are the controller and we process the data on their behalf. Forms on Hosted Pages send what you type to the code’s owner.

A code’s owner can also install the Dotwick conversion pixel on their own website, to see which scans led to a visit or an order. The pixel runs on their site, so they are the controller and we process the data for them. By default it does nothing until you agree: it sets no cookie and sends nothing. If the owner has turned that default off, they are telling us they have another legal basis. A Global Privacy Control signal is always treated as a refusal, and refusing deletes the cookie. If the pixel runs, it:

• keeps one first-party cookie (_dw_sid) on the owner’s own domain, holding only a signed identifier from your scan, for the attribution window the owner chose (1 to 90 days, 30 by default)
• reports a visit, and a conversion with its event name, an order value and currency and an order number, together with the address of the page reduced to its host and path (the query string is dropped)
• counts visitors with the same daily-salted hash and bot flag as scan events

The pixel collects no names, email addresses, phone numbers or postal addresses, and the service refuses them in every field. It uses no fingerprinting, no identifier that follows you across sites and no storage other than that one cookie, and no cookie is set by a third-party domain. We do not store the IP address. Conversion data is kept as long as the plan keeps scan events.

02Account holders

• account details: email address, name, profile picture if you sign in with Google, time zone
• sign-in and security: active sessions with the IP address and browser they came from (so you can review and end them), two-factor settings, sign-in codes while they are valid
• Workspace content: codes, destinations, designs, uploaded logos and files, Hosted Page content, folders and member roles
• billing: plan, invoices and the customer record at our payment provider — card numbers stay with the payment provider
• an audit log of important changes in your Workspace, kept to protect you and us
• business cards: a card’s details, which its holder and your admins can change, and the details visitors choose to share through its lead form (a name, an email address and whatever else they add after ticking the consent line)
• the devices you sign in to the mobile app or the browser extension with: the device name and, if you allow notifications, its push token
• merch orders: what you ordered and the shipping address
• messages you send to support

03Why we use it

• to provide the service you signed up for: sign-in, codes, redirects, Hosted Pages, analytics and exports (contract)
• to keep the service and your account secure, and to stop abuse such as phishing codes (legitimate interests)
• to send the emails the service needs — sign-in links and codes, invitations, export links, reports you turn on (contract)
• to meet legal and tax obligations, for example keeping invoices (legal obligation)

We do not sell personal data, and we do not use scan data for advertising.

04How long we keep it

Scan retention is fixed when each scan is recorded and is not extended retroactively on upgrade. Deleted data is removed from backups when those backups expire.

05Who processes it for us

We use these providers to run Dotwick. Each one only gets the data it needs for its job, under a contract that requires it to protect it.

Email is sent only through Resend. We update this list before we add a provider, and give a workspace’s owners 30 days’ notice by email.

The AI features send Anthropic only public text, design choices and counts: the title and description of a website you ask us to read, the colours we found on it, the catalogue ids of a design, what you type into an AI prompt (after email addresses, phone numbers, long numbers and the query part of web addresses are removed, and cut to 1,000 characters), and, for the analytics assistant, scan totals by day and by country, device or source with your codes replaced by labels such as C1 and C2. They never send names, email addresses, workspace names, code names or addresses, IP addresses, single scans, locations or the content of a code, and our logs record the feature, the model and the size of a call, never what was sent or returned. Anthropic does not use this input to train its models.

Tags and destinations you set up yourself, such as Google Analytics, Meta, TikTok, LinkedIn, Zapier, Make or HubSpot, are not our sub-processors: you choose to send your data there, and they act for you.

06International transfers

Our hosting, file and backup storage, email and error reports are in the EU. Cloudflare and Vercel also serve requests from edge locations around the world, where only the request itself passes through. Some providers process data in the United States: Google, Stripe, Google Web Risk, Anthropic and GitHub. Transfers to them rely on the European Commission’s Standard Contractual Clauses (SCCs), which cover each of these providers, or an equivalent safeguard.

07Your rights

Depending on where you live, you can ask to access, correct, export or delete your personal data, to restrict or object to how we use it, and to withdraw consent you have given.

You can export codes and scan history from the app. Self-service account export and deletion are coming; until then, write to privacy@dotwick.com and we will do it within 30 days.

If you scanned someone else’s code, the code’s owner controls that data; we will pass your request on to them and help them answer it.

You can also complain to your local data protection authority.

08Security

Traffic is encrypted in transit, data at rest is encrypted by our hosting providers, staff access is limited and logged, and accounts can use two-factor authentication.

09Children

Dotwick accounts are not for people under 16, and we do not knowingly collect their data.

10Changes and contact

We will post changes here and email account holders about material ones. Questions: privacy@dotwick.com. Controller: DOTWICK INC, 1337 Industrial Drive, Itasca, IL 60143, USA.