Privacy Policy

wscanner is operated by Fahim Muktadir Mahbub, 7705 112 St, Delta, BC V4C 4V9.

The person accountable for personal information here is Fahim Muktadir Mahbub, Privacy Officer. Reach them at support@wscanner.ca or +1 647 858 6669.

We serve two groups: businesses who run a loyalty program with us, and their customers who collect stamps. This policy covers both.

From a business owner, when you create an account:

• Email address and password (the password is stored only as a secure hash)
• Business name, category, logo, phone, address, opening hours
• Optional store location coordinates, if you choose to enable scan verification
• Billing details, handled by Stripe — we never see or store your card number

From a customer, when they join a loyalty card:

• Name, and phone number or email — whatever the business asks for
• Stamp and reward history for that business
• Approximate location at the moment of a scan, only if the business has turned on location verification, and only to check the scan happened at the store. We do not keep a location trail.
• A device identifier stored in your browser so your card is recognised on your next visit
• Basic technical data your browser sends with every request — IP address, browser and device type — which our hosting and database providers log to keep the service running and to block abuse such as someone farming stamps

We never receive your card number. Payment details are entered on Stripe's own checkout page and held by Stripe.

To run the service you asked for: keeping stamp counts, issuing rewards, showing a business its own analytics, taking subscription payments, and answering support messages. We do not sell personal information, and we do not use it for advertising.

Data is held in Supabase (PostgreSQL) in the Canada Central region. Access is restricted per business by row-level security, so one business can never read another's customers.

We share data only with the providers that make the service work:

• Supabase — database, authentication and file storage
• Stripe — subscription payments
• Vercel — application hosting
• Resend — transactional email

Some of these process data outside Canada, which means it may be subject to the laws of those countries.

Business account data is kept while the account is active and for up to 90 days after closure, so it can be restored if you change your mind. Customer stamp records are kept while the business's program runs, or until the business or the customer asks us to delete them. Records we must keep for tax or accounting are held as long as the law requires.

Under PIPEDA you may ask us to:

• Tell you what personal information we hold about you
• Correct anything inaccurate
• Delete your information, where we are not required to keep it
• Give you a copy in a portable format
• Withdraw consent, which may mean we can no longer provide the service

Email support@wscanner.ca and we'll respond within 30 days. Business owners can also export their customer list from the dashboard at any time.

If you are a customer of a business using our platform, that business decides what to collect and how to use it. Ask them first; we will help them act on your request.

Traffic is encrypted in transit (HTTPS), passwords are hashed, and access to customer data is scoped to the owning business at the database level. No system is perfectly secure, but if a breach ever puts you at real risk of significant harm we will notify you and the Privacy Commissioner of Canada as PIPEDA requires.

We use only what the service needs: a session cookie to keep you signed in, and a local identifier so a customer's loyalty card is remembered on their device. No advertising or third-party tracking cookies.

The service is intended for businesses and adult customers. We do not knowingly collect information from children under 13. If you believe we have, contact us and we will delete it.

If we change this policy we will update the date above, and tell account holders by email when the change is significant.