Privacy policy

1. Controller

Clexa GmbH, Friedrich-Ebert-Straße 31, 92421 Schwandorf, Germany, is responsible for Skanna under data protection law. Contact: privacy@useskanna.com.

2. Data we process

Accounts and workspaces

Name, email address, password hash, authentication sessions, workspace membership and security events. We never store the plain-text password.

Codes and content

Code names, destinations, folders, routing choices, hosted pages, uploaded files, locations, team invitations and the settings you choose.

Scan and tap analytics

For editable links we may record the time, approximate country and city, device and operating-system category, language, referrer, destination, touchpoint and a shortened pseudonymous visitor hash. The raw internet address used to calculate that hash is not stored in the scan record. Static codes go directly to their destination, so Skanna cannot record those scans.

Billing and support

Stripe customer and subscription references, plan status, pilot requests, support messages, cancellation requests and abuse reports. Payment-card details are entered directly into Stripe and are not stored by Skanna.

Technical operation

Hosting providers process request, security and error logs needed to deliver and protect the service.

3. Why we process data

• To provide accounts, redirects, analytics, hosted pages, exports and billing under Article 6(1)(b) GDPR.
• To protect users, investigate abuse, secure the service and improve reliability under Article 6(1)(f) GDPR.
• To keep invoices and comply with legal duties under Article 6(1)(c) GDPR.
• Where a future optional feature requires consent, under Article 6(1)(a) GDPR. No advertising or optional analytics cookies are currently used.

4. Service providers

We use providers only where needed to operate Skanna:

• Vercel for website hosting and application functions.
• Railway for the PostgreSQL database, configured in its European region.
• Stripe for checkout, subscriptions, invoices and payment security.
• Vercel Blob for customer-uploaded files.
• Checkly for automated availability monitoring.
• Strato for product email addresses.

Providers act under their own legal obligations or a data-processing agreement, depending on the service.

5. International transfers

Some providers are headquartered outside the European Economic Area. Where data is accessed from a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission’s standard contractual clauses or an applicable adequacy framework.

6. Retention

Account, workspace and code data is kept while the service is used and then removed or anonymised after a verified deletion request, except where law requires retention. Customers can delete or replace individual content and export workspace data. Scan records remain until the workspace owner deletes them or requests deletion. Billing records are retained for statutory accounting periods. Legal requests may be retained for up to three years to document their handling. Provider logs and backups expire according to their security and backup cycles.

7. Your rights

Depending on the circumstances, you can request access, correction, deletion, restriction, portability or object to processing. You can withdraw consent at any time where consent is the legal basis. You may also complain to a data protection supervisory authority.

Email privacy@useskanna.com. We may ask for information necessary to verify your identity and protect the account.

8. Recipients and public content

We do not sell personal data. Workspace owners decide what destinations and hosted-page content they publish. Anyone with a published link may be able to view that content, and an external destination processes visitors under its own policy.

9. Children

Skanna accounts are intended for adults and people authorised to act for a business or organisation. We do not knowingly offer accounts to children.

10. Changes

We will update the date and publish a revised policy here when processing materially changes. Where required, account holders will receive an additional notice.