Privacy Policy

Last updated: 4 June 2026

1. Who we are

PandaScan is a business based in England and Wales. We are the data controller for personal data processed through this website and service.

Contact: hello@pandascan.co.uk
Website: pandascan.co.uk

2. What data we collect and why

Account holders (parents / guardians)

• Email address — to create your account, send scan alert emails, and for account recovery. Legal basis: contract performance.
• Item names and icons — to identify your belongings on the dashboard and in notifications. Legal basis: contract performance.
• Optional return incentive — if you choose to set a finder's reward, the amount and any note you add are stored and shown to finders. Legal basis: contract performance / legitimate interest.
• Push notification subscription — if you enable push alerts, we store the browser endpoint and encryption keys required to deliver notifications. No personally identifiable data is held in this record beyond your user ID. Legal basis: consent.

Finders (anyone who scans a tag)

• No account or personal details are required from finders. Finders interact with PandaScan anonymously.
• Scan record — we log the time the tag was scanned, the location description and bin colour entered by the finder, any optional note or photo they upload, and (for school staff) the school name. This is attached to the tag record and shared only with the item owner. Legal basis: legitimate interest (reuniting lost property).
• Photos — finder-uploaded photos are stored in Supabase Storage (EU region). They are accessible only via a time-limited signed URL and are not indexed or shared with third parties.

School staff accounts

• School accounts are subject to the same data practices as parent accounts above.
• Scans made by school staff record the school name, which is included in the notification sent to the item owner.
• We are aware of the UK Children's Code (Age Appropriate Design Code) and take care not to collect unnecessary data relating to children. We do not create profiles of children; item records contain only a name and icon chosen by the parent.

3. How we use your data

• To operate the PandaScan service — tagging, scanning, and notification features.
• To send transactional emails (scan alerts, account emails). We do not send marketing emails without separate consent.
• To deliver push notifications when a tag is scanned, if you have opted in.
• To display your item names and scan history on your dashboard.
• We do not sell, rent, or share your data with third parties for their own commercial purposes.

4. Third-party processors

We use the following sub-processors to operate the service. All handle data under appropriate data processing agreements:

• Supabase Inc. (database and file storage) — data stored in EU-West region (Dublin). Privacy policy.
• Vercel Inc. (website hosting and serverless functions) — EU edge locations used where possible. Privacy policy.
• Resend Inc. (transactional email delivery) — Privacy policy.
• Browser push services — push notifications are routed via your browser vendor's push service (e.g. FCM for Chrome, APNS-Web for Safari). These services receive only the encrypted notification payload and your browser's push endpoint.

5. Data retention

• Account data is retained for as long as your account is active. You may delete your account at any time by emailing hello@pandascan.co.uk.
• Scan records are retained until the associated item or account is deleted.
• Photos uploaded by finders are retained for 90 days, after which they are automatically deleted.
• Push subscriptions are deleted automatically when the browser reports them as expired, or when you revoke notification permission in your browser.

6. Cookies and tracking

PandaScan uses only functional cookies required to keep you logged in (an authentication session cookie set by Supabase). We do not use advertising cookies, tracking pixels, or analytics third parties that profile you across sites.

7. Your rights under UK GDPR

You have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate data — most data is editable directly in your dashboard.
• Erase your data ("right to be forgotten") — request deletion by emailing us.
• Object to processing based on legitimate interest.
• Withdraw consent at any time for processing based on consent (e.g. push notifications — revoke via your browser settings).
• Portability — request a copy of your data in machine-readable format.
• Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.

To exercise any of these rights, email hello@pandascan.co.uk. We will respond within 30 days.

8. Data security

All data is transmitted over HTTPS/TLS. Database access is restricted by row-level security policies — each user can only read and modify their own records. Photos are stored in a private bucket accessible only via time-limited signed URLs. We use industry-standard authentication (bcrypt password hashing via Supabase Auth).

9. Children's data

PandaScan is a service for parents, guardians, and school staff — not for children to use directly. Accounts must be created by adults. We do not knowingly collect personal data from children under 13. If you believe a child has created an account without parental consent, please contact us and we will delete the account promptly.

Item records may contain a child's first name and an icon (selected by the parent). This minimal information is stored solely to identify a child's belongings in the event they are lost. We do not use this information for profiling or marketing.

10. International transfers

Your data is primarily stored in EU data centres. Some sub-processors (Vercel, Resend) may process data in the United States. Where this occurs, transfers are covered by Standard Contractual Clauses (SCCs) or an equivalent UK adequacy mechanism.

11. Changes to this policy

We may update this policy from time to time. Material changes will be notified by email to registered users at least 14 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.

Contact us

For any privacy-related questions or to exercise your rights, please email hello@pandascan.co.uk.