Privacy policy
The plain-English version of how we handle your data.
Who we are
Scan That Stay is a trading name of That Group Company Ltd, registered in England and Wales (company number 15564505). We're the data controller for the personal data described on this page. You can reach us about anything privacy-related at hello [at] thatgroupco [dot] com.
If you're a guest scanning a code
This is the short section, because there's almost nothing to say. Guests don't create accounts, don't sign in, and don't give us any personal details.
We process your IP address and basic technical details of the request to serve the page and keep our service secure. We don't use that to identify or profile you. If a host has added a map to their page and you open it, your browser loads the map imagery directly from Mapbox, which means Mapbox receives the standard technical details of that request (such as your IP address). Directions links open in your own maps app or site, outside our service.
If you're a host
We collect the minimum we need to run your account:
- Account details - your email address and a password (stored securely).
- Your property pages - whatever you write for guests: wifi details, house notes, local tips, place locations. You control all of it and can edit or archive it anytime.
- Billing records - your subscription status and history. Payments are processed by Stripe: your card details go directly to Stripe and never touch our servers. We store only Stripe's reference IDs and your subscription state.
Why we use it
- To provide the service (performance of a contract) - signing you in, publishing your pages, serving them to guests, and billing you £6 a month per property.
- To keep the service secure and working (legitimate interests) - operational logs, abuse prevention, sharing guide page analytics, and fixing things when they break.
- To meet legal obligations - keeping billing and tax records for as long as the law requires.
Where your data lives
Your account and property data is stored in Europe (Ireland). Payment data is held by Stripe under their own privacy policy. We don't transfer your data outside the UK and EEA except where a processor does so under UK GDPR-compliant safeguards.
Third parties we rely on
- Cloudflare - DNS, domain services.
- Amazon Web Services - hosting, database, sign-in, and service emails.
- Stripe - payment processing, receipts, and the billing portal.
- Mapbox - map imagery, only on pages where a host has added a map.
Each acts as a processor (or, for Stripe's payment processing, its own controller) under its own agreements. That's the whole list.
How long we keep it
We keep your account and property data while you have an account. If you cancel, your pages are paused rather than deleted - printed QR codes keep resolving to a polite "paused" page, your billing history stays intact, and everything is waiting if you come back. When you archive something in the dashboard, it's archived, not destroyed, so you can restore it.
If you want your personal data fully erased, ask us at hello [at] thatgroupco [dot] com and we'll do it, keeping only what the law requires us to keep (such as billing records for tax purposes).
Your rights
Under UK GDPR you can ask us to:
- show you the personal data we hold about you (access);
- correct it (rectification);
- erase it (as above);
- restrict or object to how we use it;
- give it to you in a portable format.
Email us and we'll sort it - no forms, no fee. If you're not happy with how we handle your data, you also have the right to complain to the UK's data protection regulator.
Changes and contact
If we change this policy in any meaningful way, we'll update this page and the date at the top. Questions? Email hello [at] thatgroupco [dot] com.