Privacy policy

SoSo Social EOOD is the controller of the personal data described here. Contact us about privacy at any time:

When you use your account

• Your email address, and your name and picture if you sign in with Google.
• Sign-in records: when you signed in, your IP address and browser, kept to secure your account.
• Your codes and what is in them: links, files and images you upload, contact details for a business card page, designs and settings.

When you pay

• Dodo Payments handles the payment. We receive your email, country, plan, amounts, payment status and invoice links. We never see or store your full card number.

When someone scans a code

• The time of the scan, an approximate location (country, region and city) and the device type, operating system and browser.
• We use the IP address only for a moment to work out the location and to count unique scanners. We never store IP addresses. We keep a one-way hash of the IP address mixed with a secret that changes every day, so the same phone is counted once per day and cannot be traced back.
• Scan pages set no cookies and load no third-party trackers.

When you contact us

• Your name, email and message, for example in the cancellation form or an email to support.

When you visit the website

• Usage analytics with PostHog (servers in the EU): pages viewed and steps such as choosing a code type or opening checkout. PostHog runs in cookieless mode on our site: nothing is stored on your device, and we have asked PostHog to discard IP addresses.
• Server logs with IP addresses, kept for a short time to keep the service secure.

• To provide the service you signed up for (contract): your account, codes, hosted pages, scan statistics, billing and support.
• To keep the service safe (legitimate interest): stopping phishing and abuse, securing accounts, fixing errors.
• To improve the product (legitimate interest): cookieless, aggregated usage analytics.
• To meet legal duties (legal obligation): tax and accounting records, answering lawful requests.
• Emails: we send emails you need (sign-in links, receipts, account and billing notices). We do not send marketing emails without your consent.

We do not sell personal data. We share it only with providers that help us run the service:

• Dodo Payments: payments, taxes, receipts and invoices, as merchant of record. Their privacy policy applies to the payment.
• Hetzner: our servers and database, in Germany.
• Resend: sending our emails.
• PostHog (EU cloud): website analytics.
• Cloudflare: network security and protection against attacks.
• Google: only if you choose to sign in with Google.

We may also share data when the law requires it, to protect people from fraud or harm, or with a company that takes over the service (which must keep this policy).

Our servers and database are in Germany, in the EU. Some providers above may process data in other countries, such as the United States. When they do, they use safeguards approved by the EU, such as the Standard Contractual Clauses.

• Account data, codes and their scan statistics: while your account exists. When you delete your account, we delete them within 30 days.
• Payment and invoice records: as long as tax and accounting laws require (in Bulgaria, up to 10 years).
• Cancellation requests and support emails: up to 3 years, to answer billing questions and disputes.
• Server logs: up to 30 days.
• Backups are encrypted and replaced on a rolling basis.

You can ask us for a copy of your data, to correct it, to delete it, to limit or object to how we use it, or to receive it in a portable format. Email [email protected] from your account address. We answer within one month.

If you think we got something wrong, please tell us first. You can also complain to the Bulgarian Commission for Personal Data Protection (cpdp.bg) or the data protection authority where you live.

If you scanned a code made by one of our customers and have a question about it, contact the owner of the code. We can help forward your request.

We use encrypted connections, sign-in links instead of passwords, limited staff access, encrypted backups and checks on uploaded files. No system is perfect: if a breach affects your data, we will tell you and the authorities as the law requires.

The service is for adults. We do not knowingly collect data from children. If you think a child has an account, tell us and we will delete it.

We only use cookies the site needs to work, such as keeping you signed in. Details are in our cookie notice.

We may update this policy. For important changes we email you before they apply. The date at the top shows the latest version.