Privacy Policy

1. Who is responsible

Scan2Tip (Pty) Ltd (registration number 2026/550067/07), Durbanville, Cape Town, South Africa (“Scan2Tip”, “we”) is the responsible party for personal information processed through scan2tip.net, under the Protection of Personal Information Act, 2013 (POPIA). You can reach our Information Officer at support@scan2tip.net.

2. Guests who tip

When you tip through a Scan2Tip QR code we process:

• the tip amount, the staff member you tipped, and the date and time;
• your name and email address, only if you choose to give them;
• the payment reference, status and payment method type (for example “card” or “EFT”) that Paystack returns to us.

Your card number, expiry date and CVV are entered on Paystack’s secure checkout and never reach Scan2Tip. If you give your name, the staff member you tipped can see it on their dashboard.

3. Staff

For staff accounts we process your name, phone number, login email address, the venue you work at, your acceptance of our Terms of Service, your tip records, and for your payout account the account holder name, bank name, last four digits of the account number and Paystack subaccount reference. Your full account number goes to Paystack and is not stored by Scan2Tip. We may also process documents you give us to verify your identity or employment.

4. Venues

For venue accounts we process the venue’s name, type and address, and the name, phone number and login email of the person who manages the account.

When a staff member asks to join a venue, the venue’s owner and managers can see that staff member’s name, phone number, whether their QR code is live, and the number and amounts of tips they receive at that venue while they belong to it. Venues never see bank details or a guest’s card details, and never see tips a staff member receives elsewhere. Guests using a venue’s table QR code see the first and last names of the staff who are live there.

5. Why we use it

• To process tips and have Paystack pay staff their share.
• To review staff accounts and to prevent, detect and investigate fraud and misuse.
• To handle refund requests, disputes and support questions.
• To keep the financial records the law requires.

We process this information because it is needed to perform our agreement with you, to comply with the law, or for our legitimate interest in running a safe payment service. We do not use it for marketing without your consent, and we do not sell it.

6. Who we share it with

• Your venue, if you are staff who has joined one, as described in section 4.
• Paystack, which processes payments and payouts and is responsible for card and bank data under its own privacy policy.
• Service providers that host our website and database (Netlify and Supabase), and the service that draws staff QR code images, which receives only the staff member’s tip link. These providers may store information outside South Africa; we use them only on terms that protect it to a standard comparable to POPIA.
• Authorities, where the law requires it, or to report suspected fraud.

7. How long we keep it

We keep tip and payout records for as long as the law requires financial records to be kept (generally at least five years), and staff account information for as long as the account is open and for that period afterwards. Information we no longer need is deleted or de-identified.

8. Security

Access to our database is restricted to the people and systems that need it, connections are encrypted, and payment details are handled by Paystack, a PCI-DSS compliant payment provider. No system is perfectly secure; if a breach affects your information we will notify you and the Information Regulator as POPIA requires.

9. Cookies and storage

We use only the browser storage needed to keep staff signed in. We do not use advertising or cross-site tracking cookies. Paystack’s checkout may set its own cookies to process payments securely.

10. Your rights

You may ask us to confirm what personal information we hold about you, to correct or delete it, or object to how we use it, by emailing support@scan2tip.net. Some records must be kept by law even if you ask us to delete them. If you are unhappy with how we handle your information you may complain to the Information Regulator of South Africa (inforegulator.org.za).

11. Changes

We may update this policy. The version and date at the top will change, and material changes will be shown on this page before they take effect.