Privacy policy

When you send a plan request

The request form asks for your name, email address and WhatsApp number with country code; a notice under the Send button explains that these details are emailed to our team so it can contact you on WhatsApp. The device and message fields are optional. The selected plan duration and its USD total are added by the site. The form never asks for card, bank or password details, and no payment is taken on the site.

Your request is checked by our server and emailed to the ScanFlick team's support inboxes. A plain-text acknowledgment is sent to the email address you entered. The team then confirms your request manually on WhatsApp.

The request server does not keep a database of requests. To prevent abuse, it keeps short-lived counters in memory based on your IP address and email address (for example, at most five requests per 15 minutes). Its service log records only the request reference and whether the emails were accepted, not your details.

Visit alerts

When you open the Home, USA or Canada page, the ScanFlick team receives one private Telegram alert per browsing session (a tab session expires after 30 minutes without navigation). We use these alerts to understand where visitors come from and to improve our ads. Known search-engine robots and automated browsers are excluded. Visits from hosting or VPN networks (often used by automated link scanners) are only reported once you interact with the page, for example by opening a review screenshot, choosing a plan, starting the request form or tapping WhatsApp. Telegram is a third-party service.

An alert can include: your IP address; the approximate location estimated from it (country, region and city) and your internet provider; device and browser details (operating-system and browser versions, and the device model when your browser shares it); screen size; language; timezone; the entry page; the server time (UTC) and your local time; a referring-source category; the campaign tags of the link you came from (utm_source, utm_medium, utm_campaign, utm_term, utm_content); and whether you arrived from a Google Ads click, without the click ID. The same alert details, together with the visit summary described below, are also kept on our server for up to 30 days so the ScanFlick team can review recent visits on a private page; they are then deleted automatically, and they are removed at once if an opt-out or privacy signal is received during the visit.

Alerts never include your name, email, phone number or anything typed in the request form, and never include passwords, full referring URLs, URL fragments, advertising click-ID values or precise GPS location. Location is looked up on our own server in the DB-IP Lite database; your IP address is not sent to DB-IP. IP-based location is approximate and may be wrong with a VPN or mobile network.

For the same browsing session, a follow-up alert may summarise your visit so we can see where our pages are unclear: the ScanFlick pages you opened, how far you scrolled the first page, the time spent on the site, and which request steps you reached (plans and reviews seen, plan chosen, request form started, the names of fields that showed an error, request sent or failed, WhatsApp button used). It never contains what you typed. It is sent from your browser when you leave or switch tabs, is limited to a few updates per session, and follows the same opt-out and privacy signals. Our server also adds these steps to anonymous daily totals per traffic source (for example Google, Google Ads or email): counts only, such as how many visits chose a plan or started the form, and how many arrived on each of our three main pages, at each hour of the day, from the United States, Canada, Morocco or elsewhere, and on a phone, tablet or computer. These totals contain no session ID, IP address, city, device model, page address or anything you typed; only the ScanFlick team can view them, on a private page. They are kept for up to 120 days.

ScanFlick is available only in the United States, Canada and Morocco. When a request comes from another country, our server answers with a "not available in your country" page and keeps a short technical record of that request for up to 30 days, for security and so the ScanFlick team can see on its private page where refused visits come from: the time, the IP address and the country estimated from it, the page requested (without its query string), the request method and the browser identification. The private page also estimates the city and internet provider from the same local DB-IP Lite database. These records are deleted automatically and are never sent to Telegram.

• Opt out at any time: use the Privacy button at the bottom of any page and choose "Turn off visit alerts". Your choice is saved in this browser for 365 days.
• Global Privacy Control and Do Not Track signals are honoured automatically as an opt-out.
• Turning alerts off prevents future alerts; an alert already sent cannot be recalled. Plan buttons, the request form and WhatsApp work either way.

Google tag (advertising measurement)

Every page loads the Google tag for Google Ads. Google may use cookies or similar identifiers to measure ad performance and, when configured, to count a request that was accepted by our server as a conversion. Google processes this information under its own policies. The visit-alert opt-out does not control the Google tag.

• How Google uses information from sites that use its services: policies.google.com/technologies/partner-sites
• Manage personalised ads: myadcenter.google.com, or block third-party cookies in your browser settings.

WhatsApp handoff

After an accepted request, the Thank You page prepares a WhatsApp message with your first name, request reference and selected plan. Nothing is sent until you press Send in WhatsApp yourself. WhatsApp is operated by WhatsApp LLC (Meta) under its own privacy policy. Messages you send on WhatsApp stay in our team's WhatsApp account.

Your subscription

When you subscribe, we create your line in our service provider's reseller panel and keep a private subscription record on our server so we can activate, renew and support it: the name or label you gave us, your WhatsApp number, the device MAC address and Device Key if you send them for app setup, your line's login details, plan, expiry date and the activation and renewal steps. The reseller panel also holds your line, its device MAC address if any and the name we note on it. Only the ScanFlick team can see these records.

We use your WhatsApp number to send your login details and, around the end of your subscription, a renewal reminder. Each message is sent by a team member from our WhatsApp account; nothing is sent automatically. A private reminder listing subscriptions that end soon is sent to our team's Telegram chat. Tell us on WhatsApp if you do not want renewal reminders.

What the site stores in your browser

The site does not set its own cookies. It uses browser storage only for these functions:

• A minimal request receipt (reference, plan and acknowledgment status) for the Thank You page, in this tab only, for up to 24 hours.
• Your first name for the prepared WhatsApp message, in this tab only, for up to 10 minutes.
• A one-time flag so WhatsApp opens only once after a request, in this tab only.
• Your visit-alert opt-out, if you choose it, for 365 days.
• A random tab session ID that prevents duplicate visit alerts, expiring after 30 minutes without navigation.
• The visit-summary steps described above (pages and request steps reached, never what you type), in this tab only; cleared when you turn visit alerts off.
• A one-time flag so a request is counted at most once for advertising measurement, in this tab only.

Web server logs

Like most websites, our web server keeps technical access logs (IP address, requested page, browser type and time) for security and troubleshooting. They are rotated automatically and kept for a short period.

To stop abusive robots, a device that loads pages far faster than a person can, or that opens a hidden link that only robots follow, has its IP address, the requested page, browser type and time written to a separate security log and may be blocked from this site for 1 day to 5 weeks. Search engines that respect robots.txt are not affected. Block records are kept for up to 6 weeks.

Promotional e-mails

We may occasionally send a promotional e-mail about ScanFlick plans (plain text with an HTML version) to people who have bought from us before (including on a website we previously operated) or who asked to receive our offers. Each one is labeled as an advertisement, says why you are receiving it and includes our postal address.

Every promotional e-mail has an unsubscribe link, and you can also reply "unsubscribe" or write to support.scanflick@gmail.com. The link works immediately; replies are handled within 10 business days at the latest. Our unsubscribe list stores only a coded identifier, not your e-mail address, and the unsubscribe page loads no tracking or advertising scripts. These e-mails contain no tracking pixel and load no remote images; their site link only carries a campaign name so we can count visits that came from the e-mail.

How long we keep data, and your choices

Request emails stay in our support mailbox, subscription records stay on our server and visit alerts stay in our private Telegram chat until we no longer need them to handle requests, support and advertising, or until you ask us to delete them. We do not sell your personal information.

You can ask to access, correct or delete the request details, subscription record or alerts we hold about you by emailing support.scanflick@gmail.com or messaging us on WhatsApp. Depending on where you live, for example in Canada or California, local law may give you additional rights.

Changes to this policy

We update this page when the way the site handles information changes. The date at the top shows the latest version.