Legal
Privacy Policy
Last updated: 2026-11-05
The short version. We collect only what we need to run this website, answer you, and check whether a product is genuine. Verifying a product does not need an account. When you scan, we use your location, a random device identifier and basic technical data to spot copied codes. We do not sell personal data, and we never write shoppers' personal data to the blockchain.
1. Who we are
This policy covers the LedgerScan website at led-scan.com and the LedgerScan product verification service (the web app, the mobile scanning page and the manufacturer dashboard). LedgerScan is operated by Ledgercross LLC, a Wyoming limited liability company (USA). In this policy, "LedgerScan", "we" and "us" mean Ledgercross LLC.
For personal data collected through this website and for account holders, we decide how and why the data is used (we are the "controller"). When we process scan data on behalf of a manufacturer or brand that uses LedgerScan, that customer may be the controller and we act on its instructions under our agreement with it; in that case you can also contact that brand directly.
To reach us about privacy, use the contact form on our home page and say that your message is a privacy request.
2. What we collect and why
When you visit this website
- Usage and device data collected by analytics tools: pages viewed, clicks and scrolling, the interactions you have with the page (for example playing the product film or using the demo), approximate location derived from your IP address, browser and device type, and referring site. We use Google Analytics 4 and Microsoft Clarity. Clarity can record how a session moves through the page (mouse movement, scrolling and clicks) so we can see where the page is confusing. These tools use cookies or similar technologies.
- Server logs kept by our hosting providers, such as IP address, time of request and the page requested, used to keep the site running and secure.
When you contact us or book a call
- Your work email address, and anything else you choose to tell us, so we can reply and arrange a demo or pilot.
- If you use a booking link, the scheduling provider collects the details you enter (such as name, email and chosen time) and shares them with us so we can hold the meeting.
When you verify a product
Shoppers and supply-chain staff verify a product in the browser, without an account. Each scan sends:
- The product code you scanned or typed in.
- Your device's location (GPS coordinates), which your browser asks your permission to share. A scan from a place the product was never shipped to is one of the signals of a copied code.
- A random device identifier that the scanning page creates and stores in your browser's local storage. It does not contain your name or contact details; it lets us tell whether the same code is being scanned on many different devices.
- Technical data: IP address, browser user-agent and the time of the scan.
We use this to produce a verdict (for example Trusted or Unsafe) and a risk score, to detect and block counterfeit codes, and to show the brand that owns the product where and when its products were scanned and where suspected fakes surfaced.
When you use a business account
- Account data for manufacturer, distributor, store and administrator users: name, work email, organisation, role, and sign-in credentials (passwords are handled by our sign-in service and are not visible to our staff).
- Activity data: actions you take in the dashboard, such as registering product batches, binding scanning terminals to locations, and reviewing flagged units, so the audit trail shows who did what.
3. What goes on the blockchain
LedgerScan records product information on a public blockchain (Polygon) so that a product's history cannot be quietly altered. What is written is product data: product and serial identifiers, manufacture date, intended destination, state changes in the supply chain, and the reason a unit was flagged. Shoppers' locations, device identifiers, IP addresses and account details are not written to the blockchain. Records on a public blockchain are permanent and publicly readable, and cannot be deleted by us or anyone else.
4. Our legal bases (EEA and UK visitors)
| Purpose | Legal basis |
|---|---|
| Verifying products, detecting counterfeits and protecting the service | Our legitimate interests, and those of the brands we serve, in preventing counterfeit and unsafe products reaching people. Location is only used if you allow your browser to share it. |
| Providing business accounts and the dashboard | Performance of our contract with your organisation, and our legitimate interest in keeping an accurate audit trail. |
| Replying to enquiries and arranging demos | Our legitimate interest in responding to people who contact us, or steps you ask us to take before entering into a contract. |
| Website analytics (Google Analytics, Microsoft Clarity) | Your consent where the law requires it for these cookies; otherwise our legitimate interest in understanding and improving the website. |
| Security, fraud prevention and legal obligations | Our legitimate interests and compliance with legal obligations. |
5. Who we share data with
We do not sell personal data or share it for advertising. We use service providers who process data for us under contract:
- Supabase: database hosting for product, scan and account records, and for the work email (plus the page, referrer and browser type) you submit through the home-page form.
- Cloud hosting and network providers (such as Render, Vercel and Cloudflare) that run and deliver the website, the app and the API.
- Google (Google Analytics; Google Maps for maps in the app) and Microsoft (Clarity) for analytics and mapping.
- A scheduling provider, if you use a booking link to arrange a call.
Brands that use LedgerScan see scan records for their own products, including the location and time of scans and suspected counterfeits. We may also disclose data if the law requires it or to protect people from harm, for example in a counterfeit investigation.
Some of these providers process data outside your country, including in the United States. Where data protection law requires it, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
6. How long we keep data
- Scan records: for as long as they are needed to keep an accurate authenticity history of the product for the brand that owns it, and to detect repeat use of copied codes.
- Account and activity data: while the account is active, then for as long as needed to meet contractual, audit and legal obligations.
- Enquiries: for as long as needed to handle your request and any follow-up.
- Analytics data: according to the retention settings of Google Analytics and Microsoft Clarity.
Product data written to the blockchain is permanent (see section 3).
7. Your rights
Depending on where you live, you may have the right to: access the personal data we hold about you; have it corrected; have it deleted; restrict or object to how we use it; receive it in a portable format; and withdraw consent at any time where we rely on consent. To use these rights, contact us as described in section 1. We may need to confirm your identity first. If we process the data for a brand, we may pass your request to that brand.
If you are in the EEA or UK, you can also complain to your local data protection authority.
8. Your choices
- You can refuse or revoke location permission in your browser. Some checks then cannot run, and the verdict may be less certain.
- You can clear the device identifier by clearing site data for led-scan.com in your browser.
- You can block or delete analytics cookies in your browser settings, or use Google's opt-out add-on.
9. Security
We use encryption in transit (HTTPS), access controls and role-based permissions for business accounts, and device binding for scanning terminals. No system is perfectly secure, so if you believe your account or data has been put at risk, contact us straight away.
10. Children
LedgerScan is a business service. It is not directed at children, and we do not knowingly collect personal data from children.
11. Changes to this policy
We will update this page when our practices change and revise the date at the top. If a change is significant, we will make it clear on this page or tell account holders directly.