How SheScan handles your data.

SheScan is a barcode-verification service run by The Women's Economy. This policy covers the marketing website shescan.app, the brand kit at shescan.app/kit, the investor gate at shescan.app/investors, the admin dashboard at shescan.app/admin, and the SheScan mobile web app at app.shescan.app. It also covers the SheScan Chrome extension.

From consumers who use the app or extension

When you scan a barcode in the mobile web app or the Chrome extension, we receive:

• The barcode (UPC) you scanned, so we can look it up.
• Your IP address and browser user-agent, standard in every web request; we use these for basic abuse-prevention and troubleshooting.
• The verification result we returned to you, so we can improve coverage over time.

We do not link scans to a personal identity. We do not build a purchase profile about you. We do not sell scan data.

From brands who submit through the intake form

When a brand submits the intake form at shescan.app/#signup, we collect the brand or company name, contact email, website URL, and category, plus any UTM attribution parameters if you arrived from a tagged link. This information is used to verify ownership and, if verified, to list your brand in the SheScan database.

From everyone who visits any page

We use Google Analytics 4 to count pageviews and measure how people use the site. GA4 sets a first-party cookie _ga on your browser and records: page URL, referrer, approximate location derived from IP, device type, and events we explicitly define (for example generate_lead when a brand submits the intake form, kit_download_badge when a verified brand downloads their kit).

Google Signals is turned off in our GA4 property. That means GA4 is not combining your visit with Google's cross-device advertising graph, and we are not enabling remarketing audiences.

Named vendors, no others:

• MongoDB — our primary database. Brand submissions, scan-log summaries, and the extension waitlist live here. Hosted in the United States on infrastructure managed by Emergent, our hosting provider.
• Airtable — we mirror brand submissions and extension waitlist entries into an Airtable base so our verification team can read and act on them.
• Resend — sends transactional emails (welcome, verification decisions, follow-ups). Your email address is transmitted to Resend so they can deliver the message. We do not run marketing sends through Resend.
• Google Analytics 4 — first-party site analytics only. Google Signals off. No ads-personalization sharing enabled.
• Emergent — hosting platform. Serves the site and stores our data at rest.

We do not use Meta Pixel, Pinterest Tag, TikTok Pixel, LinkedIn Insight Tag, or any other advertising-network tracker. We do not share data with data brokers.

• Brand submissions — kept indefinitely while your brand is listed. You can request deletion at any time (see below).
• Extension waitlist entries — kept until we have contacted you at least once, then either converted into an active brand record or deleted on request.
• Scan records — we keep scan records only as long as needed to operate the app, and delete them when they are no longer needed. Aggregated statistics (for example, “how many people looked for a women-owned coffee brand this week”) may be kept longer and cannot be linked back to a person.
• GA4 event data — retained at GA4's default of 14 months, then automatically deleted by Google.
• Server access logs — rotated inside 30 days.

You can ask us to:

• Tell you what we hold about you.
• Correct anything that is wrong.
• Delete your data entirely.
• Export what we hold in a machine-readable format (JSON or CSV).
• Stop sending you email — reply “unsubscribe” to any message from us, or email us directly.

To make any of these requests, email us at rene@thewomenseconomy.org. We aim to respond within 14 days.

If you are located in the European Union, the United Kingdom, California, or another jurisdiction with specific data-protection laws, you have additional rights under those laws (GDPR, UK GDPR, CCPA/CPRA). The requests above are how you exercise them here. You also have the right to complain to a supervisory authority.

• Consumer scans and analytics — legitimate interest: running a service that requires a functioning site and a way to improve it.
• Brand intake and communications — contract and legitimate interest: we cannot verify or list you without your submission.
• Transactional email — the direct consequence of the form you submitted. We do not enroll you in marketing lists.

We set two things in your browser:

• _ga — a first-party cookie for Google Analytics, containing an anonymous visitor ID.
• shescan.attribution — session storage (cleared when you close the tab) that remembers which link brought you to the site so we can credit partners correctly.

You can block cookies in your browser settings. Blocking them does not break the site.

If we materially change how we collect or process data, we will update this page and change the effective date at the top. If you have submitted an active brand record, we will also email you at the address on file.