Privacy

Effective October 14, 2026. If this changes, we'll post the new version here and email account holders.

BanditBeacon is operated by Sandy Coast Management Group, LLC, doing business as BanditBeacon ("we"). This policy explains what we collect when you scan a sign, view a listing, send an inquiry or use an owner account, and what happens to it. EstateScoop is the real estate part of BanditBeacon and follows this policy.

The short version

• You can view a listing without an account, and we don't track your location.
• If you send an inquiry, the listing owner gets your details so they can reply. Nobody else does, apart from the providers we need to run the service.
• We don't sell personal information, show ads, or use advertising or analytics trackers.
• Contact details and messages are encrypted when stored.

If you scan a sign or view a listing

We record that a scan, code entry, listing view or Call-button tap happened, with the sign and listing it relates to and the time. Owners see these as counts. We don't link them to you: we don't ask who you are, and we don't store your IP address with them.

When you scan a sign, we set a cookie that lasts 30 minutes and only applies to that sign's page, so reloading the page isn't counted as a second scan. The Call button opens your phone's dialer; we count the tap but don't place, connect or record the call.

If you send an inquiry

When you send a message or request a showing, we collect:

• your name;
• how you want to be contacted: your email address, phone number or both, as you choose;
• your message and any preferred showing times;
• the listing, and the sign and access method (QR scan or code entry) that brought you there;
• the version of the consent statement you agreed to, and when.

We use this to deliver your inquiry to the listing owner. They see it in their BanditBeacon workspace, along with anyone they've added to that workspace, and they receive an email alert with your contact details and message. We don't email you ourselves, add you to any list, or use your details for anything else.

Before you send an inquiry, you confirm this statement: "[Contact name] may contact me about this listing using the methods I chose above." (version inquiry-consent-v1). The owner agrees in our terms to use your details only to respond about that listing, by the methods you chose. Once they have your details, the owner is responsible for how they use them. To stop hearing from an owner, tell them, or contact us and we'll pass it on.

If you report a listing

We keep the reason and any details you write. We don't record who sent the report.

If you have an owner account

We store your name, email address and password, which is stored as a salted hash we can't read, as well as your workspace name and email alert settings. We also store the listings, photos, signs, notes and lead status changes you create. When you upload a photo, we resize it and save a new copy, which removes camera details and any location embedded in the file. Listing details and photos you publish are public: anyone who scans a connected sign, enters its code or has the listing's link can see them. If you publish a public page, its name, logo, colors, introduction and the contact details you add to it are public too, along with your published listings. If you choose an approximate location, we don't show the street address.

We send you account emails, such as email confirmation and password reset links, and the inquiry alerts you turn on. We don't send marketing email.

Cookies

• Sign-in: keeps you signed in. It expires after 14 days without use, or when you sign out.
• Scan counting: 30 minutes, described above.
• Messages: a one-minute cookie that shows a confirmation, such as "Listing published", after a form is sent.

All of them are needed for the service to work. We don't use advertising or analytics cookies, and our pages load no third-party scripts or fonts.

Who else handles data

• DigitalOcean hosts our servers and database.
• Resend delivers our emails, including inquiry alerts.

They handle data only to provide these services to us. We may also disclose information if the law requires it, or to protect people or the service from fraud or abuse.

Security

Pages are served over HTTPS. Inquiry contact details, messages and queued emails are encrypted in our database, and queued email content is erased once it has been sent. Sign-in, signup, code entry and inquiry forms are rate-limited. We use your connection's IP address for that, but only in memory, for a short time.

How long we keep it

• Inquiries: until the listing owner deletes them in their workspace (which they can do at any time), asks us to delete them, or closes their account.
• Activity counts: until the listing owner's account is closed. They aren't linked to you.
• Owner accounts and listings: until the account is closed.
• Reports: as long as the listing exists.

When an owner deletes an inquiry, it's removed from the service immediately. When you ask us to delete something, we remove it within 30 days. Copies in backups are overwritten as backups rotate.

Your choices

You can ask us to show you, correct or delete personal information we hold about you, including an inquiry you sent. Write to support@banditbeacon.com. We'll reply within 30 days. The listing owner can delete your inquiry, or we can on your behalf; they may already have a copy in their own email. We don't sell or share personal information for targeted advertising. Depending on where you live, you may have further rights; we honor these requests whichever state you live in.

BanditBeacon isn't meant for children under 13, and we don't knowingly collect their information. Owner accounts are for adults.

Changes and contact

If we change this policy, we'll post the new version here with its date, and email account holders about significant changes. Questions: support@banditbeacon.com, or write to Sandy Coast Management Group, LLC, doing business as BanditBeacon, 6650 Rivers Avenue, Charleston, SC 29406.