Privacy Policy

(pending registration), sole proprietorship, Singapore (“we”, “us”, “our”) operates the Secure QR service at (pending registration). This policy describes how we collect, use, and protect information about you when you use our service.

• Account information: name, email address, and a hashed password when you create an account.
• QR payload data: the content you encrypt into a QR code. It is stored as ciphertext under a per-tenant key, so a stolen database dump or backup reveals nothing. We hold the keys and the server decrypts a payload when an authorised viewer opens it, so we are technically able to read it — we do not, except where required to operate the service or by law.
• Access event logs: timestamp, gate type, and a keyed HMAC of the viewer's IP address for each scan event.
• Usage data: page views, API request counts, and error rates, aggregated and not linked to individuals.

We use your information to:

• Provide, operate, and improve the service.
• Authenticate you and enforce access gates on your QR codes.
• Send transactional emails (access links, account notices). We do not send marketing email without consent.
• Detect and prevent abuse.

Account data is retained while your account is active. QR records are retained until you delete them or close your account. Access logs (scan events) are purged automatically 90 days after they are recorded. Workspaces can choose a shorter window, and some plans enforce one; a code can also be set to record no scan events at all. On account closure, all remaining data is deleted within 30 days, and encrypted backups age out on the same 30-day cycle. Workspace owners may attach their own analytics or advertising tags (Google Analytics, Google Tag Manager, Meta Pixel) to codes they have made public. Those tags are the workspace's own, run only on public interstitial and hosted pages, never on gated content, and where consent is required they do not load until a visitor accepts.

We do not sell your personal data. We share data only with:

• Infrastructure providers (cloud hosting, database, key management) under data-processing agreements.
• Law enforcement, only when required by law and after a documented legal demand review.

The full list of sub-processors, with their purpose, data category, and region, is published on the Sub-processors page.

Connecting an AI agent sends payload content to that agent’s model provider. If you grant an API key or MCP credential the qr:content:read scope, an agent holding it can read the decrypted content behind your QR codes, and that content then leaves our systems for whichever model provider the agent runs on. We do not choose that provider, have no agreement with it, and cannot recall content once it has been read. What we do: the scope is separate from every other read permission and no existing credential inherits it, so this cannot happen until you grant it deliberately; every such read is written to your workspace audit trail naming the credential; reads are capped per credential per hour; and you can revoke the credential at any time, which stops further reads immediately. Grant it only to agents you intend to give that access.

All payloads are encrypted with AES-256-GCM before storage. Encryption keys are managed via AWS KMS (production) and never written to persistent storage in plaintext. We use TLS for all data in transit. We conduct periodic security reviews. No method of electronic storage is 100% secure; we cannot guarantee absolute security.

Depending on your location, you may have the right to access, correct, or delete your personal data, or to object to or restrict certain processing. To exercise these rights, email (pending registration), or use the export and deletion tools in your account settings. We respond within 30 days.

We use a single httpOnly session cookie for authentication. We do not use tracking cookies or third-party advertising cookies.

We will post changes here and update the date above. Material changes will be notified by email to registered users at least 14 days before they take effect.

Questions about this policy: (pending registration) · (pending registration), sole proprietorship, Singapore