Privacy Policy

1. Who we are

QRrd is the service available at qrrd.cc. In this policy, “QRrd”, “we”, “us” and “our” refer to the operator of the QRrd service.

For privacy enquiries, requests or complaints, contact privacy@qrrd.cc.

We aim to manage personal information transparently and consistently with applicable Australian privacy law, including the Australian Privacy Principles where they apply to us.

2. Information we collect

Account and team information

When you use an account or join a workspace, we may collect your email address, internal account identifiers, workspace memberships, roles, QR pool permissions, invitations, sign-in activity and audit history showing who changed QR or workspace details and when.

QR code and recipient information

Workspace users can enter information associated with a QR code, including a QR name, recipient name, recipient company, reference, destination URL, message title and body, button details, alert settings, pool assignment, status and other management information. QRrd may also generate and store PNG and SVG image assets for the public QR token.

Because a workspace user may enter information about another person, such as the intended recipient of a business card, the workspace user is responsible for ensuring they have an appropriate basis to provide and use that information. QRrd processes it to provide the service to the workspace.

Scan and device information

When a public QR code is scanned, we may record the QR code, scan date and time, approximate country, region and city supplied by our network provider, network point-of-presence information, and a general device and browser category derived from the browser user-agent. We also maintain first-scan, last-scan and total-scan information.

QRrd does not intentionally store the scanner's raw IP address in QR scan analytics. Our infrastructure provider necessarily processes network information such as IP addresses to deliver and protect the service.

Security and authentication information

For fraud prevention and rate limiting, QRrd may create keyed cryptographic hashes derived from IP addresses used during sign-in attempts or protected-message password attempts. These hashes are used to detect repeated abuse without storing the raw IP address in those application security records.

Sign-in codes expire after five minutes. Session tokens and API key secrets are stored as one-way hashes. Customer webhook signing secrets are stored encrypted. If a hosted message is password protected, QRrd stores a salted keyed password verifier rather than the plaintext message password.

Billing and credit information

When a workspace purchases QR or alert credits, we may keep Stripe customer, checkout, subscription or payment identifiers, credit balances and a transaction ledger recording purchases and credit usage. Payment card details are collected and processed by Stripe. QRrd does not intentionally receive or store your full card number or card security code.

Email and communications

We process email addresses and the content of service emails required for sign-in codes, workspace invitations, scan alerts, billing or account notices and support communications. Transactional email is delivered using SMTP2GO.

API, webhook and operational information

If you use developer features, we may store API key names, prefixes, scopes and last-used times, webhook URLs, delivery status, retry counts and limited delivery error information. We do not store the full API key secret after it is issued.

3. How we collect information

We collect information directly from account holders and workspace members, automatically when the service is used or a QR code is scanned, from payment and email service providers, and from other workspace members who invite a person or enter information about a QR recipient.

4. How we use information

We use personal information to:

• create and secure accounts using passwordless email sign-in;
• operate workspaces, team roles, permissions and QR pools;
• create, route, display, manage and permanently retire QR codes;
• provide scan counts, scan history and approximate scan analytics;
• send scan alerts and service emails requested by workspace users;
• deliver customer-configured webhook events and provide API access;
• process payments, QR credits and alert credits and maintain transaction records;
• detect abuse, investigate incidents, troubleshoot problems and protect the service;
• provide support and respond to privacy requests; and
• comply with applicable legal, tax, accounting and regulatory obligations.

We do not sell personal information. We do not currently use QR scan information for third-party advertising or behavioural advertising.

Our current account emails are primarily transactional or service messages. If we introduce marketing emails, we will handle consent and unsubscribe requirements in accordance with applicable law.

5. QR scans, alerts and webhooks

QRrd is designed so a workspace can associate a QR code with a particular card, person, document or handoff. A scan therefore may be meaningful to the workspace even though QRrd does not itself verify the identity of the person holding the device.

Approximate location and device information can be incomplete or inaccurate, including where a scanner uses a VPN, proxy, shared network or privacy service. Workspace users should treat scan analytics as engagement signals rather than proof that a particular named individual personally performed a scan.

If a workspace enables an email alert, scan details may be sent to the nominated workspace user. If a workspace configures a webhook, QRrd may send the QR name, recipient name, company, reference, scan count, timestamp, approximate location and device/browser information to the webhook URL chosen by that workspace. The workspace is responsible for the systems and recipients it chooses for those disclosures.

6. When we share information

We disclose information only as reasonably necessary to operate QRrd, follow workspace instructions, protect the service, complete payments, or meet legal obligations. Relevant recipients include:

• Cloudflare, which provides network delivery, security, Workers compute, database, object storage and queue infrastructure, and Turnstile bot protection;
• SMTP2GO, which sends transactional emails such as sign-in codes, invitations and scan alerts;
• Stripe, which processes payments and provides checkout and billing services;
• members of the relevant workspace, according to their role and QR pool permissions;
• customer-configured webhook endpoints, when a paid workspace asks QRrd to send scan events to an external system; and
• professional advisers, regulators, law-enforcement agencies, courts or other parties where disclosure is required or authorised by law or reasonably necessary to protect legal rights or safety.

If QRrd is reorganised, sold or transferred, information may be disclosed as part of that transaction subject to applicable privacy obligations.

7. Overseas processing and disclosure

QRrd uses global internet and payment infrastructure. Personal information may therefore be processed or accessible outside Australia.

Depending on the service and configuration, overseas processing may include New Zealand (SMTP2GO's operator is based in New Zealand), the United States and India (which Stripe identifies among locations involved in international data transfers), and other countries in which Cloudflare or its infrastructure providers operate.

SMTP2GO states that accounts signing up from Australia are normally assigned to its Australian data centre, but some service-provider operations or support may still involve other jurisdictions. Provider locations and subprocessors can change over time.

8. Cookies and similar technology

QRrd uses a strictly necessary session cookie after sign-in so the portal can recognise an authenticated user. The current session is designed to expire after up to 30 days and can be ended by signing out.

We do not currently use advertising cookies or third-party behavioural tracking cookies. Third-party services such as Stripe and Cloudflare may use their own necessary security or service technologies when you interact with them.

9. Security

We use technical and organisational measures intended to protect information from misuse, interference, loss and unauthorised access, modification or disclosure. Measures built into QRrd include encrypted HTTPS connections, hashed authentication and API secrets, role and QR-pool access controls, encrypted webhook secrets, one-way protected-message password verification, rate limiting, audit logs and restricted administrative testing controls.

No internet service can guarantee absolute security. If we become aware of a data breach, we will investigate it and make notifications where required by applicable law.

10. How long we keep information

We retain information for as long as reasonably necessary to provide QRrd, maintain security and audit history, resolve disputes, enforce agreements and meet legal, tax, accounting or regulatory obligations.

• Sign-in codes become unusable after five minutes, although security records relating to authentication attempts may be retained for abuse prevention and operational purposes.
• Portal sessions expire after up to 30 days unless ended earlier.
• Failed protected-message password attempt records are periodically cleaned and are designed for short-term abuse prevention.
• QR records and scan history may be retained while a workspace uses them. Retired QR codes are intentionally kept as tombstones so their public token is never issued again.
• A compact retired-token registry may be retained permanently to prevent an old printed QR URL from ever being reassigned.
• Credit and payment records may be retained for financial, tax, fraud-prevention and audit requirements.

Where information is no longer required, we may delete it, de-identify it or restrict its use, subject to technical and legal requirements.

11. Access, correction and deletion requests

You can update much of your workspace and QR information directly through the QRrd portal. You may also ask us to provide access to personal information we hold about you, correct inaccurate information, or delete information where appropriate.

Send requests to privacy@qrrd.cc. We may need to verify your identity before acting on a request. Some information may need to be retained where required by law, for security or fraud prevention, to preserve financial records, or to ensure retired public QR tokens are not reassigned.

12. Privacy complaints

If you have a privacy concern, contact privacy@qrrd.cc and provide enough detail for us to investigate. We will aim to respond within a reasonable period.

If you are not satisfied with our response and Australian privacy law gives you the right to do so, you may be able to make a complaint to the Office of the Australian Information Commissioner (OAIC).

13. Changes to this policy

We may update this policy as QRrd changes, including when we add new analytics, communications, integrations, payment or printing features. The current version will be published at qrrd.cc/privacy with the date it was last updated. If a change materially affects how we handle personal information, we may also provide an in-product or email notice where appropriate.