Privacy Policy

1. Introduction

Welcome to QR Code Management. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service at https://qr.simplyautomated.io (the "Service").

We are committed to protecting your privacy and being transparent about our data practices. Please read this Privacy Policy carefully. If you do not agree with the terms of this Privacy Policy, please do not access the Service.

2. Information We Collect

2.1 Personal Information

When you register for an account, we collect:

• Email address: Used for account creation, authentication, and communication
• Name: If you sign in with Google OAuth, we receive your name from your Google profile
• Profile picture: If you sign in with Google OAuth, we receive your profile picture URL
• Password: If you register with email/password (stored encrypted, never in plain text)

2.2 QR Code Data

When you create and manage QR codes, we store:

• QR code names and descriptions
• Destination URLs
• QR code design preferences (colors, logos)
• Creation and modification timestamps
• Folder organization

2.3 Analytics and Tracking Data

When someone scans your QR code, we collect:

• IP address: Used for geographic analytics and abuse prevention
• User agent: Browser and device information
• Referrer: Where the scan originated from
• Timestamp: When the scan occurred

This data is aggregated and used to provide you with scan analytics.

2.4 Technical and Usage Data

We automatically collect certain information when you use the Service:

• Browser type and version
• Device information
• Operating system
• Pages viewed and features used
• Time spent on pages
• Error logs and diagnostic data

3. How We Use Your Information

We use the information we collect for the following purposes:

• Provide the Service: Create and manage your account, generate QR codes, and provide analytics
• Authentication: Verify your identity and secure your account
• Analytics: Provide scan statistics and insights for your QR codes
• Communication: Send you service-related emails, updates, and notifications
• Improvement: Analyze usage patterns to improve the Service
• Security: Detect and prevent fraud, abuse, and security threats
• Legal compliance: Comply with legal obligations and enforce our Terms of Service

4. How We Share Your Information

We do not sell your personal information. We may share your information in the following circumstances:

4.1 Service Providers

We use third-party service providers to operate the Service:

• Supabase: Database and authentication services
• Vercel: Hosting and deployment
• Google OAuth: Authentication services

These providers have access to your information only to perform tasks on our behalf and are obligated to protect it.

4.2 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., court orders, subpoenas).

4.3 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before your information is transferred and becomes subject to a different Privacy Policy.

5. Data Security

We implement appropriate technical and organizational security measures to protect your information:

• Encryption in transit (HTTPS/TLS)
• Encryption at rest for sensitive data
• Secure authentication with encrypted passwords
• Regular security audits and updates
• Access controls and authentication
• Monitoring for security threats

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

6. Data Retention

We retain your information for as long as necessary to provide the Service and fulfill the purposes outlined in this Privacy Policy:

• Account data: Retained until you delete your account
• QR code data: Retained until you delete the QR code or your account
• Scan analytics: Retained for up to 2 years for analytics purposes
• Logs: Retained for up to 90 days for security and debugging

After account deletion, we may retain certain information as required by law or for legitimate business purposes.

7. Your Rights and Choices

Depending on your location, you may have the following rights:

7.1 Access and Portability

You can access and export your QR code data at any time through the Service.

7.2 Correction

You can update your account information and QR code data through your account settings.

7.3 Deletion

You can delete individual QR codes or your entire account. Contact us at support@simplyautomated.io to request account deletion.

7.4 Objection and Restriction

You can object to certain processing of your information or request that we restrict processing.

7.5 Withdrawal of Consent

Where we rely on consent to process your information, you can withdraw that consent at any time.

8. Cookies and Tracking

We use cookies and similar tracking technologies:

• Authentication cookies: Keep you logged in
• Preference cookies: Remember your settings
• Analytics cookies: Understand how you use the Service

You can control cookies through your browser settings. Note that disabling cookies may affect the functionality of the Service.

9. Children's Privacy

The Service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws different from your country.

We take appropriate safeguards to ensure that your personal information remains protected in accordance with this Privacy Policy.

11. California Privacy Rights (CCPA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information is collected
• Right to know if personal information is sold or disclosed
• Right to opt-out of the sale of personal information
• Right to request deletion of personal information
• Right to non-discrimination for exercising CCPA rights

Note: We do not sell personal information.

12. European Privacy Rights (GDPR)

If you are in the European Economic Area (EEA), you have rights under the General Data Protection Regulation (GDPR):

• Right of access to your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent
• Right to lodge a complaint with a supervisory authority

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last Updated" date.

Your continued use of the Service after any changes constitutes acceptance of the updated Privacy Policy.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

15. Data Processing Addendum

For enterprise customers who require a Data Processing Addendum (DPA) or Business Associate Agreement (BAA), please contact us at support@simplyautomated.io.