Privacy policy
Information about how QR ScanList operates and how the service is used.
Service operator: Ali Ameen
What we collect
Accounts include name, sign-in information and email or phone for the selected login method. Businesses provide catalog content, images, branding and links. Requests contain choices, contact information, delivery addresses when needed and requested appointment times. Billing includes subscriber details, invoices and submitted transfer proof.
How data is used and who can see it
Data supports accounts, catalogs, requests, billing and service protection. Published content is available at the business link and may be indexed. Request details are available to the business owner and authorized staff. Payment proofs are private to the owner and administrators authorized to review payments.
Sessions, local storage and analytics
An authentication cookie maintains sign-in. Browsers may store theme settings, cart choices, item notes and an offline catalog copy. Local analytics records event type, item, QR/link source and time, without customer names, phones, addresses, IP addresses or permanent visitor IDs. Do Not Track and Global Privacy Control are respected.
External services
Google sign-in and WhatsApp OTP depend on service configuration. Opening WhatsApp lets customers choose to send information to a business through an external service. Paymob processes payments when enabled; the app does not store card numbers. R2 may store files. If Plausible is enabled, the browser sends public usage events and a query-free path; that provider has its own processing policies.
Retention, deletion and data requests
Data needed for accounts, requests and billing is retained until deletion, expiry of operational need or applicable requirements. Owners can delete requests, images and content using available controls; unpublishing does not delete data. Recovery backups may retain earlier copies after deletion, and visitor devices may keep offline copies. Use the published support channel for access, correction or account deletion requests, and contact the business for data submitted in its requests.
Protection and updates
Passwords are stored as hashes, and server checks enforce membership and tenant isolation. Avoid sensitive information in public content or request notes. Policy updates will be published here with an updated date. This page is not a compliance certification or a guarantee against every incident.