Privacy & Cookie Policy

The controller of personal data processed through the website and the Service is OrizonQR.

You may contact us via the support or legal contact channels published on orizonqr.app. Where legally required, we will appoint an EEA or other regional representative and disclose it in this Policy or on the site.

This Policy covers the marketing website, registration and sign-in, the customer dashboard, QR redirects we operate, account-related communications, and Google measurement and advertising tags we load on the site (Google Analytics 4 and, when enabled, Google Ads).

We do not control processing by your customers or third parties at destinations your QR codes open outside our infrastructure. You are responsible for complying with applicable law for your campaigns and for people who scan your codes.

Account and profile data: name, email, password (stored securely/hashed by the auth provider), language preferences, and workspace or company details you provide.

Billing and license data: plan or tier, subscription status, payment processor identifiers, marketplace redemption history, and data needed for billing and fraud prevention.

Product usage data: QR codes, destinations, styles, scans, device/browser/OS signals, approximate geo derived from IP when enabled, and campaign metrics and marketing intelligence generated by the Service.

Site technical data: IP address, user-agent, pages viewed, referrers, device or cookie identifiers, and security/diagnostic logs.

Marketing and advertising data (only with consent when required): Google Analytics and Google Ads cookie identifiers, ad interactions and attributed conversions, and measurement events configured in our tags.

Provide and improve the Service: authentication, workspaces, dynamic QR codes, product analytics, OrizonIndex™, support, and security.

Perform contracts and legal duties: billing, accounting, fraud prevention, and responses to lawful requests.

Service communications: email verification, password reset, quota alerts, material Service changes, and support replies.

Site and product analytics (Google Analytics 4) when you grant analytics consent: understand site usage, performance, and funnels.

Advertising and ad measurement (Google Ads and related features) when you grant advertising consent: conversion measurement, remarketing, and ad personalization to the extent permitted.

Legitimate interests: protect the platform, prevent abuse, improve reliability, and produce aggregated or pseudonymized statistics where law allows without non-essential cookie consent.

We use cookies, local storage, and similar browser technologies. Some are strictly necessary for the site to work; others are used for analytics and advertising and require prior consent where the law requires it.

You can manage preferences at any time via the cookie banner, the preferences control, or the "Cookie preferences" footer link. You may also clear or block cookies in your browser; blocking essential cookies may break parts of the Service.

Essential (always on): authentication and session, language preference, theme preference, fraud/security controls, load balancing, and storage of your consent decision. These are not used for advertising and do not require marketing consent.

Analytics (optional): Google Analytics 4 cookies and identifiers (e.g. _ga, _ga_*) to measure visits, events, and site performance when you accept Analytics.

Advertising / marketing (optional): Google Ads and related identifiers (e.g. conversion measurement, remarketing, personalization) when you accept Advertising. If you reject this category, we keep ad_storage, ad_user_data, and ad_personalization denied.

We implement Google Consent Mode v2 with gtag.js. By default, worldwide, analytics_storage, ad_storage, ad_user_data, and ad_personalization are set to "denied" until you choose otherwise in the banner.

If you accept Analytics, we set analytics_storage to "granted". If you accept Advertising, we set ad_storage, ad_user_data, and ad_personalization to "granted". You may combine categories (e.g. analytics only).

While storage consent is denied, Google tags limit or adapt their behavior (including conversion modeling where Google provides it). We also enable ads data redaction when advertising is not granted.

Contract performance: creating and managing your account, delivering the Service, and related support.

Legitimate interests: security, abuse prevention, Service improvement, and strictly necessary measurements where permitted by law.

Consent: non-essential analytics and advertising cookies, and optional marketing communications when we request them separately.

Legal obligation: tax retention, responses to competent authorities, and other applicable compliance duties.

We share data with vendors that help us run the Service under contractual instructions, for example: hosting and infrastructure, authentication and database (Supabase), payment processing, transactional email, and Google (Analytics and Ads) when tags are active and consent allows.

We do not sell your personal information. We may disclose data if required by law, to protect rights, safety, and Service integrity, or in a merger, acquisition, or corporate reorganization with appropriate safeguards.

OrizonQR operates globally. Your data may be processed in Colombia, the United States, or other countries where we or our vendors run infrastructure.

When transferring from the EEA/UK/Switzerland to countries without an adequacy decision, we apply appropriate safeguards (such as standard contractual clauses or other recognized measures) as required by law.

We keep account and billing data while the account is active and for necessary legal or contractual periods afterward (e.g. accounting and disputes).

Scan and product analytics data are retained according to your plan, product retention policies, and legal duties. Technical logs are kept as needed for security and diagnostics.

Cookie preferences are stored in your browser (localStorage) to remember your choice; you may clear or change them at any time.

We apply reasonable technical and organizational measures: encryption in transit (HTTPS), access controls, multi-tenant isolation as designed into the product, and secure development practices.

No system is 100% secure. Please notify us promptly if you suspect unauthorized access to your account.

Depending on your jurisdiction, you may have rights to access, rectify, erase, restrict or object to processing, data portability, withdraw consent, and not be subject to certain automated decisions with legal or similarly significant effects where applicable.

To exercise rights related to your account, use in-product controls where available or contact support. You may also lodge a complaint with your local data protection authority.

For non-essential cookies, withdraw or change consent via the banner or preferences link; withdrawal does not affect the lawfulness of prior processing.

The Service is aimed at professionals and businesses. It is not intended for children under 16 (or the higher digital consent age in your country). If you believe a child has provided us data, contact us so we can delete it where appropriate.

We may update this Policy to reflect changes to the Service, measurement tags, or the law. We will post the updated version with a revised effective date on this page.

If changes are material to personal data processing, we will take additional notice steps when required by law.

For privacy, cookies, or data rights: use the support or contact channels published on orizonqr.app and mention privacy in the subject.

Controller email: customercare@orizonqr.app