Privacy Policy

1. Who we are

QRdy Limited is a New Zealand company that operates QRdy, a service that helps businesses give customers real-time status updates via QR codes. This policy explains what personal information we collect, why we collect it, and how we handle it under applicable privacy and data protection laws.

2. What information we collect

3. Why we collect it

• To display your job status on the status page
• To send you email or WhatsApp notifications about your job (only if you opted in)
• To send browser push notifications about your job if you opted in on a supported device
• To allow the business to identify your job in their dashboard
• To prevent abuse of the service, rate limit public actions, and prevent accidental duplicate submissions
• To secure business accounts and admin recovery flows

4. How we store and protect it

• Customer email addresses are encrypted at rest using AES-256-GCM encryption
• Customer WhatsApp numbers are encrypted at rest when stored
• All data is stored in Supabase, a US-based cloud database provider
• Data is transmitted over HTTPS at all times
• Tracker records have a validity window chosen by the business, up to 30 days
• After validity ends, a tracker can no longer be updated and is kept only for history and support during the plan retention period

5. Who we share it with

We do not sell your data. We use third-party services to operate QRdy — including hosting, authentication, payments, email, and real-time delivery. These providers process data only as needed to run the service and are bound by appropriate data processing terms. Some providers are based outside New Zealand; by using QRdy you consent to this processing.

If you opt in to WhatsApp notifications, your messages are delivered via Meta Platforms (WhatsApp Business API). See Meta's Privacy Policy.

QRdy Limited is based in New Zealand. Where personal information is transferred outside your country, we rely on our providers' contractual and operational safeguards and handle requests in line with applicable New Zealand, UK, EU, and other relevant privacy obligations.

6. Your rights

Depending on where you live, you may have the right to:

• Ask what personal information we hold about you
• Request a correction if it is wrong
• Ask us to delete your information
• Request an export of your information where applicable
• Object to or restrict certain processing where applicable law gives you that right

To exercise any of these rights, email us at support@alwaysqready.app. We currently handle access, correction, deletion, and export requests manually. We will respond within a reasonable period and in line with applicable legal requirements.

7. Data retention

• Customer job data: retained according to the business plan retention period after the tracker closes or expires
• Pro plan tracker history: retained for up to 90 days
• Business plan tracker history: retained for up to 1 year
• Anonymous/direct tracker history: retained for up to 7 days unless deleted earlier on request
• Free business tracker history: retained for up to 30 days unless deleted earlier on request
• Business account data: retained while the account is active; deleted on request
• Email notification logs: not retained after delivery
• WhatsApp phone numbers: encrypted at rest; deleted when the associated tracker record is deleted or on request
• Push subscription records: retained only while needed for active tracker notifications and removed when a tracker is deleted or the subscription is removed

8. Notification opt-out

If you opted in to email or WhatsApp notifications, you can unsubscribe at any time by clicking the unsubscribe link included in any notification we send, or by emailing support@alwaysqready.app. Once unsubscribed, we will not send further notifications for your job.

If you opted in to browser push notifications, you can also stop those notifications from your device or browser settings.

9. Cookies and tracking

QRdy uses Vercel Analytics to measure page traffic and Sentry to monitor application errors and reliability. We do not use advertising cookies or tracking pixels. We use these tools for product performance, troubleshooting, and security monitoring rather than for advertising.

We may use strictly necessary first-party browser storage or a first-party browser identifier to maintain tracker continuity, prevent accidental duplicate submissions, and protect the service against abuse. This is not used for advertising or cross-site tracking.

10. Children and minors

Business accounts on QRdy are intended for adults who are at least 18 years old and authorized to act for the business. QRdy is not directed to children under 13.

Businesses are responsible for using QRdy lawfully with their customers, including where a customer may be a minor and parent, guardian, or other lawful authority may be required. If we become aware that personal information was collected from a child under 13 in a way that should not have happened, we may review and delete that information.

11. Changes to this policy

We may update this policy from time to time. The date at the top of this page shows when it was last changed. Continued use of QRdy after changes means you accept the updated policy.

12. Contact

For privacy questions or requests, contact QRdy Limited at support@alwaysqready.app. If you are not satisfied with our response, you may also contact the privacy or data-protection regulator in your region.