← Back to Home

Flow Page Visitor Privacy Policy

Last Updated: January 1, 2025
Version: 1.0

This Privacy Policy explains what data QRoss collects when you visit flow pages and submit information.

1. Who Controls Your Data

Two parties collect your data:

Flow Creator (Data Controller)

  • Chooses what information to collect (name, email, phone, etc.)
  • Decides how to use your information
  • Responsible for keeping data secure
  • Must honor your data rights

3DF Limited (Data Processor)

  • Provides the flow page platform
  • Stores data on behalf of flow creators
  • Collects technical data automatically
  • Facilitates data rights requests

If you have concerns about your data, contact the flow creator first.

2. What We Collect Automatically

Technical Data (Collected for All Submissions)

  • IP Address: To detect spam and bots
  • Geolocation: Approximate location (city/country) from IP address
  • Device Information:
    • Browser type and version
    • Operating system
    • Screen resolution
    • Device fingerprint (for fraud detection)
  • Timestamp: When you submitted the form

Legal Basis: Legitimate interests (fraud prevention, security)

Bot Protection Data (If Enabled by Flow Creator)

If the flow creator enables Turnstile (Cloudflare's bot protection), Cloudflare may collect:

  • Browser characteristics
  • Mouse movements and interactions
  • Challenge responses

See Cloudflare's privacy policy for details.

Legal Basis: Legitimate interests (fraud prevention)

3. What the Flow Creator Collects

Flow creators choose what form fields to display. Common fields:

  • Name
  • Email address
  • Phone number
  • Organization/Company
  • Custom questions

The flow creator is responsible for:

  • Telling you why they need this data
  • Using it only for stated purposes
  • Keeping it secure
  • Deleting it when requested

We store this data on the flow creator's behalf but do not control how they use it.

4. How We Use Your Data

QRoss Uses Your Data To:

  1. Facilitate submissions: Display your submission to the flow creator
  2. Prevent abuse: Detect bots, spam, and duplicate submissions
  3. Security: Protect against malicious actors
  4. Support: Help troubleshoot issues (if you contact us)
  5. Legal compliance: Respond to valid legal requests

QRoss Does NOT:

  • Sell your data to third parties
  • Use your data for marketing (unless you opt in to our own flows)
  • Share with third parties except as described in Section 6

5. Data Retention

Active Flows

Data retained while the flow is active and for 30 days after the flow creator deletes it.

Backups

Backup copies deleted within 90 days.

Legal Holds

Data retained longer if required by law or valid legal process.

Your Deletion Rights

You can request deletion anytime (see Section 9).

6. Who We Share Data With

Service Providers

We use third-party services that may access your data:

Provider Purpose Data Accessed Privacy Policy
Cloudflare Security, CDN, bot protection IP, device data, location Link
Supabase Database, authentication All check-in data Link
Storj File storage (logos, images) Files uploaded by organizers Link

We may change providers anytime without notice.

Flow Creators

The flow creator can access all data you submit to their flow.

Legal Requests

We may disclose data to comply with valid legal requests, court orders, or law enforcement.

Customer Support

QRoss staff may access your data to troubleshoot issues. All access is logged and limited to necessary personnel.

7. International Transfers

Our service providers operate globally. Your data may be transferred to:

  • United States (Cloudflare, Supabase)
  • Europe (Supabase)
  • Decentralized storage networks (Storj)

We do not guarantee data will stay in specific regions. Providers may change locations without notice.

Safeguards: Service providers use standard contractual clauses and encryption.

8. Data Security

Our Security Measures

  • Encryption in transit (HTTPS/TLS)
  • Encryption at rest (database encryption)
  • Zero-knowledge storage for sensitive tokens (Supabase Vault - beta)
  • Access controls and logging
  • Regular security updates

Limitations

  • Alpha software: No security guarantees during testing
  • Third-party risk: Providers may have breaches
  • Organizer responsibility: Organizers must secure their accounts

No system is 100% secure. We are not liable for breaches caused by third parties or organizer negligence.

9. Your Privacy Rights

Rights Under Hong Kong PDPO, GDPR, and CCPA

You have the right to:

  1. Access: Request a copy of your data
  2. Correction: Fix inaccurate information
  3. Deletion: Request data removal
  4. Portability: Receive your data in machine-readable format
  5. Objection: Object to certain data processing
  6. Restriction: Limit how we process your data
  7. Withdraw Consent: Stop processing based on consent

How to Exercise Your Rights

Step 1: Contact the Flow Creator
Since flow creators control most of your data, contact them first:

  • Check the flow page for creator contact info
  • Email or message the flow creator directly

Step 2: Contact QRoss (If Flow Creator Unresponsive)
Email [email protected] with:

  • Flow name and date
  • Your submission details (name, email, etc.)
  • Specific request (access, deletion, etc.)

Response Time:

  • We respond within 30 days
  • Deletion completed within 30 days (backups: 90 days)

California Residents (CCPA Rights)

California residents have additional rights:

  • Do Not Sell: We don't sell your data
  • Non-Discrimination: We won't discriminate for exercising rights
  • Shine the Light: Request info on data sharing (not applicable - we don't share for marketing)

Contact [email protected] to exercise CCPA rights.

10. Children's Privacy

QRoss is for users 18+. We do not knowingly collect data from minors. If you believe a minor's data was collected, email [email protected] immediately.

11. Cookies and Tracking

Essential Cookies

  • Session cookies: Keep you logged in (if flow creator creates account)
  • Security cookies: CSRF protection

Optional Cookies

  • Turnstile cookies: If flow creator enables bot protection (Cloudflare)

We do not use tracking or advertising cookies.

Browser Controls

You can disable cookies in your browser, but this may break functionality.

12. Changes to This Policy

We may update this Privacy Policy anytime. Changes posted here.

Material Changes: 14 days' notice before effective date.

Continued use = acceptance of changes.

13. Complaints and Regulatory Contact

File a Complaint

If unsatisfied with our response, you can complain to:

Hong Kong Privacy Commissioner for Personal Data (PCPD)

EU Residents: Contact your local Data Protection Authority

California Residents: Contact California Attorney General

14. Contact Us

Questions about your data?
Contact the flow creator first.

Privacy questions or complaints:

General support:

Data Protection Contact:

3DF Limited
Hong Kong SAR
[email protected]