Privacy Policy

Last Updated: January 7, 2025
Effective Date: January 7, 2025
Version: 1.0.0-alpha
Entity: 3DF Limited
Jurisdiction: Hong Kong Special Administrative Region
Contact: [email protected]

1. Introduction

3DF Limited ("QRoss," "we," "us," or "our") operates QRoss, a QR code flow management platform. This Privacy Policy explains how we collect, use, disclose, and protect your personal information.

Scope: This policy applies to flow creators who create accounts on QRoss. For flow page visitors (people who scan QR codes and submit forms), please see the Flow Page Visitor Privacy Policy.

Governing Law: We comply with the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong Special Administrative Region and follow best practices from GDPR and CCPA where applicable.

Commitment: We are committed to protecting your privacy and handling your personal data responsibly and transparently.

2. Information We Collect

Account Information (You Provide):

• Email address (required for account creation)
• Password (hashed and encrypted - we cannot see your plaintext password)
• Name or display name (optional)
• Profile information and preferences
• Subscription tier and account status

Usage Information (Automatically Collected):

• Login dates, times, and IP addresses
• Pages visited and features accessed within QRoss
• Browser type, device type, and operating system
• Session duration and interaction patterns
• Error logs and diagnostic information

Flows & Submissions:

We collect and store information you create and manage:

• Flow names, descriptions, and configurations
• Form field definitions and validation rules
• Webhook URLs, bearer tokens (encrypted), and integration settings
• Redirect URLs and query parameters
• Flow QR codes and slugs
• Form submissions from flow page visitors (collected on your behalf)
• Submission metadata (IP addresses, geolocation, device info of visitors)

Uploaded Files:

• Flow logos and images
• File names, sizes, and upload timestamps

Upgrade Interest Data:

• Which subscription plan you clicked to attempt upgrading to
• Timestamp of upgrade attempt
• Used to notify you when paid plans become available

Customer Support Data:

• Support correspondence and tickets
• Chat or email communications with our support team
• Information you voluntarily provide when seeking assistance

Security & Anti-Fraud Data:

• Cloudflare Turnstile verification data (browser/device characteristics for bot detection)
• Rate limiting tracking (IP addresses and request timestamps)
• Spam detection signals
• Login attempt history

3. How We Use Your Information

We use your information for the following purposes:

Service Provision:

• Create and maintain your account
• Process and display your flows
• Store and manage form submissions
• Execute webhook deliveries to your configured endpoints
• Generate QR codes and flow pages

Customer Support:

• Respond to your inquiries and support requests
• Troubleshoot technical issues with your account or flows
• Help configure webhooks, bearer tokens, and integrations
• Investigate reported problems with submissions or data
• Assist with account recovery and password resets
• Support staff may access your account data to resolve issues (access is logged and limited to what's necessary)

Service Improvement:

• Analyze aggregate, anonymized usage patterns
• Identify and fix bugs or technical issues
• Develop new features and functionality
• Optimize performance and user experience

Security & Fraud Prevention:

• Detect and prevent spam, abuse, and malicious activity
• Enforce rate limits to prevent service abuse
• Verify users are human (via Cloudflare Turnstile)
• Block disposable email services and invalid domains
• Investigate security incidents and policy violations
• Maintain logs for security auditing

Legal Compliance:

• Comply with applicable laws and regulations
• Respond to legal requests (court orders, subpoenas)
• Enforce our Terms of Service
• Protect our rights and property

Communications:

• Send service-related notifications (flow submissions, account changes)
• Notify about Terms or Privacy Policy updates
• Respond to your communications
• Send upgrade availability notifications (if you expressed interest)
• No marketing emails during alpha testing

Billing (Future): When paid subscriptions launch:

• Process payments via Stripe
• Generate invoices and receipts
• Manage subscription status and renewals

4. Third-Party Service Providers

IMPORTANT: We reserve the right to change service providers at any time without notice. Data location and processing regions are not guaranteed and may change.

Current providers as of January 7, 2025:

Supabase Vault (Beta):

• Bearer tokens stored with zero-knowledge encryption
• Tokens encrypted before storage with separate encryption keys
• QRoss staff cannot access token values in plaintext
• Only the QRoss application can retrieve tokens (to send webhooks)
• Beta software - may have limitations or change

Why These Providers: We select providers based on security practices, reliability, compliance standards, and functionality. However, we are not liable for provider outages, security incidents, or policy changes.

Data Migrations: When we change providers, we may migrate your data. By using QRoss, you grant permission for data transfers to new providers as necessary to operate the Service.

5. Security & Anti-Spam Technologies

We implement multiple security measures to protect the Service and prevent abuse:

Cloudflare Turnstile (Bot Protection):

• Purpose: Verify users are human, not automated bots
• Applied to: Account signup (always enabled) and flow submission pages (configurable per flow)
• How it works: Invisible verification analyzing browser behavior and device characteristics
• Data collected: Browser type, device info, IP address, interaction patterns
• Privacy-focused: No tracking cookies, minimal data collection compared to alternatives
• User control: Flow creators can disable Turnstile per flow (at their own risk)

Disposable Email Detection:

• Purpose: Prevent spam accounts from temporary email services
• How it works: Check signup email domains against updated lists of disposable email providers
• Data used: Email domain only (e.g., "@tempmail.com")
• Applied to: Account signup (always) and event forms with email fields (configurable)
• False positives: Contact [email protected] to request domain review if legitimate email blocked

DNS Email Validation:

• Purpose: Verify email addresses can actually receive mail
• How it works: Check email domain has valid MX records in DNS
• Data sent: Email domain only (not full email address)
• Applied to: Account signup (always) and flow forms with email fields (configurable)
• Privacy: Standard DNS protocol, no personal data exposed

Rate Limiting:

• Purpose: Prevent abuse and spam
• Limits: 3 signup attempts per IP per hour, 3 flow submissions per IP per 24 hours per flow
• Data used: IP addresses
• Cannot be disabled or circumvented

Data Encryption:

• In transit: All connections use HTTPS with TLS 1.3 encryption
• At rest: Database encrypted by Supabase, files encrypted by Storj (end-to-end)
• Passwords: Hashed with bcrypt (industry-standard)
• Bearer tokens: Encrypted in Supabase Vault with zero-knowledge architecture

No Guarantees: Despite our security measures, no system is 100% secure. We cannot guarantee absolute security but follow industry best practices.

6. How We Share Your Information

Service Providers: We share data with third-party providers (Section 4) only as necessary to operate the Service. Providers are contractually bound to protect data, but we are not liable for their actions.

Law Enforcement & Legal Requests: We may disclose information when legally required:

• Court orders, subpoenas, warrants
• Valid legal process under Hong Kong SAR law or international law enforcement with proper jurisdiction
• Emergency situations involving imminent threat to life or safety (may disclose without legal process)
• We will notify you of legal requests when legally permitted (may be prohibited by court order)

Business Transfers: If QRoss is acquired, merged, or undergoes a business transfer, your information may be transferred to the successor entity. You will be notified of such transfers.

Flow Data:

• Submission data collected through your flows is controlled by you
• You decide who receives this data through webhook configurations
• We process submission data on your behalf as a data processor
• You are responsible for how you use and share submission data

Aggregate Data: We may share anonymized, aggregate statistics about Service usage (no personal identifiers included).

We Do NOT:

• Sell your personal information to third parties
• Share your data with advertisers or marketing companies
• Use your data for purposes unrelated to providing the Service
• Share bearer tokens or passwords (encrypted/hashed)
• Give unauthorized access to your submission data

7. Data Retention

Active Accounts: Data stored indefinitely while your account is active and in use.

Deleted Accounts:

• Account deactivated immediately upon deletion request
• Data purged within 30 days of deletion request
• Backups may retain data for up to 90 days, then automatically purged
• Cannot be recovered after purging

Logs & Technical Data:

• Server logs retained for 30 days
• Security logs may be retained longer if required for investigations
• Analytics data (anonymized) retained indefinitely

Legal Holds: Data retention may be extended when required by law, ongoing legal proceedings, or regulatory investigations.

Flow Data:

• Flows and submissions retained until you delete them
• Deleted flows purged according to the same schedule as account deletions

8. Your Rights

You have rights regarding your personal data:

Access & Export:

• View data: Access all your information through the QRoss dashboard
• Export submissions: Download events and submissions in CSV or JSON format
• Download files: Retrieve uploaded logos and images
• Request full export: Email [email protected] for complete data export

Correction & Deletion:

• Update information: Modify account details, flow configurations, and submissions anytime through the dashboard
• Delete flows: Remove individual flows and their submissions
• Delete account: Email [email protected] to close your account and delete all data
• Deletion timeline: Data purged within 30 days (backups up to 90 days)

Control & Preferences:

• Security settings: Choose whether to enable Turnstile per flow
• Data collection: Configure what form fields to collect
• Webhooks: Control where submission data is sent
• Upgrade tracking: Opt out by emailing [email protected]
• Close account: Terminate service anytime

Regional Rights:

Hong Kong Personal Data (Privacy) Ordinance:

• Right to access your personal data (first request free of charge)
• Right to correct inaccurate data
• Right to request erasure of data
• Right to complain to the Privacy Commissioner for Personal Data: https://www.pcpd.org.hk
• We comply with the six Data Protection Principles of the Ordinance

GDPR (European Union): If you are in the EU, you have additional rights:

• Right to data portability (structured, machine-readable format)
• Right to object to processing
• Right to restrict processing
• Right to withdraw consent
• Right to lodge complaint with supervisory authority

CCPA (California): If you are a California resident:

• Right to know what personal information is collected
• Right to know if personal information is sold or disclosed (we do not sell data)
• Right to delete personal information
• Right to opt-out of sale (not applicable - we don't sell data)
• Right to non-discrimination for exercising CCPA rights

Exercise Your Rights:

Email [email protected] with your request. We will respond within 5 business days during alpha testing (best effort). We may require verification of your identity before processing requests.

9. International Data Transfers & Cookies

International Transfers: Your data may be processed, stored, or accessed in multiple countries globally:

• Service providers operate in various jurisdictions
• Storj distributes files across decentralized nodes worldwide
• Cloudflare operates a global edge network
• We ensure adequate protections for international data transfers
• GDPR adequacy mechanisms and standard contractual clauses used where applicable

Cookies & Tracking: We use minimal cookies for essential functionality:

Essential Cookies:

• Authentication tokens (keep you logged in)
• Session management
• Security (CSRF protection)
• Cannot be disabled without breaking functionality

Turnstile:

• Cloudflare Turnstile may set cookies for bot detection
• No long-term tracking
• Privacy-focused alternative to reCAPTCHA

No Tracking/Advertising Cookies:

• We do not use analytics cookies during alpha
• No third-party advertising or tracking cookies
• No social media tracking pixels

Browser Settings: You can disable cookies in your browser settings, but this may prevent you from using QRoss.

10. Children's Privacy

QRoss is not directed to children under 18 years of age. We do not knowingly collect personal information from anyone under 18.

If we learn we have collected information from someone under 18, we will delete it immediately. If you believe we have information from someone under 18, contact [email protected].

11. Third-Party Links

QRoss may contain links to external websites or services. We are not responsible for the privacy practices or content of third-party sites. Review their privacy policies before providing any information.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be announced via:

Material Changes: Changes affecting how we collect, use, or share personal data will be announced with 2 weeks advance notice via:

• Email to your registered address
• Banner notification in the QRoss dashboard
• Updated "Last Updated" date at the top of this policy

Non-Material Changes: Minor clarifications, contact information updates, or service provider name changes may be made without advance notice. Check this policy regularly.

Your Options:

• Continued use of QRoss after changes become effective constitutes acceptance
• If you disagree with changes, you may close your account before the effective date
• You may export your data before the effective date

Effective Date: Material changes take effect 2 weeks (14 days) after notification.

13. Contact Us

Privacy Inquiries & Data Requests: [email protected]

General Support: [email protected]

Abuse Reports: [email protected]

Hong Kong Privacy Commissioner: https://www.pcpd.org.hk

Entity: 3DF Limited
Hong Kong Special Administrative Region

Response Time: 5 business days (best effort during alpha testing)

By using QRoss, you acknowledge that you have read and understood this Privacy Policy and agree to the collection, use, and disclosure of your information as described herein.