Terms of Service

Last Updated: January 7, 2025
Effective Date: January 7, 2025
Version: 1.0.0-alpha
Entity: 3DF Limited
Jurisdiction: Hong Kong Special Administrative Region
Contact: [email protected]

1. Acceptance & Eligibility

By accessing or using QRoss (the "Service"), you agree to be bound by these Terms of Service ("Terms"). If you do not agree, do not use the Service.

Eligibility: You must be at least 18 years old to create an account and use QRoss.

2. Alpha Service - No Warranties

ALPHA TESTING STAGE: QRoss is currently in alpha testing. The Service is provided on an "AS IS" and "AS AVAILABLE" basis without warranties of any kind.

You Acknowledge:

• The Service may be unstable, contain bugs, or experience outages
• Features may change, be modified, or removed without notice
• Data loss may occur despite backup efforts
• Supabase Vault (beta) for bearer token storage may have limitations or bugs
• The Service may be discontinued at any time with or without notice
• No service level agreements (SLAs) are in effect
• Support is provided on a best-effort basis

Your Responsibility:

• Maintain your own backups of critical data
• Export data regularly
• Do not rely on QRoss for mission-critical flows during alpha testing
• Test configurations thoroughly before publishing flows

3. Service Description

QRoss is a QR code flow management platform that enables you to:

• Create custom flow registration forms
• Collect form submissions with automatic metadata enrichment
• Configure webhooks to send data to external APIs
• Set up redirects to websites or external systems
• Generate QR codes for flow access
• Manage and export submission data

4. Your Account

Registration Requirements:

• Provide accurate and complete information
• Use a valid, permanent email address (disposable email services are blocked)
• Maintain one account per person
• Keep your password secure and confidential

Account Security: You are responsible for all activity under your account. Notify us immediately of any unauthorized access.

Account Deletion: To delete your account, email [email protected]. Data will be purged within 30 days (backups retained up to 90 days).

5. Your Responsibilities & Prohibited Use

You Must:

• Comply with all applicable laws and regulations, including but not limited to:
  • Hong Kong Personal Data (Privacy) Ordinance
  • General Data Protection Regulation (GDPR) if applicable
  • California Consumer Privacy Act (CCPA) if applicable
  • Any other data protection laws in your jurisdiction
• Provide clear privacy notices to flow page visitors about data collection
• Obtain necessary consents for collecting personal data
• Secure bearer tokens and API credentials
• Rotate bearer tokens regularly according to security best practices
• Test flow configurations before publishing to visitors
• Use the Service only for lawful purposes

Prohibited Activities: You may not:

• Use the Service for any illegal, harmful, or malicious purposes
• Engage in phishing, social engineering, spam, fraud, or harassment
• Collect data without proper consent or privacy notices
• Distribute malware or malicious links through flows
• Impersonate others or misrepresent your identity or affiliation
• Circumvent security measures, rate limits, or access controls
• Use VPNs, proxies, or other methods to evade rate limiting
• Employ bots, scripts, or automation to bypass security (including Turnstile)
• Attempt unauthorized access to the Service or other users' accounts
• Interfere with or disrupt the Service's operation
• Reverse engineer, decompile, or extract source code
• Resell or redistribute the Service without authorization

Consequences of Violations: Immediate account suspension or termination without refund, notice, or recourse. We may also report violations to law enforcement.

6. Third-Party Service Providers

QRoss uses multiple third-party service providers to operate. We reserve the right to change, add, or remove service providers at any time without notice.

Current Providers (as of January 7, 2025):

Important Notes:

• Data may be processed in multiple geographic locations
• Specific regions are not guaranteed and may change
• We are not liable for service provider outages, security breaches, policy changes, or service discontinuation
• Provider terms and privacy policies govern their services
• Supabase Vault (beta) stores bearer tokens with zero-knowledge encryption (QRoss staff cannot access token values)

7. Security Measures

We Implement:

Bot Protection:

• Cloudflare Turnstile on signup pages (always enabled)
• Cloudflare Turnstile on flow submission pages (configurable per flow)
• Flow creators may disable Turnstile for specific flows at their own risk

Email Validation:

• Blocking of known disposable and temporary email services
• DNS/MX record verification to ensure valid email domains
• Applied to account signup (always) and flow forms (configurable)

Rate Limiting:

• Account signup: Maximum 3 attempts per IP address per hour
• Flow submissions: Maximum 3 submissions per IP address per 24 hours per flow
• Cannot be circumvented or disabled

If You Disable Turnstile: By disabling Turnstile bot protection for a flow, you acknowledge and accept that:

• Your flow becomes vulnerable to spam and automated bot submissions
• Only IP-based rate limiting will remain as protection
• You assume all risks from spam, fake data, and bot abuse
• We are NOT liable for any spam submissions, data quality issues, webhook costs, or damages resulting from your choice to disable Turnstile
• You will receive warnings and must acknowledge these risks before disabling

Prohibited: You may not attempt to circumvent, disable, or interfere with any security measures.

8. Data Ownership & Use

Your Data:

• You own and control all flow configurations and form submission data
• You grant us a license to store, process, and transmit your data solely to provide the Service
• We process submission data on your behalf as a data processor
• You are the data controller for submissions collected through your flows

Our Use:

• We may access your data to provide customer support and troubleshoot issues
• Customer support staff are bound by confidentiality and access is logged
• We collect aggregate, anonymized analytics to improve the Service
• We do not sell your data or use it for unrelated purposes

Bearer Tokens:

• API bearer tokens are stored encrypted in Supabase Vault (beta)
• Zero-knowledge architecture: QRoss staff cannot access token values in plaintext
• Tokens are used only to send webhooks as you configured
• You are responsible for token security, permissions, and rotation
• We cannot recover lost tokens

Support Access: When you request customer support:

• Support staff may access your account information, flows, and submissions
• Access is limited to what's necessary to resolve your issue
• You may request limited access, though this may affect our ability to help
• All support access is logged for security and accountability

9. Abuse Reporting & Malicious Use

Prohibited Malicious Activities: QRoss may not be used for phishing, fraud, spam, harassment, data theft, malware distribution, privacy violations, or any illegal activities.

We Are NOT Liable: We are not liable for damages caused by malicious actors using the Service. However, we will take reasonable steps to address verified abuse.

Report Abuse:

• Email: [email protected] or [email protected]
• Include: Flow URL, description of malicious activity, evidence, and your contact information
• Law enforcement: Include badge number, case number, and legal documentation

Our Response: Upon verification of malicious activity, we may:

• Immediately disable the reported flow
• Suspend or terminate the user's account
• Preserve evidence for law enforcement investigations
• Cooperate with legal authorities
• Block IP addresses or domains if necessary

Response Timeline:

• Urgent threats or active attacks: Within 24 hours
• Law enforcement requests: Immediate response
• General abuse reports: Within 5 business days

Limitations:

• We cannot monitor all flows for malicious activity
• We rely on user reports and automated detection systems
• We cannot undo harm already caused by malicious use
• We cannot guarantee prevention of all malicious activities

Indemnification: If you engage in malicious activities using QRoss, you agree to indemnify us from all resulting claims, damages, and legal costs.

10. Subscriptions & Billing

Current Status: QRoss is currently free during alpha testing. No payment is required.

Upgrade Interest Tracking: When you click an "Upgrade" button in the application:

• We record which subscription plan you attempted to upgrade to
• We record the timestamp of your attempt
• This data is used to gauge interest in paid plans
• We may notify you when paid subscriptions become available
• You may opt out by contacting [email protected]

Future Paid Plans: When subscription plans launch:

• Payment processing will be handled by Stripe
• Billing will be monthly or annual depending on plan selected
• All sales are final - NO REFUNDS under any circumstances, except:
  • Billing errors (will be corrected)
  • Duplicate charges (will be refunded)
  • Service not provided due to our error (pro-rated refund may be issued)
• Automatic renewal unless you cancel
• Access continues until the end of your billing period after cancellation
• No refunds for partial months/years or early cancellation
• No refunds for account termination due to Terms violations
• We may change pricing with 30 days advance notice
• Price changes do not affect current subscription periods

11. LIMITATION OF LIABILITY

TO THE MAXIMUM EXTENT PERMITTED BY LAW, 3DF LIMITED SHALL NOT BE LIABLE FOR ANY DAMAGES ARISING FROM:

Your Choices & Configuration:

• Incorrect or insecure configurations (webhooks, redirects, bearer tokens, form fields, security settings)
• Disabling security features (Turnstile bot protection)
• Using insecure endpoints, credentials, or API tokens
• Misconfigured privacy settings or inadequate privacy notices
• Sending data to wrong recipients due to configuration errors
• Bearer tokens with excessive permissions or compromised credentials

Your Use of the Service:

• Data you collect and how you process, store, or share it
• Compliance failures with data protection laws (GDPR, CCPA, PDPO, etc.)
• Privacy violations or failure to obtain proper consents
• Harm to event attendees from your data handling practices
• Claims by individuals affected by your events

Third-Party Services:

• Service provider outages, performance issues, or unavailability
• Data breaches or security incidents at service providers
• Changes to provider terms, pricing, or availability
• Provider discontinuation or migration issues
• Geographic data location or international data transfers
• Your webhook recipients or their systems/security

Security & Malicious Activity:

• Malicious actors using the platform for harmful purposes
• Spam, bot submissions, or automated abuse (especially if you disabled Turnstile)
• Phishing, fraud, or other malicious events created by users
• Data breaches at your endpoints or in your systems
• Attacks on your events or infrastructure
• Harm to victims of malicious events

Alpha/Beta Stage:

• Service instability, bugs, errors, or unexpected behavior
• Data loss or corruption during alpha testing
• Service interruptions, downtime, or performance degradation
• Supabase Vault (beta) limitations, bugs, or security issues
• Changes to features, functionality, or availability
• Service discontinuation with or without notice
• Migration or provider transition issues

Types of Damages: We are not liable for any direct, indirect, incidental, consequential, special, exemplary, or punitive damages, including but not limited to:

• Lost profits, revenue, or business opportunities
• Loss of data or information
• Loss of goodwill or reputation
• Cost of substitute services
• Webhook processing costs or API rate limit fees
• Legal fees or regulatory penalties
• Any other commercial or economic losses

Maximum Liability: Our total aggregate liability for any claims arising from or related to these Terms or the Service shall not exceed the total amount you paid to QRoss in the 12 months preceding the claim. During the free alpha period, this amount is zero (HK$0).

AS-IS SERVICE: THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, NON-INFRINGEMENT, ACCURACY, OR QUIET ENJOYMENT.

We do not warrant that:

• The Service will be uninterrupted, timely, secure, or error-free
• Results obtained from the Service will be accurate or reliable
• The quality of the Service will meet your expectations
• Any errors or defects will be corrected
• The Service will be compatible with your systems or requirements

12. Indemnification

You agree to indemnify, defend, and hold harmless 3DF Limited, its officers, directors, employees, agents, and affiliates from and against any and all claims, damages, losses, liabilities, costs, and expenses (including reasonable legal fees and costs) arising from or related to:

Your Violations:

• Your breach of these Terms of Service
• Your violation of any applicable laws or regulations
• Your violation of any third-party rights (intellectual property, privacy, publicity, etc.)

Your Use:

• Your use or misuse of the Service
• Your flow configurations, content, or data collection practices
• Your webhooks, API integrations, or bearer tokens
• Data you collect and how you process, store, or share it

Your Data Handling:

• Privacy violations or failure to provide adequate privacy notices
• Failure to obtain necessary consents for data collection
• Non-compliance with data protection laws (GDPR, CCPA, PDPO, etc.)
• Claims by flow page visitors regarding their data

Malicious Use:

• If you engage in malicious, fraudulent, or illegal activities using QRoss
• Claims by victims of your malicious flows
• Costs incurred investigating or mitigating your abuse

Third-Party Claims:

• Claims by your flow page visitors
• Claims by your webhook recipients or API providers
• Claims by individuals affected by your use of the Service

This indemnification obligation survives termination of your account and these Terms.

13. Dispute Resolution

Governing Law: These Terms are governed by and construed in accordance with the laws of the Hong Kong Special Administrative Region, without regard to conflict of law principles.

Dispute Resolution Process:

1. Informal Resolution (Required First Step): Before initiating any legal proceedings, you must first attempt to resolve the dispute informally:

• Email [email protected] with a detailed description of the dispute
• We will respond within 5 business days
• Both parties will negotiate in good faith for 30 days

2. Formal Legal Proceedings: If informal resolution fails:

• You agree to the exclusive jurisdiction of the courts of Hong Kong SAR
• Any legal action must be brought in Hong Kong courts
• You waive any objection to venue or jurisdiction in Hong Kong

3. Small Claims: For disputes involving amounts under HK$75,000, either party may use the Hong Kong Small Claims Tribunal for faster, less formal resolution.

Language: These Terms are written in English. Any translation is provided for convenience only. In case of conflict between the English version and any translation, the English version shall prevail.

14. Changes & Termination

Changes to Terms: We may update these Terms at any time. Material changes will be announced via:

• Email notification to your registered email address
• Notice in the QRoss dashboard upon login
• Updated "Last Updated" date at the top of this document

Continued use of the Service after changes become effective constitutes acceptance of the new Terms.

We May:

• Modify, suspend, or discontinue the Service (or any part) at any time
• Change features, functionality, or availability without notice
• Suspend or terminate accounts for Terms violations
• Refuse service to anyone for any reason

You May:

• Close your account at any time by emailing [email protected]
• Export your data before closing your account
• Discontinue use of the Service

Effect of Termination:

• Your access to the Service will be immediately revoked
• Your account data will be deleted within 30 days
• Backups may retain data for up to 90 days, then automatically purged
• Sections that by their nature should survive (Limitation of Liability, Indemnification, Dispute Resolution) remain in effect
• No refunds will be provided for unused subscription time (when applicable)

15. Miscellaneous

Entire Agreement: These Terms, together with our Privacy Policy, constitute the entire agreement between you and 3DF Limited regarding the Service and supersede all prior agreements and understandings.

Severability: If any provision of these Terms is found to be invalid, illegal, or unenforceable, the remaining provisions shall remain in full force and effect.

No Waiver: Our failure to enforce any provision of these Terms shall not constitute a waiver of that provision or any other provision.

Assignment: You may not assign or transfer these Terms or your account without our prior written consent. We may assign these Terms to any affiliate, successor, or acquirer without restriction.

Force Majeure: We are not liable for any failure or delay in performance due to circumstances beyond our reasonable control, including but not limited to acts of God, natural disasters, war, terrorism, riots, embargoes, acts of civil or military authorities, fire, floods, accidents, pandemics, network infrastructure failures, strikes, or shortages of transportation facilities, fuel, energy, labor, or materials.

Notices: All notices to QRoss must be sent to: [email protected]

We will send notices to the email address associated with your account.

No Agency: Nothing in these Terms creates any agency, partnership, joint venture, or employment relationship between you and 3DF Limited.

Third-Party Rights: These Terms do not confer any third-party beneficiary rights.

16. Contact Information

Support & General Inquiries: [email protected]

Privacy Inquiries: [email protected]

Abuse Reports: [email protected]

Law Enforcement: [email protected]

Response Time: 5 business days (best effort during alpha testing stage)

Entity: 3DF Limited
Jurisdiction: Hong Kong Special Administrative Region
Version: 1.0.0-alpha
Stage: Alpha Testing

By using QRoss, you acknowledge that you have read, understood, and agree to be bound by these Terms of Service.