Privacy Policy

This policy explains what personal data Oryx QR, operated by Oryx QR, collects and how it is used. It covers shop staff who use the dashboard and customers who open a shop page.

1. Shop accounts

We collect your name, email address, a hashed password, two-factor authentication settings, your language preference, and your shop's business details (name, address, phone, WhatsApp number, branding). We use them to run your account, send service emails such as password resets and renewal reminders, and handle billing and support.

For security we keep an audit log of account actions, which records the IP address and browser of the person who acted. Your login session also stores your IP address and browser while it is active.

2. Customers

• Page visits: we count visits and product views per day, device type and language. Raw IP addresses are not stored; a short-lived hash is used only to avoid counting page reloads twice.
• Feedback: if a customer leaves feedback, we store their ratings and comment, plus a name and contact detail only if they choose to give them. A hash of the IP address is kept to block spam. Feedback is visible only to that shop and our administrators.
• The shop decides what to do with feedback it receives and is responsible for it. We process it on the shop's behalf.

2a. Contact form

When you send a message from our website we store your name, email, and the phone number and shop name if you give them, along with your message and a hash of your IP address to block spam. Only our administrators read these messages, and we use them only to reply to you. The form may be protected by Google reCAPTCHA, which is subject to Google's Privacy Policy and Terms.

3. Cookies

We use only essential cookies: a session cookie to keep you signed in, a security token that protects forms, and your language choice. We do not use advertising or tracking cookies. If reCAPTCHA is switched on for the contact form, Google may set its own cookies on that page to tell people from bots.

4. Service providers

• Hosting and email: our hosting provider stores the data, and our email provider delivers service emails.

We do not sell personal data.

5. Retention

Account and product data are kept while the account exists and for a reasonable period afterwards so a lapsed subscription can be renewed. Audit logs are kept for security and may be purged after a retention period. You can ask us to delete your data sooner.

6. Security

Passwords are hashed, administrator accounts require two-factor authentication, each shop's data is isolated from others, and connections are encrypted with HTTPS.

7. Your rights

You can ask to see, correct, export or delete your personal data. Customers who left feedback can contact the shop or us. Email [email protected] and we will reply within 30 days.

8. Changes

We will post any changes here and update the date at the top. For material changes we will also contact account owners.