Privacy policy

• We never store the IP address of anyone who scans a code. We store a hash that is salted and rotated daily, so a scanner cannot be followed from one day to the next — not by us, not by you, not by anyone who obtained the data.
• The redirect sets no cookies. Nothing is dropped on the phone of someone scanning your code.
• Scan records hold country, city, device type, operating system and browser. Never a name, never an address, never an advertising identifier.
• We never see your card details. Paystack handles payment.
• We do not sell data, and we do not use one customer's scan data for anything but that customer.

Under the Nigeria Data Protection Act 2023, De Sign Plus is the data controller for QRiate+ account data — your name, your email, your billing record — and a data processor for the scan data we collect on our customers' behalf.

So if you are a customer, this page tells you what we hold about you and what we do with it. If you are a customer's customer, who scanned a code on a label or a poster, the section on scan data is the one that concerns you.

What we hold

Your business or contact name, your email address, whether that address has been confirmed, and a one-way hash of your password. We never hold the password itself.

Why

To give you an account, to let you sign in, and to reach you about things that affect your printed codes: a failed payment, a blocked code, the end of a grace period.

On what basis

To perform our contract with you, and to meet legal obligations such as keeping billing records.

Accounts are handled by Neon's managed authentication service, which stores the account record and the password hash. Your profile row in our own database holds only your name and email.

For each code: its short code, the label you gave it, its current destination, when it was created and changed, and whether it is live, paused or blocked. Destinations are web addresses, which can themselves contain personal data if you put it there — a tracking parameter with a customer's name, for instance. Try not to.

When someone scans a code, we record one row: the code scanned, the time, the country and city, the device type, the operating system, the browser, whether we believe the request came from a bot or a link preview, and a hashed visitor value.

That hashed value is the one part worth explaining. It is a SHA-256 hash of the scanner's IP address combined with a secret salt and the date. The raw address is never written to the database and never written to a log. Because the date is part of the hash, the same phone scanning the same code on two days produces two unrelated values: unique counts work within a day, and tracking across days is not possible even for us.

Country and city come from the hosting network's own geographic header. We run no IP geolocation database, and when that header is absent the field is simply empty.

The redirect sets no cookies, runs no analytics script and loads nothing in the scanner's browser. It answers with a redirect and nothing else.

Where a very high volume of requests arrives from one address, we stop recording those scans — but still serve the redirect. The printed code working matters more than the count being complete.

Payments run through Paystack. Your card details go to Paystack and never to us: we hold the transaction reference, the plan, the amount, the status and the period it covers. Paystack's own privacy terms govern what they hold.

One cookie, and only when you sign in: the session cookie that keeps you signed in to your dashboard. It is strictly necessary, so it needs no consent banner, and signing out clears it.

There are no advertising cookies, no analytics cookies and no third-party trackers anywhere on this site — including on the redirect and on the status pages a scanner might land on.

Transactional messages only: confirming your address, resetting your password, receipts, a failed payment, a grace period ending, a code blocked. They are sent through Resend, which processes your address to deliver them. We do not send marketing email without asking you first.

A short list, kept short on purpose. Each is bound by contract to process data only on our instructions.

Neon

The database, the managed authentication service that holds account records, and object storage for generated artwork.

Vercel

Hosting and the redirect itself, including the geographic header that gives us a scan's country.

Upstash

A cache and a rate limiter. It holds destination lookups and scan counters keyed on the hashed visitor value, never anything identifying.

Paystack

Payments and subscriptions.

Resend

Sending the transactional email above.

A URL reputation service

Destination screening checks a link against a reputation service. It receives the destination address, which is a customer's own link and not a scanner's data.

Our hosting and database providers operate outside Nigeria, so account and scan data is processed abroad. Where the NDPA requires safeguards for that, they come from our contracts with each provider. If you need to know the specific regions for a procurement review, ask and we will tell you.

Individual scan records

For the scan history window your plan provides — between 90 days and 24 months, shown on your plan page — after which each row is deleted. Nothing is deleted before it has been counted.

Daily totals

Once individual records expire, only daily totals per code, country and device type remain. They carry no visitor value of any kind and are what your older charts are drawn from.

Your account and codes

For as long as your account is open. Pausing, lapsing and suspension all keep everything intact.

After an account closes or lapses

6 months, then deleted. Printed material outlives a missed payment, so a late return restores everything; past that there is no reason for us to hold it.

Abuse reports

Up to 24 months, so a pattern of abuse across accounts can be recognised.

Billing records

As long as tax and company law require us to keep them, which is longer than the rest.

If you are a customer, you can ask us to show you what we hold, correct it, delete it, or hand it to you in a portable form. You can object to a particular use, and you can withdraw consent where consent is what we relied on.

Some of this you can do yourself: your settings page shows your account data, and scan history for a code can be exported as CSV where your plan includes it. The export deliberately leaves out the hashed visitor value — it is not an address, but handing out a per-day identifier for your customers is more than anyone needs.

For anything else, write to hello@qriateplus.com and we will answer within 30 days. If we have got it wrong, you can complain to the Nigeria Data Protection Commission.

We hold no name, no email address, no phone number and no raw IP address for you, and the hashed value we do hold is rotated daily and cannot be reversed. In practice there is nothing we can retrieve, correct or delete on request, because there is nothing we can connect to you.

Whatever the code led you to is a different matter. That site belongs to the business that printed the code, and its own privacy notice governs it. If a code has led you somewhere harmful, use the "Report this link" form on any of our status pages, or write to hello@qriateplus.com.

The service is for businesses, and accounts are not for anyone under 18. We do not knowingly collect data about children, and we do not ask the age of anyone scanning a code.

If we change this policy in a way that materially affects you, we will email you before it takes effect. The date at the top always shows the current version.

Questions, requests and complaints about personal data: hello@qriateplus.com.