Privacy policy

ShellRick Tech Pty Ltd t/a Qrop is the responsible party for the personal information described in this policy.

Registration number: 2025/619155/07
Registered address: 3 Grosvenor Road, Diep River, 7800, Cape Town

Requests, complaints, or questions about how we handle your personal information can be directed to our Information Officer:

Frederick Niekerk
Email: informationofficer@shellricktech.co.za

Depending on how you use Qrop, we process:

• Account information: name, email address, phone number, and (for company accounts) a company name, collected at registration and verified via one-time codes.
• Marketing preference: whether you chose to receive product updates and offers by email, and when and how you chose it. We only send these if you opt in, and every message has an unsubscribe link. You can also change the choice in your account settings at any time. Receipts and notices about your account are not marketing and are sent regardless.
• Billing information: credit purchases, subscription plan, and payment status. Card details are entered directly into PayFast’s hosted payment page and never touch our servers.
• API key metadata: a salted hash of each API key, a label you choose, and last-used timestamps. We never store API keys in plain text.
• Generation records: the data type, format, and resolution of each QR code you generate, and the IP address of anonymous (logged-out) requests, used for daily rate limiting and abuse detection. IP addresses are automatically removed after 30 days.
• Scan data for tracked codes: when someone scans a tracked QR code we record the time, approximate location (country, region and city, from their network connection), device type, operating system, browser, language, and referring site. We do not store the scanner’s IP address. To count unique scanners we store a one-way hash of the IP address and browser that changes every day, so it cannot be used to recognise anyone across days or to recover the IP address.
• Webhook endpoints: if you add a webhook, we store its address, a signing secret and any custom headers you add (both encrypted), and a short log of each delivery (time, result and error, not the content). We send the scan details described above, without the visitor hash, to the address you chose. Once they arrive there you are responsible for them.

We do not read, store, or scan the content you encode into a QR code (URLs, Wi-Fi credentials, contact cards, etc.) beyond what is technically required to generate the image and return it to you.

• To create and operate your account, and generate QR codes you request (contract).
• To bill credit purchases and API subscriptions (contract, legal obligation).
• To prevent abuse of the free anonymous tier through IP-based rate limiting (legitimate interest).
• To respond to support requests and Information Officer enquiries (legitimate interest).
• To count and report scans of the tracked codes you create, so you can see how they perform (contract).
• To send you emails about your account, such as receipts, payment problems, allowance notices and tracked-code reminders (contract, legal obligation).
• To send you product updates and offers by email, only if you have opted in (consent). You can withdraw consent at any time with the unsubscribe link in each email or in your account settings.
• To show advertising on the free tier (anonymous or registered, never paying accounts), only where you have given consent (consent).

We share personal information with the following operators, strictly to provide the service. None of them may use your information for their own purposes:

• Amazon Web Services (Cognito): authentication and identity verification, hosted in Cape Town, South Africa (af-south-1).
• Vercel: application hosting and compute, served from Cape Town, South Africa and Frankfurt, Germany (EU).
• Neon: database hosting for account, billing, and generation records, hosted in Frankfurt, Germany (EU).
• Upstash: short-lived rate-limit counters (Redis), keyed by IP or API key, hosted in Cape Town, South Africa.
• PayFast (Pty) Ltd: payment processing and subscription billing, hosted in South Africa. We share your name, email address, and the transaction amount with PayFast when you initiate a payment. Card details are entered directly on PayFast’s hosted payment page and never reach our servers. PayFast’s own privacy policy is available at payfast.co.za/privacy-policy.
• Amazon Web Services (Simple Email Service): sends our emails to you (receipts, account notices and, only if you opt in, product updates). It receives your email address, and your name where an email uses it. Hosted in Cape Town, South Africa.
• Google AdSense: only with your cookie consent, as described above.

Your account, billing, and generation records are stored in our Neon database in Frankfurt, Germany, and some of our application compute is served from Vercel’s Frankfurt region, both outside South Africa. These are cross-border transfers under section 72 of POPIA, and we rely on the fact that the European Union (including Germany) is recognised as having a data protection framework (the GDPR) that is at least equivalent to POPIA’s conditions for lawful processing. Authentication (AWS Cognito), email sending (Amazon SES), rate-limiting (Upstash), and the remainder of our application compute (Vercel) are located in Cape Town, South Africa. Google AdSense may also process data on servers outside South Africa (including the United States) as part of providing advertising; we rely on its standard data processing terms to impose safeguards equivalent to POPIA’s conditions in that case. We do not sell personal information to any third party.

• Account and billing records: for as long as your account is active, plus the period required by tax and financial record-keeping law thereafter.
• Anonymous rate-limit IP logs: rolling 30 days, then deleted automatically.
• Generation history: for as long as your account is active, so you can review past usage.
• Tracked-code scan data: deleted automatically one year after the tracked code was created, or sooner if you delete the code or your account.
• Marketing preference and welcome-email progress: for as long as your account is active, then deleted with it. If you opt out we keep the record that you did, so we do not email you again.

API keys are hashed with SHA-256 and shown in full only once, at creation. Passwords and identity verification are handled entirely by AWS Cognito and never touch our database. All traffic is served over HTTPS, and access to personal information in our systems is restricted to what each service needs to operate.

Strictly necessary cookies (session authentication, security) are always active and cannot be disabled, as the service cannot function without them. Advertising cookies (Google AdSense, shown only on the free tier, never to paying accounts) are off by default and only activate once you choose “Accept all” in the cookie banner. You can change your choice at any time by clearing the qrop_consent entry in your browser’s local storage and reloading the page.

Under POPIA, you have the right to:

• Be told what personal information we hold about you and why.
• Request access to, or a copy of, your personal information.
• Request correction of inaccurate or outdated personal information.
• Request deletion or de-identification of personal information we no longer have a lawful basis to keep.
• Object to processing based on legitimate interest, or to direct marketing, at any time.
• Lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za if you believe we have not handled your information lawfully.

Registered users can exercise the access and deletion rights directly from Account & privacy in the dashboard: download a full copy of your data as JSON, or permanently delete your account and personal information. For any other request, or if you don’t have an account, contact our Information Officer at informationofficer@shellricktech.co.za. We will respond within a reasonable time and may need to verify your identity first.

We may update this policy as the service changes. Material changes will be reflected on this page with an updated effective date.