Privacy Policy

This Privacy Policy governs the collection, storage, use, and protection of personal data of users of the Qrbon service (the website qrbon.io and the mobile application Qrbon Ops, collectively the “Service”). The Service is owned and operated by ZiyaraGo Technologies (“Company”, “we”). By using the Service you consent to this Policy.

1. Data we process

We collect only the minimum data needed to operate the Service:

• Identification: venue name, owner / staff full name, job title.
• Contact: phone number, email, physical address of the venue.
• Account: login, password (hashed), activity history.
• Payment data: partially masked card details for cashless subscription payments.
• Technical data: IP address, device type, cookies, application logs.
• Operational data: orders, statuses, delivery history (needed for platform functionality).
• Push tokens: FCM token (Android) and APNs token (iOS) — only for order notifications.

We do not collect biometrics, political opinions, religious beliefs, health data, device geolocation, contacts, gallery photos / videos, advertising IDs or ATT tracking.

2. Purposes of processing

• Account creation and management;
• Providing access to QR storefront, orders, logistics and integrations;
• Subscription and payment processing;
• Order and system notifications (push, email);
• Service improvement and technical support;
• Compliance with applicable law (KSA PDPL, Uzbekistan Personal Data Law, EU GDPR where applicable).

3. Third parties (sub-processors)

We pass data to the following processors strictly for the purposes above:

• Google Firebase (Cloud Messaging, Firestore) — push notifications and order sync. Jurisdiction: US / EU.
• Apple APNs — iOS push delivery. Jurisdiction: US.
• OpenStreetMap — map tiles (only IP is shared).
• Payment providers (Payme, Click, mada, Apple Pay) — payment processing per their jurisdictions.
• Hosting provider — Hetzner Online GmbH (Germany, EU).

4. Legal basis

• Contract performance — for all data related to the subscription and platform operation;
• User consent — for push notifications (iOS / Android system dialog);
• Legitimate interest — for analytics and security;
• Legal obligation — tax and accounting records.

5. Retention

• JWT tokens in the app — until logout or refresh expiry;
• Account and venue — until admin revokes access;
• Order and financial history — 3 years (accounting);
• Push tokens — until app uninstall or logout (auto-revoked).

6. Your rights

You have the right to: access your data, correct it, delete it, restrict or object to processing, lodge a complaint with the supervisory authority (Saudi Data & AI Authority in KSA; Personal Data Protection Agency in Uzbekistan). Send requests to [email protected].

7. Security

• All network traffic — HTTPS / TLS 1.2+;
• Passwords are stored hashed (bcrypt);
• Mobile app tokens — Keychain (iOS) / EncryptedSharedPreferences (Android);
• Backend requires Bearer JWT on all protected endpoints.

8. Children

The Service is intended only for persons over 18 — staff of commercial venues. We do not knowingly process data of minors.

9. Policy changes

Material changes are announced in the app and/or by email at least 7 days before they take effect. The latest revision date is at the top of this document.