Privacy policy

1. Who we are

TrackQr is a Shopify app operated by Nexa Labs, based in Cotonou, Benin ("we", "us"). This policy covers the TrackQr app, the scan and campaign pages it serves to shoppers, and this website. You can reach us at bernadoecom@gmail.com.

2. Our role

• For merchants (Shopify stores that install TrackQr), we are the controller of account and store information needed to run the service and bill it through Shopify.
• For shoppers who scan a merchant's QR code or use a merchant's campaign page, the merchant is the controller and we process the data on the merchant's behalf, under their instructions, to provide TrackQr.
• For visitors of this website, we are the controller of the limited data described in section 4.8.

3. Summary

• We never store a shopper's IP address in clear: it is hashed with a salt that changes every day.
• Scans are anonymous: we don't know who scanned, only when, from which kind of device and roughly where (country).
• The only personal data we keep about shoppers is what they choose to enter on a campaign page (usually an email address).
• We don't sell data, and we don't use it for advertising.
• When a merchant uninstalls TrackQr, their store's data is deleted 48 hours later.

4. Information we process

4.1 Merchant account and store information

When you install TrackQr, Shopify shares your store's domain, name, contact email, currency, time zone and primary language, plus the access token that lets the app call the Shopify API on your behalf. We also keep your plan and subscription status as reported by Shopify, and your app settings (for example your admin language).

4.2 Content you create

QR codes, their destinations, designs and schedules, campaign pages and their content, and images you upload (such as logos and campaign images).

4.3 Scan data

When someone scans a TrackQr code, we record:

• the date and time, the QR code scanned and, for per-order codes, the order reference printed on it;
• a hash of the IP address (SHA-256 with a daily salt) — never the IP address itself;
• the approximate country, as provided by our hosting provider's geolocation;
• the device type, operating system, browser, user agent and referring page;
• the smart-routing rule or A/B variant used, if any;
• a random session identifier, stored in a cookie for 7 days, used to count unique visitors and attribute orders.

Automated traffic identified as bots is not recorded.

4.4 Campaign pages and leads

We count campaign page views. When a shopper submits a form on a campaign page, we store the email address and any other fields the merchant added, whether the shopper ticked the marketing-consent box, a hash of the IP address, a short summary of the browser, and — if the merchant enabled it — the unique reward code given to the shopper. On the Growth plan, a merchant can ask TrackQr to create the lead as a customer in their Shopify store; TrackQr only does so after the merchant grants the corresponding Shopify permission.

4.5 Order data for attribution

On the Growth plan, TrackQr receives Shopify order notifications to match orders to scans. We keep the order ID, the order number, its total amount and currency, and the scan it was matched to. We don't store the customer's name, address or payment details from those notifications.

4.6 The storefront app embed

When a merchant enables the "TrackQr attribution" app embed, a small script on their online store keeps the scan ID in the shopper's browser (local storage, for 7 days) and adds it to the cart as cart attributes, so the resulting order can be matched to the scan. It contains no personal information.

4.7 Emails and support

We send merchants service emails, such as lead alerts and the weekly report. When you contact us, we keep your messages and the information you share so we can help you.

4.8 This website

This website uses Vercel Web Analytics, which measures page views in aggregate without cookies. Your theme preference (light or dark) is stored in your browser only. Our hosting provider keeps standard server logs for security.

5. Cookies and similar technologies

• tqr_sid — a first-party, HttpOnly cookie set when a code is scanned, valid for 7 days, used for unique-visitor counts and attribution.
• tqr_attr — a local-storage entry on the merchant's online store (app embed), valid for 7 days, holding the scan ID.
• trackqr-theme — a local-storage entry on this website remembering your theme.

TrackQr sets no advertising cookies. Campaign pages load web fonts from Google Fonts. If a merchant adds their own Google Analytics 4 or Meta Pixel identifiers to a campaign page (Growth plan), those services set their own cookies under the merchant's responsibility, including obtaining any consent required.

6. How we use information

• to provide TrackQr: redirect scans, serve campaign pages, compute analytics and attribute orders;
• to send the emails you asked for (lead alerts, weekly reports) and answer support requests;
• to manage plans and quotas with Shopify Billing;
• to keep the service secure and prevent abuse, for example by filtering unsafe link types;
• to improve the product, using aggregated and de-identified statistics;
• to comply with legal obligations and Shopify's requirements.

7. Legal bases (EEA, UK and similar laws)

We rely on the performance of our contract with merchants, on our legitimate interests (security, abuse prevention, product improvement, website statistics) and on legal obligations. Marketing consent collected on campaign pages is collected by the merchant, for the merchant's own purposes.

8. Service providers

We use the following providers to run TrackQr, under contracts that protect the data they process:

• Shopify — app platform, authentication and billing;
• Vercel — hosting of the app, the scan and campaign pages, and this website;
• a managed PostgreSQL database provider — storage of the data described above;
• Cloudinary — storage and delivery of images uploaded to campaign pages;
• an email delivery provider — lead alerts and weekly reports;
• Google Fonts — web fonts on scan and campaign pages.

The current list of providers is available on request.

9. International transfers

Our providers may process data outside your country, including in the United States and the European Union. Where required, transfers rely on appropriate safeguards such as the European Commission's standard contractual clauses.

10. Retention

• Store data, scans, leads and attributed orders are kept while TrackQr is installed on the store, so merchants keep their history. The analytics history shown depends on the plan.
• When a merchant uninstalls TrackQr, all of their store's data is deleted 48 hours later, when Shopify sends the corresponding data-deletion request.
• Support emails are kept as long as needed to handle the request and our legitimate records.

11. Security

Data is encrypted in transit (HTTPS). Access to production systems is restricted. IP addresses are only stored as daily-salted hashes, and campaign data is scoped to the store that owns it.

12. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict its processing, and to complain to a data-protection authority.

• Merchants can write to us at bernadoecom@gmail.com.
• Shoppers should contact the store that ran the campaign: as the controller, the merchant handles the request, and Shopify forwards it to TrackQr. When asked, we send the merchant the data linked to the shopper's email address, or delete it.

13. Children

TrackQr is a business tool and is not directed to children.

14. Changes

We will update this page when our practices change and adjust the date at the top. Significant changes will be announced in the app or by email.

15. Contact

Nexa Labs — Cotonou, Benin — bernadoecom@gmail.com. See also our terms of service.