Privacy Policy

Qrop ("Qrop", "we", "our" or "us") connects local businesses with the people who visit them. Businesses publish a page; customers join it by scanning a QR code, then check in on their visits, claim rewards, leave reviews and message the business. This policy explains what personal information we collect when you use qrop.app, how we use it, who we share it with, and the choices you have.

It applies to customers who join businesses on Qrop, to the people who run a business page, and to visitors who browse the site without an account.

Information you give us

• Account details: your name and email address, and your phone number and profile photo if you add them. If you sign in with Google, we receive your name, email address and profile photo from Google.
• Profile details, all optional: your birthday (day and month only, never the year), gender, nationality, the area you live in (never your street address) and your interests.
• Your marketing preference: whether you are happy to hear about rewards and news from the businesses you join, and when you gave or withdrew that consent.
• Business details, if you run a page: your business name, address, opening hours, photos, rewards, links and everything else you publish on it.
• What you write: reviews, messages between customers and businesses, and notes a business keeps about its customers.
• Support requests: anything you send us through the Contact us form.

Information created when you use Qrop

• Activity: the businesses you join, your check-ins, and the rewards you claim and redeem, with when each happened.
• Page statistics: when someone views a business page or taps one of its links, we record the time, the referring site, the browser, device, operating system and language, and the IP address along with an approximate location derived from it (country, city and time zone). Businesses see these statistics for their own page.
• Online status: when you last had Qrop open, so a business can see whether you are online.
• The country you signed up from and how you heard about us, recorded once when you create your account.

How we use your information

• To run Qrop: to create and secure your account, sign you in, record visits and rewards, and deliver messages.
• To show the businesses you join who their customers are, as described below.
• To send service emails, such as your sign-in code. We do not send you marketing ourselves; promotions come from the businesses you join, and only if you opted in.
• To give businesses statistics about their page.
• To power optional AI features for businesses: help writing their page, a daily summary of their dashboard, and short briefings on a customer drawn from the business's own notes.
• To keep Qrop safe, prevent abuse and fix problems.
• To meet our legal obligations.

What businesses can see

When you join a business, it can see your name, profile photo, email address and phone number, the profile details you chose to share, whether you have opted in to promotions, and your activity with that business: visits, rewards, reviews and messages. It cannot see what you do at other businesses.

A business can export this information, for example as a spreadsheet, to use in its own tools such as an email marketing service. Once exported, the business is responsible for how it uses that information under the law that applies to it, including only sending promotions to customers who opted in. Notes a business keeps about you are private to that business.

Who we share information with

We use a small number of service providers to run Qrop. They process personal information only on our instructions and only to provide their service:

• Convex: database, file storage and application hosting
• Vercel: website hosting
• Resend: sending email
• Google: Sign in with Google, and the address search used to choose a location
• OpenAI and Google Gemini: processing for the AI features businesses use
• Cloudflare: domain and network services

We may also disclose information when the law requires it, to protect the rights and safety of our users or of Qrop, or as part of a merger, acquisition or sale of our business. We do not sell your personal information, and we do not share it for advertising.

Cookies

We only use the cookies Qrop needs to work, mainly to keep you signed in. We do not use advertising cookies or third-party tracking, and our page statistics are collected by Qrop itself rather than by an outside analytics company. The Sign in with Google button loads Google's own script on the sign-in page, which is covered by Google's privacy policy.

How long we keep it

• Account and profile information: for as long as your account is open. When you ask us to delete your account, we delete or anonymise your information within 30 days, unless we must keep something to meet a legal obligation.
• Memberships, visits, rewards, reviews and messages: for as long as both your account and the business's page exist, since they are the history you share with that business.
• Sign-in codes: they expire after 10 minutes.
• Page statistics: for as long as the business's page needs them for its reports.
• Support requests: for as long as it takes to resolve them.

Security

Information travels over encrypted connections, sign-in uses one-time codes rather than passwords, and access to personal information is limited to what each part of Qrop needs. No system is completely secure, so we cannot guarantee that information will never be accessed without permission.

International transfers

Some of our service providers process information outside the country you live in, including in the United States. Where the law requires it, we rely on appropriate safeguards, such as the European Commission's standard contractual clauses, for those transfers.

Your rights

Depending on where you live, you may have the right to access the personal information we hold about you, correct it, delete it, receive a copy in a portable format, object to or restrict how we use it, and withdraw any consent you have given.

You can update your profile and your marketing preference at any time in your account preferences. For anything else, contact us as described below.

If you are in the European Economic Area or the United Kingdom, we process your information because it is needed to provide Qrop to you (contract), for our legitimate interests in keeping Qrop secure, providing statistics and improving it, with your consent for optional profile details and your marketing preference, and to meet legal obligations. You also have the right to complain to your local data protection authority.

If you are a California resident, you have the right to know what personal information we collect and how we use it, to ask us to delete it, and not to be treated differently for exercising these rights. We do not sell or share personal information as those terms are defined under California law.

Children

Qrop is not intended for anyone under 16, and we do not knowingly collect personal information from them. If you believe someone under 16 has given us personal information, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. We will post the new version on this page and change the date at the top, and if the changes are significant we will let you know through Qrop or by email.

Contact us

Use the Contact us button at the bottom of any page on qrop.app.