Privacy Policy

This policy explains what personal data QRkontaq processes and why. QRkontaq is operated by sole proprietor (ФОП) Dmytro Kushpel, registered in Ukraine ("we", "us"). Contact: inowioss@gmail.com. We act as the data controller for the platform and as a processor for the menu data venues publish.

1. Data we process

• Venue owners and staff: name, e-mail, password hash, venue details (name, address, logo, menu, photos), subscription and payment history (amounts and status — never card numbers).
• Guests visiting a menu site: anonymous usage statistics (page scans by day, table and hour), dish likes stored on the guest's device, ratings and reviews if submitted.
• Loyalty program members: e-mail and name from Google or Apple sign-in, loyalty balance and visit history at participating venues.
• Technical data: server logs (IP address, user agent) kept for security and debugging.

2. Purposes and legal bases

We process data to provide the service (contract), to secure and improve it (legitimate interest), and — for optional features like loyalty — based on your action of signing in (consent). We do not sell personal data and do not run third-party advertising or tracking.

3. Cookies and local storage

We use only functional storage: session tokens to keep you signed in, and device storage for preferences such as language and liked dishes. No advertising cookies.

4. Service providers

• Hetzner Online GmbH (Germany) — hosting; all data is stored in the EU.
• monobank / Universal Bank (Ukraine) — payment processing; card data is handled entirely by the bank.
• Google LLC / Apple Inc. — optional sign-in for the loyalty program; Google Fonts served from Google servers.

5. Retention

Account and venue data is kept while the account is active and deleted on account or venue deletion (backups expire within 30 days). Payment records are kept as long as financial regulations require. Anonymous statistics contain no personal identifiers.

6. Your rights

Under the GDPR and Ukrainian data protection law you can request access, correction, deletion or export of your data, object to processing, and withdraw consent at any time by e-mailing inowioss@gmail.com. You can also lodge a complaint with your local supervisory authority.

7. Security

All traffic is encrypted (TLS), passwords are stored hashed, access to production systems is restricted, and each venue's data is isolated per tenant.

8. Children

The service is intended for business use and is not directed at children under 16.

9. Changes

We may update this policy; the current version with its effective date is always available at qrkontaq.com/privacy.