Privacy Policy

This Privacy Policy explains how FeedbaQR (a DBA of South Fork Mobile LLC, “we,” “us”) handles personal information. We built FeedbaQR to be privacy-first by design:

• first-party, cookieless analytics — no Google Analytics, no advertising or cross-site trackers;
• we never store raw IP addresses — only a salted, non-reversible device hash for light anti-spam;
• scanning is anonymous — no account, no login, for the person scanning a code;
• we don't sell or “share” personal information (as those terms are used under California law).

For owner accounts and visitors to our own site, we are the controller of the limited data described below.

When a business uses FeedbaQR to collect feedback, votes, or contact details from its own customers, that business is the controller of those responses and we act as a processor on its behalf — handling the data only to provide the Service. Businesses are responsible for having a lawful basis to collect responses through their codes.

• Owner account: your email address (used for the one-time sign-in link). No password.
• Codes you create: the configuration you enter — business/event name, prompt or question, options, review links, and any logo or brand color you upload.
• Responses to a code (from people who scan it): the rating, vote, or choice; an optional comment or message; any photo or image you choose to upload (for example, a guest-book photo); and any optional contact details (name / email / phone) the person chooses to leave. We also store a salted device hash (never a raw IP) and a coarse device type (e.g., “mobile”) for light anti-spam.
• Traffic analytics: anonymous, cookieless signals — page path, the referring website's host, any campaign (UTM) tags, and a coarse device type.
• Email delivery: we send transactional email (your sign-in link) through an email provider.

We use a single, strictly-necessary cookie: an HttpOnly session cookie set only after you sign in, so you stay signed in. We use no analytics or advertising cookies. Because the only cookie is essential to a feature you asked for, there is no cookie-consent banner to click through.

• to operate the Service — create and serve your codes, record responses, show your dashboard;
• to send you a sign-in link and essential service messages;
• to protect the Service and prevent abuse (e.g., light per-device throttling);
• to understand aggregate traffic so we can improve the product.

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (to provide the Service you signed up for); our legitimate interests in securing the Service and understanding anonymous, aggregate usage (kept minimal and privacy-protective); and your consent where we ask for it. You can object to processing based on legitimate interests (see your rights below).

We do not sell or “share” personal information, and we don't use it for cross-context behavioral advertising. We disclose data only to:

• service providers that operate the Service for us — cloud hosting/infrastructure and email delivery — under contracts that limit use to providing the Service;
• authorities, if required by law or to protect rights and safety.

Our infrastructure and data are hosted in the United States.

• Unclaimed (draft) codes: deleted after ~30 days if never saved.
• Traffic analytics: retained ~180 days, then automatically expired.
• Responses, votes & guest-book entries (including any uploaded photos): retained for the owner's dashboard and keepsake until the owner deletes them or asks us to; an owner can request deletion of their codes' data at any time.
• Account data: kept while your account is active; deleted on request.

Depending on where you live, you may have the right to access, correct, delete, or receive a portable copy of your personal information; to object to or restrict certain processing (GDPR/UK); and, in California (CCPA/CPRA), to know, delete, and correct your information and to opt out of any sale or sharing — though we don't sell or share it. We will not discriminate against you for exercising these rights.

To make a request, email privacy@feedbaqr.io. We'll respond within 30 days (up to 45 days for California requests where permitted), and may need to verify your identity. You can also lodge a complaint with your local data-protection authority.

We are a US business and process data in the United States. If you access FeedbaQR from outside the US, your information is transferred to and processed in the US. We apply the protections described in this policy to all users regardless of location.

FeedbaQR is a general-audience service that is not directed to children, and we do not knowingly collect personal information from children under 13. Scanning a code is anonymous and collects only the minimal data described above. Because a business or host — not FeedbaQR — controls what its own code asks for, owners are responsible for not using the Service to knowingly collect personal information from children under 13 (and for complying with COPPA and similar laws). If you believe a child has provided us personal information, contact privacy@feedbaqr.io and we'll delete it.

We protect data with encryption in transit, least-privilege access, and data minimization (for example, salted device hashes instead of IP addresses). No system is perfectly secure, but we keep the data we hold small on purpose.

Account owners can optionally opt in to receive text-message (SMS) alerts when someone reports a problem on one of their codes. This is a transactional, owner-only program — we text only the verified account owner about their own codes, and never the members of the public who scan a code. Opt-in happens inside the owner dashboard (Console → Text alerts): the owner enters and verifies their own mobile number after an explicit consent notice. Messages are limited to a one-time verification code and problem-report alerts; message and data rates may apply; reply STOP to opt out or HELP for help.

We do not share mobile opt-in information or consent with any third parties or affiliates for marketing or promotional purposes. Text-messaging originator opt-in data and consent are not shared with any third parties. The mobile number is used solely to deliver these messages through our messaging provider.

Full details are in our Text Messaging (SMS) Terms.

We may update this policy; material changes will be reflected by the “last updated” date above and, where appropriate, communicated through the Service.

Privacy questions or requests: privacy@feedbaqr.io. FeedbaQR, a DBA of South Fork Mobile LLC, Rexburg, Idaho, USA (full mailing address available on request).