Introduction & Scope
Welcome to the Dynamic QR Code Engine. This website provides dynamic QR code generation services, allowing users to create, customize, export, and dynamically update destination URLs for marketing campaigns, physical assets, WiFi networks, digital business cards (vCard), and corporate redirects without reprinting physical materials.
We value your trust and are committed to protecting the privacy of our registered users as well as the individuals scanning dynamic QR codes generated through our platform. This policy outlines our data handling standards, technical security layers, and data protection principles.
Information We Collect (QR Scan Analytics)
Our platform records diagnostic analytics data strictly and only when an end user scans an active dynamic QR code or opens its associated short redirect link (/r.php?h=...):
The scanner's incoming IP address is processed to identify approximate country and city location for geographical campaign reporting.
Hardware device category (Mobile, Desktop, Tablet) and operating system (iOS, Android, Windows, macOS, Linux).
HTTP User-Agent header inspection (Chrome, Safari, Firefox, Edge, or in-app camera scanner).
UTC date and time when the redirect was executed to calculate velocity curves and peak engagement hours.
User Account Data
When you register for an account to manage dynamic QR codes and view analytics dashboards, we collect and store:
- Username: A unique handle chosen by you to identify your account session.
- Email Address: Used for account recovery, notifications, and identity verification.
- Encrypted Password Hash: Your raw password is never stored in plain text. It is cryptographically hashed using industry-standard bcrypt algorithms with unique salts before reaching storage.
Data Security & Hosting Architecture
Data is safely managed on secure hosting architecture. We apply standard defense-in-depth protocols including:
- Database Parameterization: All database queries utilize PDO Prepared Statements with strict parameter binding to eliminate SQL Injection (SQLi) vectors.
- Bcrypt Password Protection: One-way password derivation ensuring credential isolation even in disaster recovery scenarios.
- Transport Layer Security: All data transmitted between client devices, short redirect endpoints, and server infrastructure is protected via HTTPS/TLS encryption.
- Access Controls: Administrative and owner-level authorization checks strictly isolate campaign edit rights between distinct accounts.
Operational Cookies
Our platform uses strictly necessary operational session cookies (PHPSESSID) purely to handle authenticated dashboard logins and maintain session security.
These cookies carry security flags such as HttpOnly (protecting cookies against JavaScript theft) and SameSite=Lax (guarding against Cross-Site Request Forgery). We do not deploy third-party advertising trackers or sell browsing profiles to marketing brokers.
Data Management & Inquiries
Registered account holders can export their collected scan logs at any time via CSV format directly from the Analytics dashboard, or delete campaigns permanently from their database.
If you have questions regarding this Privacy Policy or wish to request complete deletion of your account and scan records, please contact your hosting administrator at contact1@qrcodeg1.com.