Privacy Policy

1. Introduction

Prime Innovation ("Company," "we," "us," or "our") operates the Prime QR platform ("Service"), a cloud-based software-as-a-service for creating and managing digital menus and catalogs via QR codes.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. It applies to all users of the Service, including business owners who create menus and their end-user customers who view menus via QR codes.

By using the Service, you consent to the data practices described in this policy. If you do not agree with the terms of this Privacy Policy, please do not access or use the Service.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, password (securely hashed), and optionally phone number when you register
• Business Information: Business name, type, address, contact details, and menu URL slug
• Menu Content: Item names, descriptions, prices, images, categories, variants, and availability schedules
• Payment Information: Transaction references and billing details (we do not store full payment credentials)
• Communications: Messages you send to us via email or support channels

2.2 Information Collected Automatically

• Usage Data: Pages viewed, features used, menu interactions, and navigation patterns
• Device Information: Browser type, operating system, device type, and screen resolution
• Log Data: IP address, access timestamps, referring URLs, and server response codes
• Analytics Data: QR code scans, menu views, item views, and engagement metrics for business owners

2.3 Information from Third Parties

• Social Login Providers: If you sign in via Google, Facebook, Apple, TikTok, or LINE, we receive your name, email (if available), and profile picture as permitted by the provider
• AI Services: When you use the AI chat feature, your menu data and customer queries are processed by our AI provider to generate responses

3. How We Use Your Information

We use your information for the following purposes:

• Service Delivery: To create and manage your account, display your menus publicly, generate QR codes, and process subscriptions
• Analytics: To provide you with insights about your menu performance, including view counts, popular items, and scan statistics
• AI Features: To power the AI chat assistant using your menu data to answer customer questions accurately
• Communication: To send account-related notifications, security alerts, service updates, and respond to your inquiries
• Improvement: To analyze usage patterns, diagnose technical issues, and improve the Service
• Security: To detect, prevent, and address fraud, abuse, and security vulnerabilities
• Legal Compliance: To comply with applicable laws, regulations, and legal processes

We do not sell your personal information to third parties. We do not use your specific business data or menu content to train AI models for other customers.

4. Legal Basis for Processing

If you are in the European Economic Area (EEA), United Kingdom, or other jurisdictions that require a legal basis for processing personal data, we rely on the following:

• Contract Performance: Processing necessary to provide the Service you requested (account creation, menu hosting, subscription management)
• Legitimate Interests: Processing for analytics, security, service improvement, and fraud prevention, where our interests do not override your fundamental rights
• Consent: Where you have given explicit consent, such as for marketing communications or optional data collection. You may withdraw consent at any time
• Legal Obligation: Processing required to comply with applicable laws

5. Data Sharing & Third Parties

We share your information only as necessary to operate the Service and as described below:

5.1 Service Providers

5.2 Other Disclosures

We may also disclose your information:

• To comply with legal obligations, court orders, or governmental requests
• To protect the rights, property, or safety of Prime Innovation, our users, or the public
• In connection with a merger, acquisition, or sale of assets (with prior notice)
• With your explicit consent

6. Cookies & Tracking Technologies

We use cookies and similar technologies for the following purposes:

We do not use third-party advertising cookies or cross-site tracking. You can manage cookie preferences through your browser settings. Disabling essential cookies may prevent you from using certain features of the Service.

7. Data Retention

We retain your data according to the following schedule:

• Active Accounts: Your data is retained for as long as your account is active and the Service is being used
• Cancelled Accounts: Account data is retained until the end of the billing cycle, then access is restricted. Core data is retained for 30 days to allow reactivation
• Deleted Accounts: Upon deletion request, personal data is permanently removed within 30 days. Anonymized, aggregated analytics data may be retained indefinitely for statistical purposes
• Inactive Free Accounts: Free-tier accounts with no activity (no owner login and no public menu visits) for 180 days (6 months) are automatically deactivated. Data is preserved for a 60-day grace period during which the owner can reactivate by logging in. After 240 total days of inactivity, all account data including menu content, images, categories, and business information is permanently deleted. Warning emails are sent at multiple intervals before both deactivation and deletion. Paid accounts are exempt from this policy
• Analytics Data: Menu analytics (views, scans) are retained according to your subscription tier (7 to unlimited days). Historical data beyond your retention period is automatically purged
• Legal Requirements: Certain data may be retained longer if required by law, regulation, or to resolve disputes

8. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption in Transit: All data transmitted between your browser and our servers is encrypted using TLS/HTTPS
• Encryption at Rest: Stored data is encrypted on our servers and cloud storage
• Password Security: Passwords are hashed using industry-standard algorithms (scrypt) and never stored in plaintext
• Session Security: Session tokens are cryptographically generated, and only SHA-256 hashes are stored server-side
• Access Controls: Strict role-based access controls ensure data is only accessible to authorized personnel and systems
• Regular Updates: We regularly update our dependencies and infrastructure to address known vulnerabilities

While we strive to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security but commit to promptly notifying affected users in the event of a data breach.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including:

• Cloud Infrastructure: Our hosting and storage providers (Cloudflare) operate globally with data centers in multiple regions
• AI Processing: AI chat queries may be processed by providers in the United States or European Union

When transferring data internationally, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, adequacy decisions, or other legally recognized transfer mechanisms. We assess the data protection laws of recipient countries and implement supplementary measures where necessary.

10. Your Rights Under GDPR

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following rights under the General Data Protection Regulation (GDPR):

• Right of Access: You can request a copy of the personal data we hold about you
• Right to Rectification: You can request correction of inaccurate or incomplete personal data
• Right to Erasure: You can request deletion of your personal data when it is no longer necessary for the purposes collected
• Right to Restriction: You can request that we restrict the processing of your data under certain circumstances
• Right to Data Portability: You can request to receive your personal data in a structured, commonly used, machine-readable format
• Right to Object: You can object to the processing of your data based on legitimate interests or for direct marketing purposes
• Right to Withdraw Consent: Where processing is based on consent, you can withdraw consent at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at support@prime-qr.com. We will respond to your request within 30 days. If we need additional time, we will inform you of the reason and extension period (up to 60 additional days).

You also have the right to lodge a complaint with your local data protection supervisory authority if you believe your rights have been violated.

11. Your Rights Under CCPA

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: You can request disclosure of the categories and specific pieces of personal information we have collected, the sources, the business purposes, and the third parties with whom we share it
• Right to Delete: You can request deletion of personal information we have collected from you, subject to certain exceptions
• Right to Correct: You can request correction of inaccurate personal information
• Right to Opt-Out: You can opt out of the sale or sharing of your personal information. We do not sell or share personal information as defined by the CCPA/CPRA
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights

To exercise these rights, contact us at support@prime-qr.com. We will verify your identity and respond within 45 days. You may designate an authorized agent to make a request on your behalf.

12. Children's Privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@prime-qr.com. If we discover that we have collected personal information from a child under 16 without verification of parental consent, we will take steps to delete that information promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Notify you via email or an in-app notification at least 30 days before the changes take effect
• Provide a summary of key changes

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after any changes constitutes acceptance of the updated policy.

14. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

For GDPR-related inquiries, you may also contact your local data protection authority. For CCPA-related inquiries, California residents may contact the California Attorney General's office.