Privacy Policy

This policy is written in English, and the English version applies.

Effective date: 2026-11-06

This policy explains how My Ink QR ("we") handles personal data in My Ink QR, in line with the Personal Data Protection Act 2010 of Malaysia (PDPA).

1. Two roles

For your account, we decide how your data is used. For data that people enter through your QR codes, such as form entries, contact details and shared locations, you decide what is collected and why, and we process it for you. You must give those people any notice and get any consent the law requires.

2. What we collect

• Account: username, email, encrypted password, two-step verification settings and language.
• Optional company details: company name, SSM number, address and phone, if you add them.
• Security and legal records: IP address and browser at sign-up and login, acceptances of our Terms with time and IP, changes to QR destinations, and staff actions on unique codes.
• Scan statistics: time, approximate country, state and city from the IP address, device, system, browser and referring site. Scanners' IP addresses are stored only as a one-way hash.
• Content you add: QR content, files, images, translations, and staff names you create.
• Data from people who scan: form entries, feedback, and locations that a finder chooses to share for a lost-pet or lost-item tag.
• Payments: handled by Stripe and Billplz. We keep the bill number, amount, date and status. We never see or store your card or bank login details.

3. How we use it

We use personal data to provide and secure the Service, prevent fraud and abuse, send account, security and payment emails, respond to support requests, meet legal obligations and resolve disputes. We do not sell personal data or use it for advertising.

4. Who we share it with

We share data only with providers that help run the Service: Cloudflare (network and security), Stripe and Billplz (payments), our email provider, Telegram (alerts to our administrator), Google Web Risk, URLhaus and PhishTank (link safety checks, which receive destination URLs only), and MaxMind (location database used on our own server, so no IP addresses are sent to it). We may also share data when the law requires it, or to protect our rights, users or the public. Some providers process data outside Malaysia, and we use them on the basis that they protect it adequately.

5. How long we keep it

• Scan records: 7 days on Free, 90 days on Starter, 365 days on Pro, 730 days on Business, 730 days on Partner.
• Form entries: deleted automatically after 365 days, or earlier if you delete them.
• Account data: until you delete your account. Backups are kept for up to 30 days.
• Payment, Terms acceptance and security records: as long as the law requires or allows, even after an account is closed.

6. Security

Passwords are hashed, two-step verification secrets are encrypted, scanners' IP addresses are hashed, connections use HTTPS, backups are encrypted, and we tell you when your account logs in from a new network. No system is completely secure. If a data breach is likely to harm you, we will tell you and the authorities as the law requires.

7. Your rights

You can see and change your details on the Account page, and delete your account and its data there. To ask about, correct or limit the use of your data, or to withdraw consent, email [email protected]. If you entered data through someone else's QR code, contact them first, because they control that data.

8. Cookies

We use only the cookies needed for login, security, language choice and staff mode. We don't use advertising or tracking cookies.

9. Children

The Service is not meant for people under 18, and we don't knowingly create accounts for them.

10. Changes

We may update this policy. If we make a material change, we will tell you by email or on the Service.

11. Contact

My Ink QR
Email: [email protected]