Privacy Policy
What we collect, why we collect it, how long we keep it, and the rights you can exercise at any time.
1. About this notice
Onvarp turns one dynamic QR code or short link into intelligent device routing, a customizable landing page, lead capture and real-time analytics. Handling personal data carefully is therefore part of the product, not an afterthought.
This notice explains what personal data Onvarp collects, why, who we share it with, how long we keep it and the rights available to you. It covers the onvarp.com website, the Onvarp web and mobile apps, and the scan destinations and landing pages we serve on behalf of our customers.
The service is operated by Onvarp, which is the data controller for the personal data described below. Where this notice says "we", "us" or "Onvarp", it means Onvarp.
Using Onvarp also means agreeing to our Terms of Service, which govern accounts, plans and acceptable use.
2. Our two roles: controller and processor
Onvarp handles personal data in two distinct roles, and your rights differ depending on which one applies.
- As a controller
- For our own account holders and website visitors — the people who sign up, sign in, pay us, contact support or browse onvarp.com — we decide why and how the data is used. This notice governs that data.
- As a processor
- For lead data that our customers collect through their own Onvarp forms, missions, vCards and landing pages, the customer is the controller and we act on their instructions under our data processing terms. If you submitted your details after scanning someone's Onvarp code, please direct access or deletion requests to that organisation first; we will assist them, and you can always contact us if they do not respond.
3. Personal data we collect
We collect only what a scan-to-customer platform needs to work.
- Account data
- Name, work email address, password hash, organisation name, team members you invite, plan and role. Required to create and secure your account.
- Billing data
- Plan, billing country, VAT/tax identifiers, invoices and the last four digits and brand of your payment card. Card numbers are entered directly with our payment processor — Onvarp never receives or stores full card details.
- Content you create
- Your dynamic QR codes, short links, destination URLs, landing-page content, uploaded logos and images, form fields and mission steps. This may contain personal data if you choose to put it there.
- Scan and click analytics
- For each scan or click of a dynamic code or link: timestamp, approximate location derived from the IP address (country and region only — never a precise GPS position), device type and operating system, browser, referrer, the UTM/channel tags on the link, and which destination the router selected. IP addresses are hashed; we do not retain them in raw form.
- Lead data (as processor)
- Where a customer switches on lead capture, the details a visitor submits — typically name, phone number, email address, company and LINE ID — together with the consent record, the lead source (form, mission, LINE or vCard) and the timestamp. Consent is logged on every submission.
- Website and support data
- Pages requested, your language preference, and the content of messages you send us by email or through a contact form, including any attachments.
We do not knowingly collect special-category data (health, biometrics, religion, political opinions, sexual orientation) and ask that you do not collect it through Onvarp forms without an appropriate legal basis of your own.
4. What the onvarp.com website does
The marketing site you are reading is a static site with no advertising, no third-party analytics scripts and no cross-site tracking pixels.
- The free QR code generator runs entirely in your browser. The text or URL you encode is never sent to our servers, and the codes you download are not logged or stored.
- When you first land on onvarp.com, our edge redirect reads your browser's Accept-Language header and your country as reported by our hosting provider, so we can send you to the right language. Neither value is stored beyond that request.
- Your language choice is remembered in a single functional cookie so we do not ask again on your next visit.
- Static QR codes generated here are free, unlimited, watermark-free and untracked — only dynamic codes, which need an account, produce scan analytics.
5. Why we use personal data, and our legal bases
Under the GDPR and equivalent laws we must have a legal basis for every use. Ours are set out below; under Thailand's PDPA the corresponding bases are contractual necessity, legitimate interest and consent.
- Providing the service
- Creating your account, routing scans to the right destination, rendering landing pages, delivering analytics and lead inboxes. Basis: performance of our contract with you.
- Billing and administration
- Taking payment, issuing invoices and meeting tax and accounting obligations. Basis: contract and legal obligation.
- Security, fraud and abuse prevention
- Detecting bot traffic, scan fraud, phishing destinations and account takeover. Basis: legitimate interest in keeping the platform safe.
- Improving the product
- Aggregated and de-identified usage statistics to decide what to build. Basis: legitimate interest.
- Support and service messages
- Answering your questions and sending operational notices such as plan limits, expiries and security alerts. Basis: contract and legitimate interest.
- Marketing emails
- Product news and offers, only where you have opted in or are an existing customer receiving similar-product updates. Basis: consent or legitimate interest. Every message carries a one-click unsubscribe.
- Lead capture forms
- Handled for our customer on their instructions, with the visitor's consent captured and logged at the point of submission. Basis: the customer's, usually consent.
8. International transfers
Onvarp is a global service and our infrastructure is distributed, so personal data may be processed outside the country where it was collected.
Where data leaves the European Economic Area or the United Kingdom, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum where applicable) or an adequacy decision. Where Thai personal data is transferred abroad, we rely on the cross-border mechanisms permitted under the PDPA. A copy of the safeguards we use is available on request.
9. How long we keep data
We keep personal data only as long as it serves the purpose it was collected for. Scan analytics retention depends on your plan:
- Free — 7 days of scan analytics
- Startup — 90 days
- Pro — 1 year
- Expo (Event Pass) — for the event plus 90 days
- Enterprise — 2 years or more, by agreement
- Account and billing records — for the life of the account, then up to 7 years where tax or accounting law requires it
- Lead data — kept for as long as the customer who collected it instructs, and deleted when they delete it or close their account
- Support correspondence — up to 24 months after the matter is closed
When a retention period ends we delete the data or irreversibly de-identify it. Backups are purged on their own rolling cycle, normally within 35 days.
10. How we protect data
Our safeguards are technical and organisational, and are reviewed as the product changes.
- Data is encrypted in transit with TLS and at rest on our storage layer.
- Visitor IP addresses are hashed rather than stored in raw form.
- Access to production data is role-based, granted on a need-to-know basis and logged.
- Passwords are stored only as salted hashes — never in plain text, and never recoverable by us.
- Enterprise customers can add SSO/SAML and custom domains for tighter control.
- We maintain backups and an incident response process, and will notify affected users and the relevant supervisory authority of a qualifying personal data breach without undue delay and, where required, within 72 hours.
No online service can promise absolute security, but we work to a standard proportionate to the sensitivity of the data we hold.
11. Your rights
Depending on where you live, some or all of the following rights apply. We do not charge for exercising them and we will not treat you differently for doing so.
- Access
- Get confirmation of whether we hold data about you, and a copy of it.
- Rectification
- Have inaccurate or incomplete data corrected.
- Erasure
- Ask us to delete your data where there is no overriding reason to keep it.
- Restriction and objection
- Ask us to pause a use, or object to processing based on legitimate interest — including direct marketing, which we will always stop on request.
- Portability
- Receive your data in a structured, machine-readable format, or have it sent to another provider. Analytics and leads can be exported to CSV from the app at any time.
- Withdraw consent
- Where we rely on consent, withdraw it at any time. This does not affect processing that already happened.
- No sale or sharing (California)
- Onvarp does not sell or share personal information as those terms are defined by the CCPA/CPRA, so there is nothing to opt out of. You retain the rights to know, delete, correct and to non-discrimination.
- Complain
- Lodge a complaint with your data protection authority — in the EEA or UK your local supervisory authority, and in Thailand the Personal Data Protection Committee (PDPC). We would appreciate the chance to resolve it first.
To exercise any of these, email [email protected]. We will verify your identity and respond within 30 days, or tell you if we need longer.
12. Children
Onvarp is a business tool and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
13. Scanned destinations and third-party sites
A dynamic Onvarp code routes to a destination chosen by the customer who created it — an app store, a website, a landing page or a social profile. Once you arrive there, that destination's own privacy notice applies, and we have no control over what it collects.
Because a dynamic code's destination can be changed after it is printed, the site a code opens today may differ from the one it opened previously. We screen for abusive and phishing destinations, but we cannot guarantee the content of every third-party site.
14. Changes to this notice
We update this notice as the product and the law evolve. The "last updated" date at the top always reflects the current version. If a change materially affects your rights we will tell you by email or in the app before it takes effect.
15. Contact us
For any privacy question, request or complaint, or to reach the person responsible for data protection at Onvarp:
- Privacy enquiries
- [email protected]
- General enquiries
- [email protected]
If you are in the EEA or the UK and we are required to appoint a representative under Article 27 of the GDPR, their details will be published here.