Privacy Policy

This policy is issued by Davis Noe Perez Ugarte, a Mexican individual carrying out business activity (Persona Física con Actividad Empresarial, RFC: PEUD810924TX3), operating under the trade name QR-Powered Identity ("we," "us," "our"). We operate QR-Powered Identity™, a platform that lets home service companies dispatch technicians with QR-code identity verification. This policy explains what personal information we collect, why, and what you can do about it.

This policy covers three kinds of people, defined in the Definitions section of our Terms of Service: Avatars (the home service companies that sign up for and pay for the Service, and their dashboard users), Technicians (an Avatar's own employees or contractors, added to that Avatar's account, who receive a QR badge), and Homeowners (an Avatar's own end customers, who receive a dispatch notification and interact with a Technician's QR badge). Homeowners never sign up for or pay for the Service.

Information we collect

From Avatars (business accounts):

• Company name, contact name, email, phone, and website URL provided at signup
• Branding assets you provide or that we extract from your website (logo, colors) for technician-facing pages
• Login credentials, managed by our authentication provider (Supabase) — we never see your password in plain text
• Payment and billing information, processed by Stripe — we do not store full card numbers on our own servers
• A record each time you accept our Terms of Service and policies: the date and time, the version, your IP address, and your browser details

From Technicians (added by an Avatar):

• Full name, role title, and phone number, entered by the Avatar who employs them
• A unique QR badge and verification token tied to their identity
• Dispatch and arrival activity, including timestamps
• A record of their confirmation, when they finish setup, that they have read and agree to follow our Acceptable Use Policy and Privacy Policy: the date and time, the version, their IP address, and their browser details
• Vehicle make, model, color, and license plate, if the technician chooses to provide them during onboarding — shown to a homeowner only when they have a real, confirmed dispatch with that technician, never on a general scan of the badge by anyone else. Whoever owns the vehicle — the technician, or the Avatar if it's a company vehicle — is responsible for having the right to share it, and providing it is treated as that consent.

From Homeowners (end customers of an Avatar):

• Name, email, and/or phone number, provided by the Avatar dispatching a technician to you
• Service address, used to route the technician and, where enabled, to verify their arrival location against the address on file (geofencing)
• Photographs, only if a technician requests one during a visit and only after you're shown a consent screen and agree — declining is always an option and does not block service. A second, separate, optional checkbox on that same screen lets you additionally allow the Avatar to use those photos, along with any comments you leave about your visit, in their own marketing (for example, social media or their website) — declining that second checkbox also never affects your service, and it's entirely independent from the first
• Any comments you choose to leave about your visit, on the job summary page after service is complete — this is always optional and separate from the photo consent screen above
• A record of whether you scanned or verified a technician's QR badge, and when

How we use this information

• Operating the Service: creating dispatches, generating and verifying QR badges, sending notifications
• Verifying a technician has actually arrived at the correct address, where an Avatar has this feature configured
• With your separate, optional consent: letting the Avatar who dispatched the technician use your before/after photos and any comments you leave about your visit in their own marketing materials
• Billing and account administration
• Responding to support requests and investigating flagged or failed verifications
• Maintaining an internal activity log of account, dispatch, notification, and payment events, for security and troubleshooting
• Legal compliance, and enforcing our Terms of Service
• Keeping proof that you accepted our Terms of Service and policies, and which version

Who we share it with

We don't sell personal information, and we don't give it to anyone to market their own products to you. The service providers below process information on our behalf to operate the Service:

• Supabase — database hosting and authentication
• Vercel — application hosting
• Stripe — payment processing
• Twilio — SMS text message delivery
• Resend — transactional email delivery
• Google Maps Platform — address autocomplete and geocoding, when an Avatar's account has this configured
• Google (Gmail) — the mailbox where we receive and answer the customer-service emails you send us, so the content of those emails is stored with Google
• Google Analytics — website analytics on our public pages (home, sign-up and legal pages), only if you accept analytics on the cookie banner; Google receives which pages you view, your approximate location and your device and browser type. Analytics never runs on badge verification pages, dashboards or the admin console
• Anthropic (Claude) — the AI that powers the Marketing Department tools and works as the operating assistant that helps us run and monitor the platform (support, payments, notifications and system health). It receives only what a task needs, for example the business details you give a marketing tool, or account, dispatch and payment records when we investigate an issue or review activity
• Law enforcement or regulators, only when legally required to

An Avatar's technicians and homeowners' information is visible to that Avatar's own account — it is not shared with other Avatars on the platform.

We share information electronically, over encrypted connections (HTTPS/TLS), through each provider's service, and only the information that provider needs to do its job (for example, Stripe receives payment details and Twilio receives a phone number and the text of the message).

Mobile phone numbers and SMS opt-in data and consent are not shared with any third party, affiliate or lead generator, and are never sold, bought or used for marketing or promotional purposes. Our service providers (including Twilio, which delivers our messages, and Supabase, which stores our records) handle this data only on our behalf and only to operate the Service. We do not send text messages to homeowners: homeowners receive their notices by email only, and a homeowner's phone number, if an Avatar enters one, is not used to send texts. Text messages go only to company account owners and technicians who opted in directly to QR-Powered Identity. See our SMS Messaging Terms for how text messages work.

How we protect your information

Each Avatar's data is isolated at the database level, so an account can only reach its own organization's records. Internal admin access is checked on every request. We never see passwords in plain text; our authentication provider stores them using industry-standard hashing. Data is encrypted in transit (HTTPS/TLS) and at rest (by our database provider). We never store full card numbers; Stripe handles them directly. Payment, text-message, and email events that update an account are signature-verified before we act on them, and significant account events are recorded in an internal activity log. If we learn of a security incident affecting your data, we will notify you without undue delay. For more detail, see our Data Processing & Security Statement.

Your choices

• Homeowners can decline a photo request, skip leaving a comment, or decline the separate marketing-use permission, at any time without affecting service
• If you agreed to let your photos and/or comments be used in an Avatar's marketing, you can withdraw that permission at any time by contacting us — see below
• Avatars can remove a technician from their team, which deactivates that technician's badge going forward (past job history is retained for record-keeping)
• You can request a copy of, correction to, or deletion of your personal information by contacting us — see below

Data retention

We keep account and dispatch records for as long as an account is active, plus a reasonable period afterward for legal, tax, and dispute-resolution purposes. Photos are retained as part of the dispatch record they belong to unless you request deletion. Records of acceptance of our Terms of Service and policies are kept for as long as the account is active and for a reasonable period afterward, because we may need them as evidence.

Children

The Service is not directed at, and we do not knowingly collect information from, anyone under 18. No one under 18 may create an account, sign up for, or purchase the Service — see the eligibility requirements in our Terms of Service. If we learn that we've collected information from someone under 18 in connection with an account, we'll take reasonable steps to delete it and close the account.

Changes to this policy

We may update this policy as the Service changes. We'll update the date at the top of this page when we do. For material changes we will also email the contact address on your account before they take effect, as described in our Terms of Service (Section 10). This policy is one of the documents that form the single agreement described in Section 12 of our Terms of Service.

Contact us

Questions about this policy, or requests to access, correct, or delete your information: legal@qr-poweredidentity.com