Privacy Policy

1. Information we collect

If you have an account:

• Account details: your name and email address, and your sign-in credentials (passwords are stored hashed by our authentication provider).
• Workspace details: workspace name, members and their roles, and your plan.
• QR codes: short codes, names you give them, destination URLs, custom links (such as vlcard.me/your-name), status and expiry dates.
• QR designs and logos: the colours, shapes, frames and frame text you choose, and logo images you upload for styled QR codes. Logos are stored privately for your workspace and are only shown to its members and in the QR images you download.
• API keys: we store only a hashed form of each key and when it was last used.
• Webhooks: the web addresses you ask us to send events to, which events they get, a signing secret for each (stored encrypted), and a record of each delivery.
• Billing: your plan, subscription and invoice status, and QR packs you bought. Card details are entered on Paystack's pages and held by Paystack; we never see or store your full card number.
• Communication: emails and support requests you send us.
• Technical data: sign-in and session records, and server logs of requests to the dashboard.

If you scan a VisionLink QR code (you don't need an account), we record the scan so the code's owner can see how it is used:

• a hashed form of your IP address (we do not store the raw IP address)
• browser user-agent text (shortened), and the device type and browser worked out from it
• country, looked up from your IP address in our own copy of a free IP-to-country database (IP Geolocation by DB-IP); your IP address is not sent to DB-IP
• browser language, the referring website's domain, and campaign (UTM) tags in the link
• a random visitor identifier from the vlq_vid cookie, hashed before storage, so we can estimate unique scanners
• on codes that show an ad, which of our own ads was shown

Code owners see this as totals and breakdowns (for example scans per day, country or device). They do not see your IP address or identifier.

On plans with webhooks, a code owner can also have each scan sent to a server they control, a few seconds after it happens: the time, country, device type, browser, operating system, referring website's domain, campaign (UTM) tags and whether it looked automated. This never includes your IP address in any form, your user-agent text, your language or your visitor identifier. Once sent, the code owner handles it under their own privacy policy.

2. How we use your information

• To run the service: create and host your QR codes, send scanners to your destinations, and show you scan analytics.
• To manage your account, workspace, plan and payments, including renewals, failed payments and plan changes.
• To send service emails: account confirmation, password resets, security notices and important changes. Paystack sends payment receipts and invoices.
• To keep the service secure: rate limits, preventing abuse such as phishing or malware links, and investigating incidents.
• To provide support and respond to your requests.
• To improve the service, using aggregated usage information.
• To meet our legal obligations.

We do not sell your personal information, and we do not share it for marketing without your explicit consent.

3. Legal basis

We process personal information on these grounds under POPIA:

• Contract: to provide the service you signed up for.
• Legitimate interest: to record scan analytics for code owners, and to keep the service secure and working.
• Consent: where you have agreed to something specific. You may withdraw consent at any time by emailing support@visionlink.co.za.
• Legal obligation: where the law requires it, for example keeping financial records.

4. Service providers (operators)

We use these providers to run VisionLink QR. They process personal information only on our instructions and under agreements that require them to keep it confidential and secure:

• Supabase: database and authentication.
• Vercel: hosting of the dashboard and website.
• Railway: hosting of the scan service on vlcard.me and the API.
• Paystack: payment processing and subscription billing.
• Our email delivery provider: sending account and security emails.

5. Where your information is stored

Our database is hosted in the European Union (Frankfurt, Germany). The dashboard and the scan service run on cloud platforms that may process requests in other countries, including the United States. When personal information leaves South Africa, we only use providers bound by data protection terms that give a level of protection substantially similar to POPIA, as section 72 of POPIA requires.

6. How long we keep it

• Account and workspace data: while your account is open. If you delete your account in Settings, your access ends at once and we erase the data 7 days later, which gives you time to change your mind. If you ask us by email, we delete it within 10 business days. Either way we keep only what the law requires.
• QR designs and logos: while your account is open, or until you delete them. Deleting a logo removes the file.
• Scan analytics: for as long as your plan shows analytics history, plus a short buffer; after that we delete it or keep only totals that no longer relate to any person.
• Deleted QR codes: we keep a minimal record of a deleted code so its short code is never given to someone else. A removed custom link is held for 90 days so only its previous owner can take it back.
• Webhook delivery records (what we sent to your endpoints and whether it arrived): 30 days.
• Billing records: for as long as tax and company law requires (generally 5 years).
• Server and security logs: for a short period, normally no more than 30 days.

7. Security

We protect personal information with measures appropriate to the risk, including:

• encryption in transit (TLS) for the dashboard, API and scan links, and encrypted storage by our hosting providers
• hashing of IP addresses, visitor identifiers and API keys before storage
• row-level access control in the database, so each workspace can only reach its own data, and limited, role-based staff access
• rate limits, monitoring and automated checks on our code and database

8. Security breaches

If we have reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you as soon as reasonably possible, and aim to do so within 72 hours of becoming aware of it. The notice will describe what happened, the information involved, the possible consequences, what we have done about it, what you can do, and who to contact.

9. Your rights under POPIA

You have the right to:

• ask whether we hold personal information about you, and request a copy of it
• ask us to correct or update inaccurate information
• ask us to delete information we no longer need or may not keep
• object to processing based on our legitimate interests
• withdraw consent where processing is based on consent
• not receive direct marketing without your consent
• complain to the Information Regulator (inforegulator.org.za)

To use these rights, email support@visionlink.co.za from the address on your account, or tell us which code you scanned if you don't have an account. We confirm receipt within 3 business days and complete requests within 10 business days where the law allows. If you only scanned a code, we generally cannot link a scan to you, because we don't keep your IP address or who you are.

10. Cookies

• Authentication cookies keep you signed in to the dashboard. They are essential and are not used for advertising.
• On vlcard.me, the vlq_vid cookie holds a random visitor identifier (hashed before storage) so owners can see approximate unique scans. It contains nothing that identifies you.
• Some Free-plan codes show a short ad for our own VisionLink Digital Cards before opening. These ads set no cookies and use no third-party ad network or tracker. We don't use advertising cookies. If we ever add a third-party ad network, we will update this policy first and ask for consent where the law requires it.

You can block or delete cookies in your browser settings; the dashboard needs its sign-in cookies to work.

11. Other websites

A VisionLink QR code sends scanners to a website chosen by the code's owner. We don't control those websites or how they handle your information; read their privacy policies.

12. Changes to this policy

We may update this policy to reflect changes to the service or the law. We will tell account holders about significant changes by email or in the dashboard before they take effect. The date at the top shows the current version.

13. Contact

Questions, requests or complaints about your personal information: support@visionlink.co.za.

• Company: VisionLink Technologies (Pty) Ltd
• Information Officer: Jacques van den Berg (director), contactable at support@visionlink.co.za
• Website: visionlink.co.za

See also our Terms of Service and Refund Policy.