Privacy Policy — QR‑Ixonity (Ixonity)      
   

Privacy Policy (Privacy Policy)

   

Last updated: October 11, 2025 • Version: 2025‑10‑12‑1

   

This Privacy Policy explains how Private Entrepreneur Zaitsev Oleksii Yuriyovych (Ixonity brand) («we», «Data Controller») collects, uses, stores, processes, and protects personal data when you use our QR‑Ixonity applications, associated web services, backend, and related features («Service»). We comply with the requirements of the legislation of Ukraine, the European Union (EU/EEA), the United Kingdom, the USA, and other jurisdictions where the Service is applied.

   

Service Name: QR‑Ixonity (Ixonity brand)
    Standardized Product Name: QR‑Ixonity (used further in the text as the designation of the Service)
    Data Controller: Private Entrepreneur Zaitsev Oleksii Yuriyovych (Ukraine, Odesa)

   

Contacts:
        •    Email: ixonity@gmail.com
        •    Phone: +380771817071
        •    Website: https://energymotort-collab.github.io/ixonity-site/ixonity-site-legal/
        •    Postal Address: we accept inquiries via email. Response time to requests: up to 3 business days (Kyiv time).

   

Data Processors: Google Firebase (Auth, Firestore, Functions, Storage, Messaging, Hosting), Apple (StoreKit, APNs), static hosting providers for QR code landing pages.
    Jurisdictions: Ukraine, European Union, United Kingdom, USA.
    Hosting Region (Firebase/Backend): Europe — Poland (europe-central2 region, Warsaw).

   

Legislative Basis

       

We aim to ensure maximum transparency, security, and compliance with user rights. If you have questions, please contact us using the provided contacts.

   

1. Definition of Terms

   

For clarity, the following terms are used in this Policy:

       

2. Regulatory Framework and User Rights

   

We operate in accordance with the aforementioned legislation. Your fundamental rights as a data subject include:

       

To exercise your rights, send a request to ixonity@gmail.com. We will verify your identity and respond within the established deadlines (usually 30 days according to GDPR, or 45 days with a possible extension up to 90 days for complex requests under CCPA/CPRA).

   

Additional clarification: Consent for data processing (e.g., for push notifications or QR code analytics) is obtained through explicit confirmation (checkbox or button) and is not pre-set. For push notifications, after the application is installed, a panel is displayed asking to confirm consent to receive notifications or to decline.

   

3. Data We Process and Why

   

3.1. Account Data (after registration via Firebase Auth):

   

• Email and unique user identifier (UID, Firebase ID).
       • Apple sign-in data (if chosen).
       • Technical device tokens for push notifications (e.g., Firebase Registration Token, stored in the devices collection).
       Purpose: Authentication, user identification, and access recovery.

   

3.2. Subscription Data (via Apple StoreKit):

   

• Plan identifier (Pro, Business, Ultra), start/end date.
       • Subscription type, access rights (entitlements), and usage limits (usage).
       Purpose: Subscription management, limit control for dynamic QR codes and API.

   

3.3. Notification Data (if allowed)

   

• What we store: APNs/FCM‑token of your device; notification settings (prefs), including scanning thresholds (10, 100, 10000, 50000).
       • How it works: one iOS/iPadOS system permission; settings can be changed in Settings → Notifications or in the «Notifications» section.
       • Purpose of processing: technically necessary notifications (milestones, limits/subscription status).
       • No tracking: the token is only for delivery via Apple/FCM, without advertising tracking/profiling.
       • Marketing notifications: currently not sent; in the future — only upon separate opt‑in.

   

3.4. QR Code Analytics (if activated by the user for paid features)

   

• We collect only depersonalized aggregated statistics: country, city, device type (iOS/Android/Desktop), interface language, referrer, UTM, target page (target), date/time.
       • IP is processed once for geolocation and is not stored.
       • User‑Agent — to determine the device type without personal identification.
       Purpose: aggregated statistics to measure effectiveness. Optionality: available in Pro/Business/Ultra and is activated by explicit action (opt‑in) for a specific QR code; can be disabled anytime. IDFA/ATT are not used.

   

3.5. Technical Logs and Analytics

   

• Aggregated Firebase metrics (AppCheck) for performance optimization.
       • Usage accounting: number of scans, API calls, dynamic codes created (monthly accounting).
       Purpose: limit control, protection against overload, billing, and audit. Not used for tracking behavior.

   

3.6. App Tracking Transparency (ATT) and IDFA

   

• We do not use IDFA and do not perform “tracking” in the sense of Apple ATT.
       • The system ATT dialogue is not displayed, as we do not request tracking.
       • QR code analytics is depersonalized and not associated with advertising profiles.

   

4. Data We DO NOT Collect

   

• Payment card information (processing exclusively by Apple).
       • Photos, documents, or other private user files.
       • GPS location, access to the microphone/camera without direct user action.
       • Activity logs beyond one-time use for QR analytics.

   

5. Sources of Data Collection

   

• Provided by you: contact information, notification settings.
       • Automatically collected: technical tokens, usage, depersonalized scanning analytics (if activated).
       • From third parties: subscription data from Apple, authentication from Firebase/Apple.

   

6. Legal Basis for Processing (Legal Basis)

   

• Contract performance — account/subscriptions/limits, storage of QR data, technically necessary notifications.
       • Legitimate interest — security, integrity, stability, audit, and resource planning (with the right to object).
       • Consent — marketing push (if they appear, only opt‑in), optional QR code analytics (opt‑in).
       • Legal obligations — responses to legal requests, accounting/taxes.

   

7. Purpose of Processing

   

Authentication and identification; storage of QR data; subscription and limit management; sending notifications; aggregated analytics; security, diagnostics, and optimization.

   

8. Cookies and Similar Technologies

   

Only strictly necessary cookies for authentication and functionality. If we add optional cookies — we will request consent and respect GPC signals.

   

9. Data Transfer and Transfers

   

Data — only to verified Sub-processors (DPA). Firebase — in the EU (europe‑central2). Separate services may technically process data outside the EEA/UK; we apply SCC/DPF, conduct TIA, and implement additional security measures.

   

9.1. Representative in the EU/UK (Art. 27 GDPR/UK GDPR)

   

If we systematically offer the Service to residents of the EU/UK or conduct targeted marketing — we will appoint a representative and update this section. Currently, no representative has been appointed.

   

10. Data Storage

   

• Active account: we store exactly as long as necessary to provide the Service (authentication, storage of QR data/settings, subscription, limits/quotas, notifications).

   

• Deletion upon request: «Delete account» in the application — complete deletion of all personal data and associated content under our control (Auth, QR links and statistics, files in Storage, prefs/devices, usage, entitlements). The process is automatic and usually takes from seconds to minutes.

   

• Backups and provider logs: after deletion, data may be temporarily stored as technical backups/logs with our processors (Google/Firebase) for up to 30–90 days; these copies are not available for operational use and are destroyed automatically.

   

• Analytics and usage: for active accounts, aggregated QR statistics and usage may be stored for up to 12 months for limits/audit/optimization; upon deletion of a QR code/account, associated data is deleted immediately.

   

• Apple subscription logs: we do not store Apple transaction logs; we only have the current plan/entitlements status, which is deleted along with the account.

   

• Legal obligations: if the law obliges us to store certain data longer (accounting, etc.), we store the minimally necessary volume and only for the period explicitly stipulated by law.

   

10.1 Consent logs and retention periods

   

During registration, we display links to the current versions of the Policy and Terms of Use. You can review the documents directly in the application, after which you confirm consent by explicit action (checkbox or button). We store records of the consents you provided (document type: Policy/Terms, version/date, locale, time of acceptance) in Firebase/Firestore and locally in the application solely to confirm the lawfulness of processing and comply with legal requirements. Such records are stored for the duration of your account's existence and up to 3 years after its deletion; after this, the records are deleted or anonymized.

   

10.2 Legal basis for storing consent records

   

The storage of consent logs is carried out based on the performance of the contract and/or our legitimate interest in ensuring confirmation of the lawfulness of processing and compliance with data protection requirements. You can object to such processing by contacting us using the contacts specified in this Policy.

   

11. Security and Incidents

   

Encryption (SSL/TLS, HTTPS), Firebase App Check, access control, MFA, audit. In the event of incidents, we notify you and the authorities (e.g., within 72 hours under GDPR). Data is encrypted in transit and «at rest» (AES‑256 on Firebase servers).

   

12. Account Deletion

   

Available in the application interface (/me/delete). Deletes: account, QR codes, statistics, files in Storage, usage, tokens. Data is not recoverable. Deletion of a separate QR code — also automatically deletes associated data (including scanning statistics) from our backend.

   

13. Main Sub-processors

   

Google Firebase (Auth, Firestore, Functions, Storage, Messaging, Hosting); Apple (StoreKit, APNs); QR landing page hosting providers. The full list is available upon request.

   

14. User Content and Legal Compliance

   

Rights to QR codes belong to users. Illegal content is prohibited; moderation and cooperation with authorities are possible.

   

15. Additional Provision for California Users (CCPA/CPRA)

   

We do not “sell” data. Rights: access, deletion, Opt‑Out. Contact channels: ixonity@gmail.com. QR code analytics can be opted out of by deleting the QR code in the application or by sending a request.

   

16. Children

   

The Service is not intended for children; minimum age is 17+ or the age of consent in your jurisdiction. Discovered children's accounts will be deleted. Parents/guardians can contact ixonity@gmail.com.

   

17. Policy Changes

   

We notify of changes in the application/on the website 14 days before they take effect. Continued use = consent.

   

18. Automated Decision Making

   

We do not use automated decision-making in the sense of GDPR (Art. 22). QR code analytics is depersonalized and does not affect the rights/obligations of users. Moderation involves human intervention.

   

19. Force Majeure

   

We are not responsible for delays or inability to process data due to force majeure circumstances (natural disasters, wars, strikes, cyberattacks, disruptions in third-party platforms). In such cases, we notify via push/email and take measures to restore service.

   

20. Contacts and Supervisory Authorities

   

Controller: Private Entrepreneur Zaitsev Oleksii Yuriyovych (ixonity), ixonity@gmail.com.

       

Clarification for Brazil (LGPD): in the event of a security incident that may cause risk or significant damage to data subjects in Brazil, we notify the ANPD and affected data subjects within a reasonable time after the discovery of the incident in accordance with LGPD and ANPD guidelines.