Privacy Policy for CarQR

Effective Date:** 27 July 2026 **Website: carqrapp.com

This Privacy Policy explains how CarQR ("CarQR", "we", "us", or "our") collects, uses, stores, shares, and protects personal data when users access or use the CarQR mobile application, website, public QR alert pages, vehicle alert services, premium features, physical QR products, car scent packages, support channels, and related services.

CarQR is a QR-based vehicle alert platform. By default, third parties can send predefined alerts without seeing the owner's phone number. An owner may separately enter a vehicle-specific contact number and explicitly consent to publishing it on the public QR page.

CarQR is not an emergency service, law enforcement service, towing service, insurance service, vehicle security system, or guaranteed communication channel.

1. Data Controller

For applicable privacy and data protection laws, including KVKK, GDPR, UK GDPR, and similar regulations where applicable, the data controller is Taha Bayar (sole proprietorship — "CarQR")**; address: Bademlidere, 259. Cad. Eren Apt., Çankaya / Ankara (full address shared on request). Lumina Digitale, which provides infrastructure/development services, is a data processor. For data protection and privacy requests, email **info@carqrapp.com.

2. Information We Collect

We may collect the following categories of information depending on how the user interacts with CarQR.

2.1 Account Information

We may process:

• Email address
• User ID
• Authentication identifiers
• Account creation date
• Login/session information
• Language preference
• App settings

Passwords and authentication processes may be handled by third-party authentication infrastructure such as Firebase Authentication. We do not intentionally store plain-text passwords.

2.2 Vehicle Information

Depending on what the user provides, we may process:

• Vehicle nickname
• Vehicle type
• Vehicle color
• Vehicle QR slug
• Public QR URL
• QR status
• Vehicle alert preferences
• Vehicle-related notification history
• A public contact number, only if separately entered by the vehicle owner
• Consent-text version and consent/withdrawal timestamps for that public number

Users should not enter unnecessary sensitive or personal information into vehicle names, notes, or QR-related fields.

2.3 QR Alert Information

When a third party scans a CarQR code and sends an alert, we may process:

• QR slug
• Selected alert category
• Timestamp
• Alert delivery status
• Seen/resolved/archived status
• Technical request metadata
• Abuse-prevention and rate-limit data

The QR scanner does not need to install the app.

2.4 Device and Technical Information

We may process:

• Device type
• Operating system
• App version
• Firebase Cloud Messaging token
• IP address
• User agent
• Crash logs
• Diagnostics
• Security logs
• Rate-limit and abuse-prevention metadata

2.5 Shipping and Physical Product Information

If physical products are offered, such as QR stickers, QR cards, car scents, premium kits, or replacement products, we may process:

• Recipient name
• Delivery address
• Delivery phone number, if required for delivery
• Country/city/postal code
• Order and fulfillment status
• Delivery-related support communications

Shipping information is used for fulfillment, fraud prevention, customer support, legal compliance, and operational purposes.

2.6 Subscription and Purchase Information

If purchases or subscriptions are offered, we may process:

• Selected plan
• Purchase status
• Subscription status
• Entitlement status
• Transaction reference
• Renewal/cancellation/refund status
• Platform purchase metadata

We do not intentionally store full card details directly.

2.7 Support Communications

If users contact us, we may process:

• Email address
• Name, if provided
• Account/order references
• Support message content
• Screenshots or attachments voluntarily provided
• Communication history

2.8 Cookies and Similar Technologies

Our website and public QR pages may use cookies, local storage, CAPTCHA/Turnstile-like protection, security tokens, and similar technologies for security, abuse prevention, language settings, session handling, analytics if enabled, and service performance.

3. How We Use Data

We use personal data to:

• Create and manage user accounts
• Authenticate users
• Generate and manage vehicle QR codes
• Deliver vehicle alerts
• Send push notifications
• Display notification history
• Manage vehicle alert preferences
• Publish an optional contact number on the public QR page with the owner's separate explicit consent and remove it when consent is withdrawn
• Enable QR sharing, saving, printing, or PDF delivery
• Provide premium features
• Manage physical product fulfillment, if applicable
• Process subscriptions and entitlements, if applicable
• Provide customer support
• Prevent spam, abuse, fraud, unauthorized access, scraping, and misuse
• Maintain security and system integrity
• Enforce our Terms
• Comply with legal obligations
• Protect our rights, users, and third parties

4. Legal Bases

Where applicable privacy laws require a legal basis, we may rely on:

• Performance of a contract
• User consent
• Legitimate interests
• Compliance with legal obligations
• Establishment, exercise, or defense of legal claims
• Platform security and abuse prevention

Examples:

• Account and vehicle data are processed to provide the CarQR service.
• FCM tokens are processed to send push alerts.
• Shipping data is processed to deliver physical products.
• Security logs are processed to prevent abuse and fraud.
• An optional public contact number is published only on the basis of separate, specific, informed and freely given explicit consent. It is not a condition of the service.

5. Push Notifications

CarQR uses push notifications to alert vehicle owners. Push delivery depends on device settings, notification permissions, internet access, operating system restrictions, Firebase Cloud Messaging availability, and other third-party infrastructure.

We do not guarantee that every notification will be delivered instantly, successfully, or at all.

If users disable notifications, core alert functionality may not work properly.

6. Public QR Pages

By default, public QR pages let third parties send limited alerts without exposing the owner's account, sign-in or delivery phone, email address, or private contact details.

If an owner separately enters a vehicle-specific contact number and explicitly consents after being told that anyone who scans the QR may see, copy and call it, only that number is displayed. Account, sign-in and delivery numbers are never used automatically. The number is stored only on the vehicle consent record and is not copied into the QR slug, print, fulfillment, account or shipping records. The owner may withdraw consent at any time in the app/PWA, after which the public API stops returning it. We cannot technically erase screenshots or copies that third parties may already have made outside CarQR.

Public QR pages must not be used for:

• Harassment
• Spam
• Threats
• Fraud
• Advertising
• Scraping
• Stalking
• Illegal content
• Attempting to identify or expose the vehicle owner
• Misusing the alert system

We may block, rate-limit, investigate, log, or restrict abusive activity.

7. Data Sharing

We may share data with:

• Cloud infrastructure providers
• Authentication providers
• Database providers
• Push notification providers
• Hosting providers
• Payment or app store providers, if purchases are enabled
• Fraud-prevention and IP-reputation providers (for example, to detect VPN/proxy/anonymized connections during a payment), processing the IP address for security and abuse-prevention purposes on a legitimate-interest basis
• Delivery/fulfillment partners, if physical products are offered
• Customer support tools
• Analytics providers, if enabled
• Legal, tax, accounting, compliance, and professional advisors
• Authorities, courts, or regulators where legally required
• Successors in case of merger, transfer, restructuring, or sale of assets

We never automatically display an owner's account, sign-in or delivery phone on QR pages. Only a vehicle-specific public contact number separately entered and explicitly approved by the owner is disclosed to QR scanners.

We do not sell users' private contact details.

8. International Transfers

Your data may be processed in Türkiye or other countries where our service providers operate. Where required, we use appropriate legal safeguards, contractual protections, or other recognized transfer mechanisms.

9. Data Retention

We retain personal data only as long as necessary for the purposes described in this Policy, unless a longer period is required or permitted by law.

Indicative retention:

• Account data: while the account is active
• Vehicle data: while the vehicle remains registered
• Public contact number and consent record: until consent is withdrawn or the vehicle/account is deleted; the withdrawal timestamp may be kept for a limited period needed for consent management and disputes
• Alert history: according to plan limits, app settings, or deletion requests
• Security logs: for a limited period necessary for abuse prevention and legal protection
• Shipping/order records: as required for fulfillment, tax, accounting, consumer law, and disputes
• Support records: as needed for customer support, dispute resolution, and legal protection

We may anonymize or aggregate data so it no longer identifies users.

10. Security

We use reasonable technical and organizational measures, including:

• Authentication controls
• Server-side business logic
• Database security rules
• Restricted client access
• Rate limiting
• Abuse logging
• Secure infrastructure
• Access controls
• Encryption in transit where supported

No system is completely secure. Users are responsible for keeping their devices, accounts, and credentials secure.

11. User Rights

Depending on applicable law and location, users may have rights to:

• Access personal data
• Correct inaccurate data
• Request deletion
• Restrict processing
• Object to processing
• Withdraw consent
• Request portability
• Opt out of certain data sharing
• File a complaint with a data protection authority

Requests can be submitted through the contact page on info@carqrapp.com.

We may verify identity before processing requests.

12. Children

The service and contract are not intended for anyone under 18; you must be at least 18 to create a CarQR account and enter into the contract. We do not knowingly collect personal data from anyone under 18. If we become aware of such processing, we will delete the data where legally required.

13. Third-Party Services

CarQR may interact with third-party services such as app stores, cloud providers, authentication providers, payment processors, hosting providers, analytics tools, and delivery partners. Their privacy practices are governed by their own policies.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes may be communicated through the app, website, email, or other reasonable methods.

Continued use of CarQR after changes means acceptance of the updated Policy where permitted by law.

15. Contact

For privacy, data protection, support, and account requests, use the contact page on info@carqrapp.com.

16. United States — Your Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides you the following rights regarding your personal information:

• Right to know / access the categories and specific pieces of personal information we have collected about you.
• Right to delete personal information we hold about you, subject to legal exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of the "sale" or "sharing" of personal information.
• Right to limit the use of sensitive personal information.
• Right to non-discrimination for exercising any of these rights.

We do not sell your personal information for money.** Analytics and any marketing tags load only **after you accept cookies; if you decline, no third-party analytics or advertising trackers are loaded.

Categories of personal information we may collect:** identifiers (account ID, phone number, email address); commercial information (subscription tier and payment status); and internet/app activity (usage analytics, only with your consent). We do **not collect precise background geolocation.

To exercise these rights, contact us via info@carqrapp.com. You may use an authorized agent, and we will not discriminate against you for exercising your rights. We may verify your identity before fulfilling a request.

Residents of other U.S. states with comprehensive privacy laws (e.g., Virginia, Colorado, Connecticut, Utah) have analogous rights; we honor equivalent requests where those laws apply.