Privacy policy | LamsaQR

1. Scope of this policy

This policy explains how LamsaQR (Lamsat Q R Information Technology W.L.L., CR no. 254114, Doha, Qatar) handles personal data for two groups: business owners who create an account, and visitors who scan a QR code and open a business page. We comply with Qatar's Personal Data Privacy Protection Law (Law No. 13 of 2016).

2. Business owners' data

Account data: name, email address, phone number, password (hashed).
Business data: business name, branches, menu, photos, contact links; this data is public by nature because it appears on your page.
Billing data: plan, invoices and payment status. Card details never pass through our servers; they are processed by the licensed payment gateway.
Usage logs: sign-ins and edits, for security and support.

3. Visitors' data

When a visitor opens a business page we collect the minimum needed to run the page and give the owner aggregated statistics: which page was opened, the source QR code, country, device type and time. Visitors are not asked to create an account, their data is not sold, and they are not tracked across other websites. Orders and bookings happen directly with the business through WhatsApp, phone or delivery apps, which have their own policies.

4. Cookies and tracking

One essential session cookie for signing in to the dashboard.
Business pages carry no marketing cookies; our counter uses no persistent identifier.
On our marketing site we may use measurement tools (such as Google Analytics) after the visitor's consent where the law requires it.

5. Why we process data

To run the service and provide support, issue invoices, protect the platform from fraud, improve the product through aggregated statistics that identify no individual, and send operational messages (verification codes, subscription alerts). Marketing emails go only to people who subscribed, and every message has an unsubscribe link.

6. Where data is stored and who sees it

Data is hosted with reputable cloud infrastructure providers and transferred encrypted. Our staff access it only when needed for support, and service providers who process it on our behalf (hosting, payments, email) are bound by confidentiality agreements. We do not sell personal data.

7. Retention and deletion

We keep account data while the account exists and invoices for as long as the law requires. When an account is deleted, the page and its content are removed within thirty days, keeping only what the law requires. Visitor statistics are kept in aggregated form for the retention period of your plan.

8. Your rights

You may access, correct and delete your data, object to its processing and request a copy. Write to support@lamsaqr.qa and we will respond within thirty days. We may update this policy; the date at the top shows the last change.