Privacy Policy
Version 1.2 — Effective date: August 26, 2026
Applicable law: Swiss nFADP/nDSG (in force since 1 September 2023); EU GDPR where applicable.
These terms are currently under legal review.
1. Identity of the Data Controller
Ahmed Badiah
Individual operator — MiriSmartGuard
Switzerland
Contact: privacy@mirismartguard.com
2. Scope
This Privacy Policy applies to all personal data processed through mirismartguard.com. It covers two categories of data subjects: registered users who create a profile ("Owners"), and visitors who scan a QR code linked to the Service ("Visitors"). Visitors are data subjects — data about their scan is collected as described in §3.2 and §3.4.
3. Data We Collect and How
3.1 — Registered Users (Owners)
| Data | Format stored | Purpose |
|---|---|---|
| Full name | Plain text | Profile display |
| Email address | Plain text | Authentication, notifications |
| Phone number | AES-256-CBC with random IV | Contact — see §3.1a |
| Phone hash | HMAC-SHA256 | Deduplication, fraud prevention |
| Telegram username | Plain text | Public Telegram button |
| Telegram Chat ID | Plain text | Notification delivery |
| Profile photo URL | URL reference | Profile display |
| Status and bio | Plain text | Profile display |
| Account plan | Plain text | Feature access control |
| Notification preferences | Boolean flags | Notification delivery |
| Delivery address (optional) | Plain text | Physical product shipment |
3.1a — Phone number: how it is used
Your phone number is stored encrypted (AES-256) and is used for one purpose: to open a WhatsApp conversation when a visitor chooses to contact you. It is not shown on your profile page and is not contained in the page or its HTML source, so a visitor who only looks at the page does not receive it.
When a visitor taps the WhatsApp button, our server redirects their device to WhatsApp using your number. From that moment the number is known to that visitor and to WhatsApp — this is how the contact works, and it cannot work otherwise. You can switch the WhatsApp button off at any time in your dashboard.
3.2 — Visitors (non-registered)
Visitors who scan a QR code are data subjects. The following data is collected at the time of a scan:
| Data | Format stored | Purpose |
|---|---|---|
| Name (if voluntarily submitted) | Plain text | Scan notification to Owner |
| IP address | HMAC-SHA256 hash — plain IP not stored | Fraud prevention, rate limiting |
Visitors may request access to or deletion of their data by contacting privacy@mirismartguard.com.
3.3 — Waitlist Subscribers (pre-launch)
| Data | Purpose | Retention | Legal basis |
|---|---|---|---|
| Waitlist email (optional) | Launch announcement, product updates | Until launch + 6 months, or until unsubscribe | Consent (nFADP Art. 6.6 / GDPR Art. 6(1)(a)) |
Waitlist subscribers may unsubscribe at any time by contacting contact@mirismartguard.com. For the complete list of parties who may process your data, see §7.
3.4 — Scan Logs (every QR code scan)
| Data | Format | Retention |
|---|---|---|
| Timestamp | Plain datetime | 12 months |
| IP address | Hash only | 12 months |
| Country code (ISO 3166-1) | 2-letter code | 12 months |
| Device type | Category (mobile/tablet/desktop/bot) | 12 months |
| User-agent string | Truncated to 500 characters | 12 months |
| Whether scan was blocked | Boolean | 12 months |
4. What We Do NOT Collect
- We do not store IP addresses in plain text — only as HMAC-SHA256 hashes.
- We do not sell, rent, or trade personal data. Authorised delivery partners may confirm a delivery scan via our API — they receive only the recipient's name and QR serial, not phone numbers or addresses.
- We do not use data for advertising or profiling.
- We do not use third-party analytics tools (no Google Analytics, no Meta Pixel).
5. Legal Basis for Processing
| Processing activity | Legal basis |
|---|---|
| Account management and profile display | Contract performance (Art. 6(1)(b) GDPR / Art. 31 nDSG) |
| Scan logging and notification delivery | Contract performance |
| Rate limiting and fraud prevention | Legitimate interests (Art. 6(1)(f) GDPR / Art. 31 nDSG) |
| Visitor contact form submission | Consent (freely given, specific, informed) |
| Payment processing | Contract performance + legal obligation |
| Report handling and abuse prevention | Legitimate interests |
| Waitlist email collection | Consent (nFADP Art. 6.6 / GDPR Art. 6(1)(a)) |
6. Technical Measures
- AES-256-CBC with a random IV per encryption operation for all phone numbers
- HMAC-SHA256 for IP address and phone hashing — computationally irreversible
- Row-Level Security (RLS) enforced at the database level
- Service role access restricted to server-side API routes only
- Signed session cookies (httpOnly, Secure, SameSite=Strict) — cannot be read by JavaScript
- All data in transit transmitted via HTTPS/TLS
7. Data Sharing and Sub-processors
We do not sell data. The following parties receive personal data solely to operate the Service. This is the complete list — it applies to all data categories described in §3.
| Sub-processor | Role | Data received | Processing location | Safeguard |
|---|---|---|---|---|
| Supabase | Database, authentication | All profile data, scan logs, waitlist emails | EU — Ireland (eu-west-1) | SCCs |
| Vercel | Hosting, edge runtime | Server logs, IP addresses (hashed before storage) | EU — Germany (Frankfurt) | SCCs |
| Stripe | Payment processing | Name, email, payment instrument data | US / EU | SCCs + DPA |
| Resend | Transactional email | Email address, notification content | US | SCCs |
| Telegram | Push notifications | Telegram chat_id, notification content | Dubai / US | User's own Telegram account |
| WhatsApp / Meta | Contact facilitation | Phone number (as wa.me redirect URL — not stored by Meta beyond the redirect) | US / Global | User's own WhatsApp account; Meta ToS applies |
Core storage and processing (Supabase, Vercel) takes place within the European Union. Transfers to the United States (Stripe, Resend) are governed by Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR / Art. 16 nDSG). Telegram and WhatsApp operate under their own terms; the Service only initiates the contact — it does not transmit or store message content.
8. Data Retention
| Category | Retention period |
|---|---|
| Owner account data | Until account deletion + 30-day grace period |
| Scan logs | 12 months from scan date |
| IP rate-limiting records | 30 days after block expires |
| Payment records | 10 years (Swiss accounting law — Art. 958f CO) |
| Abuse reports | Until resolved + 6 months |
| Visitor data (name) | 12 months from last scan, then anonymised automatically |
| Transfer tokens | 48 hours (auto-expired) |
| Waitlist email | Until launch + 6 months, or until unsubscribe request |
9. Your Rights
Under nDSG (Art. 25–27) and GDPR (Art. 15–22), you have the following rights:
| Right | Description |
|---|---|
| Access | Request a copy of all personal data held about you |
| Rectification | Correct inaccurate or incomplete data |
| Erasure | Request deletion of your data (“right to be forgotten”) |
| Restriction | Request temporary suspension of processing |
| Portability | Receive your data in a machine-readable format |
| Objection | Object to processing based on legitimate interests |
| Withdrawal of consent | Withdraw any previously given consent at any time |
To exercise any of these rights: privacy@mirismartguard.com
Requests will be responded to within 30 days as required by Art. 25 nDSG.
10. Right to Lodge a Complaint
If you believe your data protection rights have been violated, you may lodge a complaint with:
Federal Data Protection and Information Commissioner (FDPIC / PFPDT)
Feldeggweg 1, CH-3003 Bern
www.edoeb.admin.ch
EU residents may also contact their local Data Protection Authority.
11. Automated Decision-Making
The Service uses automated rate-limiting logic to detect and block abusive scanning behavior based solely on hashed IP activity patterns. This does not involve profiling of personal characteristics. Blocked users may contact the Operator to dispute a block.
12. Children's Data
The Service is not directed at persons under 16 years of age. We do not knowingly collect personal data from minors. If we become aware that a minor has submitted personal data, it will be deleted immediately.
13. Cookies
The Service uses a single signed session cookie (httpOnly, Secure, SameSite=Strict) strictly necessary for visitor identification. No advertising, tracking, or analytics cookies are used.
14. Changes to This Policy
This Privacy Policy may be updated periodically. The "Effective date" at the top reflects the most recent revision. Registered users will be notified of material changes via email. Continued use of the Service constitutes acceptance.
15. Contact
Ahmed Badiah
Individual operator — MiriSmartGuard, Switzerland