Saltar al contenido

Privacy policy

Last updated: October 12, 2026 · Version 2026-10-12 · Leer en español

Beta policy. BoriQR is in private beta. A Puerto Rico attorney will review this policy before the paid service starts; if it changes, we will ask you to accept the new version.

1. Summary

BoriQR keeps what it needs to run your catalog and to charge for the subscription. We do not sell data, show ads or use analytics or tracking cookies.

2. Who this applies to

BoriQR (bori-qr.com) decides how the data described here is used. This policy applies to business owners who use the dashboard and to people who visit a catalog.

3. Business owner data

  • Account: when you sign in with Google, Auth0 receives your name, email address, profile photo and account identifier from Google. BoriQR stores that identifier and your email. Your name is only shown in the dashboard while you are signed in.
  • Business and catalog: what you enter in the dashboard, such as name, description, hours, address, phone, contact email, categories, products, prices, tags and offers.
  • Photos and logo: we convert each image to WebP in three sizes. The processed versions do not keep the original photo's metadata, such as location. The original image your browser uploads is deleted within two days.
  • Billing: Stripe receives your email, your account identifier and the business name and link, and at payment receives your card, name and billing address. BoriQR stores only the Stripe customer and subscription identifiers, the subscription status and its cancellation date. We never see or store your card number.
  • Terms acceptance: when you accept the terms and this policy we store your account identifier and your email at that moment; the business (identifier and link); whether it was at creation or reactivation; the versions of the terms, this policy, the purchase notice and the checkbox text; a SHA-256 fingerprint of each document's exact text; the language you saw them in; an attempt identifier; and the date and time (UTC). This record does not store your IP address or browser.
  • Photo uploads: your browser sends each photo straight to our storage on AWS. AWS's audit log (CloudTrail) records each upload with the IP address and browser it came from.
  • Messages: if you write to us, we keep your message in our email, provided by Google.

4. Catalog visitor data

Viewing a catalog needs no account and sets no cookies. Your browser remembers the language you choose. Our application logs record errors and events, such as the business link, without your IP address. To detect abuse, the AWS firewall keeps a sample of requests, with IP address and browser, for up to 3 hours.

5. What we use data for

  • Showing your catalog and letting you edit it.
  • Signing you in and protecting your account.
  • Charging for the subscription and calculating taxes.
  • Preventing abuse, investigating failures and keeping costs under control.
  • Proving that you accepted the terms, for example in a payment dispute.
  • Complying with the law.

We do not sell or rent data, or use it for advertising.

6. Cookies and browser storage

  • __session: Auth0 cookie that keeps you signed in. It is encrypted and cannot be read from JavaScript. It lasts up to 3 days, or 1 day without activity.
  • __txn_: temporary cookie while you sign in.
  • boriqr:draft:<link> (localStorage): your catalog draft in this browser, so you do not lose unpublished changes. It stays in the browser until you clear the site's data.
  • boriqr:business-setup:<email> (sessionStorage): what you have typed while creating a business. Cleared when you close the tab.
  • past-due-dismissed:<link> (sessionStorage): remembers that you closed the payment-due notice. Cleared when you close the tab.
  • boriqr-lang (localStorage): the language you choose in a catalog.

We do not use analytics, advertising or tracking cookies. Fonts are served from our own site. Stripe uses its own cookies on its payment and billing pages.

7. Where data is stored

On Amazon Web Services (AWS), region us-east-1 (Virginia, United States): the database (DynamoDB), photos (S3), logs (CloudWatch) and the audit log (CloudTrail). The site and published photos are delivered through AWS CloudFront, which keeps temporary copies on servers in several countries. Our providers may process data outside Puerto Rico.

8. Providers

  • Amazon Web Services: hosting, database, photos, logs and abuse protection.
  • Auth0 (Okta): sign-in.
  • Google: the account you sign in with, and the email and documents where we keep your messages and the record of your requests.
  • Stripe: payments, billing and taxes.

Each provider has its own privacy policy. We share only what each needs for its job. We may also disclose data when a law or a valid court order requires it.

9. How long we keep data

  • Account, business and catalog: as long as the account exists. Cancelling deletes nothing; they are deleted when you ask.
  • Published photos: while they are in the catalog. Photos you replace or remove: up to 60 days.
  • Photos of a cancelled business: taken out of public view and kept for a reactivation until you ask us to delete them.
  • Photos removed after a report: until they are reinstated or the business is deleted.
  • Photos uploaded but never published: until the business is deleted. We plan to have them deleted automatically after a period.
  • Terms acceptance record: as long as the account exists and up to 2 years after it is deleted, as evidence in disputes and payment chargebacks.
  • Application logs: 30 days. Firewall samples: up to 3 hours. AWS audit log, which includes the IP address of photo uploads: 400 days.
  • Database backups: 35 days. Earlier versions of photos: 30 days.
  • Temporary technical data (upload passes, daily quotas and processed Stripe notices): deleted automatically within 1 to 30 days.
  • Messages you send us and the private record of each request: as long as needed to handle the request, and at most 2 years.
  • Stripe keeps payment records under its own obligations, even after we delete your account.

10. Your rights and how to ask

  • See and edit: everything about your business is in your dashboard.
  • Correct: if you cannot do it yourself, for example because your subscription ended, we correct it for you: the business name, description, address, phone and email, and your account email. Your Google name and photo are changed at Google; the email on your receipts, in Stripe's billing portal.
  • Delete: you can ask us to delete a business or your whole account. We cancel the subscription with no automatic refund and delete the data and photos immediately. If we delete your whole account, we also delete your Auth0 user by hand. Backups and earlier versions disappear within 35 days, and application and audit logs expire on the schedule in section 9. Stripe keeps payment records. We keep the terms acceptance record for 2 more years, as evidence in payment disputes. We will tell you how to clear drafts saved in your browser.

To ask, write to mathcelopr@gmail.com from your account's Google email. If you write from another address, we will ask you to write from that one. Before deleting anything, we send a confirmation to that address and wait for your reply. We keep a private record of each request and what we did. We reply within 30 days.

11. Minors

BoriQR is not intended for anyone under 18 and we do not knowingly collect data from minors. If we learn that a minor created an account, we will delete it.

12. Security

Connections are encrypted (HTTPS) and data is encrypted on our servers. Only authorized operators have administrative access. We verify the signature of every Stripe notice and validate every uploaded image.

13. If there is a security breach

If we detect unauthorized access to your personal data, we will tell you as soon as possible and, as Puerto Rico Act 111-2005 requires, report it to the Department of Consumer Affairs (DACO) within 10 days of detecting it. We will tell you what happened, what data was affected and what you can do.

14. Changes to this policy

Each version is identified by its date. When we change this policy, we will publish the new version on this page and ask you to accept it the next time you create or reactivate a business. If the change is significant, we will also tell you by email. Earlier versions remain available on this page.

15. Contact

For privacy questions or to make a request, write to mathcelopr@gmail.com.