Privacy Policy

1. Who is responsible

MERAF Digital Solutions runs this website and its store, and is responsible (the “controller”) for the personal data described in this policy.

QRSVP, QRSVP Pro and the add-ons run on your own WordPress website. The guest lists, registrations and check-ins of your events stay there: we do not receive them, and for that data you are the controller. If you ever share some of it with us, for example for support, our Data Processing Agreement applies.

2. Personal data we collect

• Orders and your account: your name, email address, billing address and phone number, your company’s name if you give it, your username and password (stored only as a secure hash), and your orders and subscriptions.
• Payments: the amount, date and status of each payment and the payment provider’s reference for it. Your card, PayPal or wallet details go to the payment provider; we never see or store them.
• Licences: the licence keys we issue to you, their plan and expiry date, and the addresses (domains) of the websites where you activate them. When QRSVP Pro or an add-on checks its licence, our licensing service receives the licence key, the website’s address and the IP address of the server that asks.
• Demo events: if you register for one of the demo events on this website, the details you enter in its form, as that event’s own privacy notice describes.
• Messages: what you send us by email, and our replies.
• Technical data: our web server records the IP address, browser and address of each request, to keep the website secure and to fix problems; and the cookies described in our Cookie Policy.

3. Why we use it, and on what legal basis

• To take and fulfil your orders, issue and renew your licence keys, provide downloads and updates, and help you with support — performance of our contract with you.
• To keep accounting and tax records — a legal obligation.
• To send you emails about your orders, licences, renewals and important changes — our contract, and our legitimate interest in keeping you informed.
• To keep this website, the store and our licensing service secure, and to prevent fraud and the misuse of licence keys — our legitimate interest in protecting them and our customers.
• To learn which links and campaigns bring us customers (WooCommerce’s order attribution) — your consent, which you can withdraw at any time in the cookie settings.
• To run the demo events you try — as each event’s privacy notice describes.

We do not sell personal data and do not use it for advertising. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

4. Who receives it

We share personal data only with those who need it to run the store and our services, and only as far as they need it:

• the payment provider you choose at checkout, such as PayPal or Cryptomus, to take your payment, under its own privacy policy;
• our licensing platform, the MERAF Production Panel, which we run ourselves, to create your licence keys and answer licence checks;
• our hosting and email delivery providers;
• authorities, when the law requires it, and a successor if our business is reorganised or sold, after telling you.

Our fonts are served from our own server, and our pages make no requests to other services, except when you choose them: the payment provider you pick at checkout, an event’s map, which loads from Google only when you ask to see it, and a WhatsApp chat button, which opens WhatsApp only when you tap it.

5. International transfers

MERAF Digital Solutions is based in the Philippines, and our providers may process data in other countries. Where data protection law requires it, we protect transfers with appropriate safeguards, such as the European Commission’s Standard Contractual Clauses.

6. How long we keep it

• Orders, invoices and payment records: as long as tax and accounting laws require.
• Your account: until you ask us to delete it. Your licence records: as long as the licence exists, and afterwards as part of your order records.
• Demo event registrations: as that event’s privacy notice describes.
• Web server logs: about five weeks.
• Messages: as long as we need them to help you and to keep a record of what we agreed.
• Cookies: as our Cookie Policy lists.

7. How we protect it

Connections use HTTPS, passwords are stored only as hashes, and access to customer data is limited to the people who need it. No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we will tell you and the competent authorities as the law requires.

8. Your rights

Depending on where you live, you can ask us to give you a copy of your personal data, correct it, delete it, restrict or object to its use, and receive it in a portable format. You can withdraw consent at any time, without affecting what was done before. You can see and correct much of your data yourself under My account.

To use your rights, write to us at the address below. We answer within one month and may ask you to confirm your identity.

You can also complain to the National Privacy Commission of the Philippines, under the Data Privacy Act of 2012 (Republic Act No. 10173), or to the data protection authority where you live or work. Please contact us first, so that we can help.

9. Children

Our store is not meant for anyone under 18, and we do not knowingly collect their personal data.

10. Changes to this policy

We may update this policy. The date at the top shows the latest version, and we will tell our customers about significant changes by email before they apply.