Privacy policy

Last updated 02/11/2026

CHAWINNIX COMPANY LIMITED ("we") is the data controller for QR naka. This policy explains what we keep, why, for how long, and your rights under Thailand's Personal Data Protection Act B.E. 2562 (2019).

Data controller: CHAWINNIX COMPANY LIMITED (บริษัท ชวินนิกซ์ จำกัด) · registration no. 0105557139451 · 555, Nawamin Road, Khlongkum, Buengkum, Bangkok, THAILAND, 10240 · contact@chawinnix.com

1. What we do not collect

Every plain QR code and barcode is made in your browser: PromptPay numbers, amounts, Wi-Fi passwords, contact cards, text and logos are never sent to us. The read-QR page also reads pictures on your device. Accounts are optional: if you sign in, the QR codes you use are kept in your account (section 2.7).

2. What we collect

2.1 Site statistics

Pages opened, time spent, clicks, the kind of QR made and file format downloaded (never the content), device type, operating system, browser, screen size, language, time zone and the referring site, tied to a random id in the qrnaka_vid cookie or a daily id computed from the IP address, which is then dropped (with a salt deleted within 2 days). Legal basis: legitimate interest (section 24(5)) to improve the service; you can object at any time with "Decline" in the cookies section.

2.2 Tracked QR codes (when you create one)

The destination, name, style, creation time, device type used, and a random browser id (the qrnaka_dev cookie, stored as a hash), to run the link and show you its statistics; and the IP address of whoever creates it (and of whoever edits or manages it later), encrypted, kept 3650 days and then masked for good, to comply with the Computer-Related Crime Act (legal bases: legal obligation, section 24(6), and providing the service you asked for).

2.3 Scans of tracked QR codes (people who scan)

Time, device type, operating system, browser or app, language and approximate province / country, worked out from the IP address with a database on our own server, after which the IP is dropped. Our system does not store scanners' IP addresses, sets no cookie on them and sends no IP to anyone. QR creators see totals only, never individual scans (legal basis: legitimate interest, section 24(5)).

Location database: IP Geolocation by DB-IP (CC BY 4.0), kept on our own server; no IP is sent anywhere. It also picks the language of the pages when your device is set to neither Thai nor English (no IP is kept).

Tracked QR codes that start with qrnaka.net pass through Cloudflare's network before they reach our server, so they still lead to their destination when our server has trouble. Cloudflare therefore receives the IP address and connection details in transit, under Cloudflare's privacy policy. The copy kept at Cloudflare holds QR codes and destinations only; our own system still keeps no IP of people who scan.

2.4 Photo QR codes (when you create one)

The photos you upload, resized and re-saved (EXIF details such as where and when they were taken and the camera are removed on your device before sending and again on the server), the text above them, file sizes and a "fingerprint" of each picture (a value worked out from it, used to stop a blocked picture being uploaded again), plus the same data as in 2.2, to show the photos to people who scan and to let you manage the QR (basis: providing the service you asked for, section 24(3)). Older sets you replaced are no longer shown but are kept as history; you may ask us to delete them (section 5).

2.5 Reports of dangerous QR codes

The code, reason, details and contact (if you give one), used only to investigate and reply.

2.6 Web server logs

The web server keeps the usual access log (IP address, time, address opened and browser type) for security and troubleshooting. It is not used for statistics and is deleted automatically within 14 days (legal basis: legitimate interest, section 24(5)).

2.7 Accounts and QR history (when you sign in)

Accounts are optional. If you sign up or sign in we keep: your mobile number, your PIN (as a one-way hash) and how many wrong PINs were entered in a row, the name you choose (if any), your e-mail address (if you give one), the password of an older account that set one (also a one-way hash), your LINE user id and display name if you link LINE (the only two things we ask LINE for: no e-mail, no profile picture), language, and when and how you signed in, to run the account you asked for (basis: contract, section 24(3)). A browser that signed in remembers the account in the qrnaka_me cookie (encrypted), so next time it asks for the PIN alone, until you sign out.

QR history: while you are signed in, every QR code and barcode you download, copy, share or print is sent to us: what it holds and how it was made (encrypted), the file you got and a thumbnail, a short description and the time, so you can look back, download it again and open a copy to edit (basis: contract, section 24(3)). Keeping it is part of having an account and cannot be switched off; to keep a QR out of it, sign out before you make it. Team members with the permission can open the history to help you and to check misuse, and every look is logged (basis: legitimate interest, section 24(5)).

When you sign in, the tracked and photo QR codes of that browser ("My QR") move into the account, and that browser's site statistics (section 2.1) are tied to the account so the team can help you. SMS codes are kept as hashes and expire within minutes; the network asking for a code is kept as a hash to stop codes being requested too often.

Record of actions: every sign-in, change to an account and QR created or edited is recorded with the time, the kind of device and the values before and after, for good (it cannot be edited or deleted). The IP address of each action is kept encrypted for 3650 days and then masked for good, to prevent and settle disputes and to comply with the Computer-Related Crime Act, section 26 (bases: legal obligation, section 24(6), and legitimate interest, section 24(5)). Our team exports it only on a lawful written request from the authorities, and every export is recorded.

2.8 Who helps send messages and sign you in

Your mobile number and the code message go through the SMS provider we use (such as ThaiBulkSMS, SMSMKT or Twilio). When we send e-mail (such as a code by e-mail, or a notice about your account or a payment), it goes to your account's address through our e-mail provider. An account linked to LINE signs in through LINE (LY Corporation) under LINE's privacy policy.

2.9 Membership and payments

As a member we keep: the end of your trial and of the time paid for, your plan, your payments (amount, date, the way you paid and the payment provider's reference), receipts (the name, tax ID, branch and address you enter for a tax invoice), and for a card kept for automatic renewal only its brand and last four digits: the full card number is typed on the payment provider's page and we never see it. If you pay by transfer with a slip, we keep the slip image on our server (never shown on the site; team members with the permission open it to check, and every look is logged), to provide the service and issue receipts (basis: contract, section 24(3)) and to keep accounting and tax records as the law requires (basis: legal obligation, section 24(6)). API: we keep keys as hashes and the number of calls per day, not the caller's IP.

3. How long

We keep system history for the long term for accuracy and audit, except IP addresses of link creators and of actions (masked after 3650 days) and the daily-id salts (deleted within 2 days). Accounts and QR history are kept until you ask us to close the account. On request we mask data that identifies you instead of deleting history, except what the law requires us to keep. The record of actions (values before and after each change) cannot be edited or deleted: it confirms what happened, settles disputes and answers lawful requests from the authorities. Payments, receipts and slips are kept at least as long as accounting and tax law require.

4. Sharing

We do not sell data, use no ad networks and share nothing with third parties, except processors that help us run the service (such as servers, the helpers that send messages and sign you in, section 2.8, and payment providers, section 2.9) under confidentiality, or authorities as the law requires.

5. Your rights

You may ask for access, a copy, correction, deletion or masking, restriction, objection and portability, and complain to the Personal Data Protection Committee. Write to contact@chawinnix.com. We may ask for something that shows the data is yours (such as writing from the account's e-mail or number, or a QR's manage link). Account holders can see and download their own QR history on the history page.

6. Security

Encrypted connections, encrypted secrets, team permissions by role, and every change in the system is logged.

7. Changes

When we update this policy, the date above changes.

8. The QRnaka mobile app (iOS and Android)

The app makes QR codes and barcodes, reads QR codes and makes PromptPay cards on your device. What you type, the photos you pick and the files you make stay on your device and are not sent to us, unless you sign in and use the members' part (tracked QR, photo QR and the QR history, section 2). The app has no ads and no third-party trackers.

The permissions it asks for are used only when you tap: the camera (scanning a QR), adding pictures to your photo library (when you save a QR), location (only when you tap "use my current location" on the map of a location QR). The app's settings (pinned and recent QR types, language, theme) stay on your device. The app has no third-party SDKs and sends nothing abroad; downloading the app and buying through a store follow Apple's and Google's policies. The app does not send photos or your location to us, except the photos you choose to upload as a photo QR.

Signing in on the app (your mobile number and a code by SMS, then a PIN) gives the app a key for that device, kept as a one-way hash with the device name and when it was last used. You can see each device and sign it out on your account page on the site. The account, membership and QR history are the same as on the site.

Buying membership in the app: you pay through the App Store or Google Play under Apple's and Google's terms. We receive only the result of the purchase (the product, start and end dates, the renewal status and the transaction id) and never see your card. Cancelling and refunds are done at the App Store or Google Play.

Deleting the account: in the app (Settings > Delete account) or on your account page on the site, confirmed with your PIN. The account closes at once and every device is signed out; the number can sign up again. The account's data is kept for at least 5 years after closing, as evidence of payments and tax, for audit and as the law requires, and is not used for anything else in that time. Tracked QR codes already printed keep going to their destinations. Steps: Delete a QRnaka account

9. Legal basis

We use data under Thailand's Personal Data Protection Act B.E. 2562 (2019) on these bases: contract (the account, membership, payments, tracked QR, photo QR and QR history you ask for) · legal obligation (evidence of payments and tax, and computer traffic data under the Computer-Related Crime Act) · legitimate interests (security, preventing misuse, the record of changes and site statistics without identities) · consent (the statistics cookie, as you choose in the cookie section of the terms of use)

10. Age

The service and the app are not made for children, and we do not knowingly collect data of anyone under 10. Anyone under 20 should have a parent's or guardian's consent before signing up or buying membership. If you find a child's data kept without that consent, tell us and we will close the account.