BoxdQR Privacy Policy
Last updated: 15 November 2026
BoxdQR (boxdqr.com) is run by Shadowtek Pty Ltd (ACN 627 829 878). This policy explains what personal information we collect, why, and what you can do about it.
What we collect
From account holders and members
- Your email address, used to sign you in and to contact you about your account.
- What you record about your boxes and items: titles, notes, rooms, categories, quantities and photos.
- Payment records. Card payments are handled by Stripe; we see the payment records Stripe gives us (amount, date and number of boxes), never your card number.
- Where you first found us. If you arrive through a link that says where it came from, a small cookie remembers that label for up to 30 days and we save it on your account when you sign up. It holds the label only, nothing about you.
From people who visit boxdqr.com
- On our home page and these policy pages, Google Analytics sets cookies to count visits and see which pages people use and where they came from. Google processes this data, which can be outside Australia. It is never used on box pages or in your account. You can opt out with Google’s browser add-on at https://tools.google.com/dlpage/gaoptout.
- On the same pages, the Meta pixel sets cookies so we can measure our Facebook and Instagram ads and show them to people who visited. Meta processes this data, which can be outside Australia. It is never used on box pages or in your account. You can control ads based on this in your Facebook or Instagram ad preferences.
- When you ask for a sign-in email before you have an account, create your account or pay us, our server tells Meta and Google Analytics that it happened, so we can measure which ads and pages bring sign-ups. Meta gets your email address and, once you have one, your account number, both scrambled (hashed) so they can’t be read, your IP address and browser type, the Meta cookies from your visit if you have them, and the address of the page. Google Analytics gets your account number once you have one, the Google cookie from your visit if you have it, and for payments the amount. Meta gets the amount too. To report a payment, Stripe keeps those visit details with your checkout. It never sends your box contents, item names or photos.
Photo suggestions
- When you tap Suggest on a photo, that photo is sent to Cloudflare Workers AI to suggest a title and category. It is processed to answer that request only. Nothing is suggested unless you ask.
Why we use it
- To run the service: sign you in, store and show your inventory, print labels, make customs lists and exports, and process payments.
- To contact account holders about their account, payments and important changes.
- To keep the service secure and fix problems.
We do not sell personal information. We use only the visit and sign-up details above to measure and show our own ads, never what you record about your boxes.
Who can see your inventory
Only people signed in to your account. Box QR labels contain an address and a random code, nothing about what is inside: anyone who scans one sees a sign-in page. Photos are never public; they are only served to people signed in to your account.
Our operators can view an account to help when you ask for support. Each time, it is recorded, lasts at most an hour, and cannot reach billing or your team.
Who we share it with
The providers we use:
| Provider | What for | Where data may be held |
|---|---|---|
| Cloudflare | Hosting, database, photo storage and photo suggestions | Cloudflare data centres, worldwide |
| SMTP2GO | Sending sign-in and invite emails | May be outside Australia |
| Stripe | Payments, tax invoices and the visit details above | United States and other regions |
| Visit counts on our home and policy pages (Analytics) | United States and other regions | |
| Meta | Measuring our Facebook and Instagram ads | United States and other regions |
Some of these providers store data outside Australia. We choose providers with strong security and privacy commitments.
How long we keep it
- Your inventory and photos: while your account is open. Deleted boxes and items can be restored for a short time, then are removed.
- Payment records: 7 years, as required for tax.
- Support session records: kept as an audit log.
Your choices and rights
- You can see, change and export your inventory at any time in your account.
- You can ask us to close your account and delete your information by emailing hello@boxdqr.com.
- You can ask what personal information we hold about you and ask us to correct it.
We will respond within 30 days.
Security
Sign-in links and codes work once and expire after 15 minutes. Sessions and sign-in tokens are stored only as secure hashes. All traffic uses HTTPS.
Complaints
Email hello@boxdqr.com. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.
Changes
We will post any changes here and, for significant changes, email account holders.