Operator: MX Design, a Sijilli online business registered in Bahrain under CR 166830.
Contact: support@bahrain-qr.com
1. About this policy
Bahrain QR is an independent QR creation and business-display service. It is not a bank, payment processor or payment provider and is not affiliated with or endorsed by any bank, wallet provider or payment company. This policy explains how MX Design processes personal data through the Bahrain QR app, website, account, poster and Apple Wallet services.
2. Information we process
- Account identifiers, name and email supplied through Sign in with Apple.
- Business names, settings and the Bahrain IBAN entered by the owner. Full IBAN values are encrypted when stored by the backend.
- QR, poster, digital-card and Wallet-pass information needed to provide requested outputs.
- Apple transaction identifiers, product, date, environment and business entitlement. We do not receive full card credentials.
- Staff and kiosk device names, device identifiers, invitation records, access-token hashes and last-active timestamps used to secure display-only access.
- Session, request, error, network and security information needed to operate and protect the service.
- Information voluntarily provided when requesting support.
We do not receive any amount entered in a third-party wallet or banking app and do not know whether a payment was completed. Optional poster logos remain on the device in version 1.0 and are not uploaded to the Bahrain QR backend.
3. How information is used
We use information to authenticate accounts, synchronize businesses, validate IBAN formatting, create requested QR material and Wallet passes, verify Apple purchases, provide support, prevent abuse, maintain security and comply with applicable obligations. We do not sell personal data or use it for behavioral advertising.
4. Owner responsibility
Bahrain QR cannot confirm that an IBAN belongs to the intended business or that a payment reaches the intended recipient. The owner must review the complete IBAN and test every QR before displaying, printing or sharing it.
5. Service providers
We use Apple for authentication, purchases, distribution and Wallet functionality; Cloudflare for hosting, encrypted database storage, delivery, security, rate limiting and operational logs; and Cloudflare Email Routing for forwarding support messages. Information may be disclosed when required by applicable law or valid legal process.
6. Storage, security and retention
We use encrypted transport, access controls, revocable sessions and encryption for stored full IBAN and Apple-token values. Account and business information is normally kept while the account remains active. Operational and security records are kept only as reasonably necessary for reliability, fraud prevention, accounting and legal obligations, then deleted or de-identified. Deleting an account removes data not required to be retained by law; it cannot erase posters, screenshots, printed copies or Wallet passes already saved elsewhere.
7. Your choices
Subject to applicable law, users may request access, correction or deletion. Business information can be corrected in the app, and permanent deletion can be initiated through Account → Delete account. Other requests may be sent to the contact address above. Users can also manage Bahrain QR authorization in their Apple Account settings.
8. Children and changes
The service is intended for business owners and authorized staff and is not directed to children. We may update this policy when the service, law or security practices change; the effective date identifies the current version.