Taqrio is operated by 宜都市飘昆商贸有限公司, the operator responsible for the personal information described in this policy. Contact contact@taqrio.cn for privacy questions, requests or complaints.

This policy covers the Taqrio website, merchant and administrator accounts, NFC/QR card management and the fixed-link redirect service. A merchant's destination website and third-party sign-in services have their own privacy policies. This policy describes our handling of information, rather than those services' independent practices.

Account and business information includes your name, email address and verification status, business name, language preference, avatar, account status, linked sign-in identifiers, and the policy versions and acceptance times recorded during registration. If you use WhatsApp authentication, we also handle your linked phone number.

Service information includes card identifiers, batches, ownership and management relationships, fixed public links, destination URLs and their history, card status, exports, and the business records and audit events created by your actions. Information you enter in a destination URL can be visible to visitors and to the destination service; do not put passwords or private access tokens in those URLs.

Security information includes session identifiers, session IP addresses and browser User-Agent information, authentication events, verification records, timestamps and security-related metadata. Some security events use a keyed IP fingerprint instead of the original IP address. Support information includes messages, feedback, your reply address and information needed to resolve your request.

The redirect service does not create per-tap visitor records, visitor profiles, or visitor location, device and referral analytics. Aggregate operational metrics measure service health and performance. Network requests still need technical information such as an IP address to be delivered, and a destination website may collect information under its own policy.

You can register with an email address and Taqrio password, or use an available third-party sign-in method. Registration requires your name, business name and acceptance of the displayed policies. Third-party methods are offered only when configured for the service; choosing one is optional.

Google sign-in supplies an account identifier and available profile information. During registration you enter an email you can receive, which must be verified with a Taqrio code before the account becomes active. Other supported providers, including Facebook and Instagram, supply the identifiers and profile information needed for the selected sign-in method. Instagram authentication is intended for supported professional accounts.

WhatsApp authentication uses your phone number and a one-time code delivered through Meta's WhatsApp service. It does not give Taqrio access to your address book or chat history. For providers that do not establish verified mailbox ownership, including TikTok, you must provide a reachable email address and complete Taqrio's email verification before account activation. We do not obtain your third-party account password.

If you choose TikTok sign-in and authorize Taqrio, Login Kit uses only the user.info.basic permission. We request your application-specific TikTok account identifier (open_id), display name and profile image to identify the connection, create initial account details and let you sign in or link your account. TikTok does not supply or verify your Taqrio email address through this integration.

We store the provider and account identifier, granted permissions, encrypted OAuth access and refresh tokens when supplied, and their expiry information to operate the authorized connection. This login integration does not request access to your videos, private messages, follower lists or permission to publish content. We do not use TikTok login information for advertising or sell it.

You can remove the TikTok connection in Taqrio's Account and Security settings; administrators use their Account page. This removes the local connection and its stored OAuth credentials. You may need to add another working sign-in method first. To revoke permission on TikTok's side, also manage Taqrio in TikTok's app permissions settings. Disconnecting Taqrio does not delete your TikTok account or information held independently by TikTok. You can request deletion of information held by Taqrio through the contact procedure below.

Taqrio uses necessary authentication and security cookies to maintain sessions, protect sign-in requests and remember session choices. Where offered, Remember me controls whether the sign-in cookie persists after the browser session. Browser session storage also holds a random tab identifier used to coordinate session lifecycle across tabs.

Taqrio does not add advertising or visitor-analytics trackers. We count only how many times each page is opened per day; these totals hold no IP address, device, referrer or cookie and cannot be linked to a person. Cloudflare Turnstile loads third-party security code on pages that use its verification challenge. You can control cookies and site storage in your browser, but blocking necessary storage can prevent sign-in or other protected functions. Signing out ends the current sign-in; you can also revoke sessions in the available account security settings.

We use information to create and verify accounts, authenticate users, manage merchant access and cards, maintain fixed links and destination settings, send verification and other service messages, answer support requests, prevent abuse, investigate failures and security incidents, and meet applicable legal obligations.

We process information when needed to provide the service you request, meet legal obligations, or on the basis of your consent where required. Where applicable law permits, we also use necessary security and operational information for the legitimate purposes of protecting the service and resolving disputes. Optional third-party login is based on the authorization you choose to grant. Declining optional login does not require you to use that provider; information essential to a requested function is still needed to provide it.

Our hosting and database infrastructure processes account and service information to run Taqrio. Alibaba Mail (阿里邮箱) processes recipient email addresses, message contents and delivery information for verification, account security, service notifications and support correspondence.

Cloudflare Turnstile processes technical verification information, including the challenge response and, where used for verification, the request IP address, to prevent automated abuse. If you select a third-party login, the relevant provider (TikTok, Google, Meta/Facebook, Instagram or WhatsApp) processes the authorization or authentication request under its own policies; we exchange only information needed for the selected function.

Authorized personnel and service providers may access information only as necessary for their work, subject to applicable confidentiality, security and contractual duties. We may disclose information when legally required, to respond to a lawful request, or when necessary to protect rights and address fraud or security incidents. We do not sell personal information or provide it for third-party advertising.

Taqrio's application servers and primary business data are located in the United States. Information you submit to Taqrio is therefore transmitted to and stored in the United States, including when you access the service from another country or region.

Email, third-party sign-in and security verification involve the providers described above, which may process information in additional locations under their own service arrangements. We do not represent that their processing is confined to the United States. Where applicable law requires additional notices, consent or other safeguards for international transfers, the operator must meet those requirements; this policy does not replace them. Contact us for questions about the processing of your information.

We retain account and service information while it is needed to provide your account and the card services you request. Verification codes, sessions and OAuth tokens have validity limits; expiry prevents further use for the relevant authentication purpose and does not mean every associated security record or backup is immediately erased.

When you disconnect a provider, its local account connection and stored OAuth credentials are removed. When a merchant account is closed, the application removes login credentials, linked OAuth accounts, sessions, MFA data and verification records, and anonymizes the account's name, email and avatar and relevant feedback details.

Stable ownership references, card settings and destination history, and necessary business, security and audit records can remain where needed to operate existing fixed links, trace authorized changes, resolve disputes or meet legal obligations. We assess retention by those purposes and applicable requirements, and delete or anonymize personal information when it is no longer needed. Backups may retain earlier copies until replaced or expired; any retained copies remain protected and are not a source for ordinary account use. Contact us about a particular record or deletion request; we will explain any applicable retention restriction.

Passwords used for sign-in are stored as hashes. If the optional merchant account-support feature is configured, merchant platform passwords set while it is enabled are also stored as encrypted copies that authorized platform administrators can view for account support after additional authentication; these access events are audited. Do not reuse a password from another service.

OAuth tokens are encrypted in storage. We use access controls, administrator authentication, audit records and other technical measures to reduce unauthorized access and misuse. No online system can guarantee absolute security. Keep your account mailbox and sign-in methods secure, and never send passwords, verification codes or session tokens to support. If an incident requires notification, we will take protective action and notify affected people or authorities as required by applicable law.

You may request access to or a copy of your personal information, correction, deletion, an explanation of processing, or withdrawal of consent. Depending on applicable law, you may also have rights to restrict or object to processing or request portability. Contact contact@taqrio.cn from your account mailbox, stating your account email, the connection or information concerned and the request you want us to handle. You can also complain through this address or contact the competent data-protection authority.

Do not include passwords, one-time codes, access or session tokens, or unsolicited identity documents. If you no longer have access to your mailbox, explain that so we can discuss proportionate ownership verification. We verify the requester and ask only for information necessary to identify and handle the request. We respond within the period required by applicable law and explain the outcome, any refusal and the reason for retained information. You can ask us to review that response through the same address.

After signing in, merchants can manage linked providers in Account and Security; administrators use their Account page. Disconnecting a provider removes that sign-in connection while the Taqrio account, business profile, cards, destinations and history remain. The service protects the last usable sign-in method, so another working method may be required first. Withdrawing optional authorization does not invalidate earlier lawful processing.

Merchants can permanently close their own account in Account and Security after verifying the confirmation code sent to their verified mailbox. Closure ends account access and cannot be undone. Cards retain their original merchant ownership, enabled state, fixed addresses and destination settings; configured redirects remain active. Registering again with the same email does not restore access to those cards. Before closing the account, arrange any needed card or destination changes, or contact support.

Unlinking a provider, closing an account and requesting deletion of particular information are separate actions. A request does not automatically remove all business records or shut down every fixed link. If deletion is restricted by applicable law or necessary retention, we will explain the restriction and limit further processing as required.

Merchant accounts are intended for adults authorized to operate a business, not for children. We do not knowingly seek children's personal information. If you believe a child has supplied information to Taqrio without the required authorization, contact us so we can assess and address it.

We publish updates on this page and identify the applicable policy version. Material changes will be brought to users' attention through an appropriate service notice or account email; we will obtain further consent where required. Contact 宜都市飘昆商贸有限公司 at contact@taqrio.cn for questions, requests or complaints.