Privacy Policy

QR Gate is a brand of Mortise Systems LLC, a Texas limited liability company ("QR Gate", "we"). It lets organizations (masajid, gyms, clubs, offices and others) open their doors to people who verify a phone number. Visitors don't make an account. We collect what it takes to check a phone, apply the organization's rules, open the door and keep a record of it.

• We don't sell or rent data, and we don't use it for advertising.
• Phone numbers are stored as a keyed one-way code, with the last 4 digits kept for display. Full numbers are kept only where an organization needs them (see below).
• Everything has a retention period, and an organization can delete all of its data.

When you verify your phone at a door, the organization that runs that door decides what's collected and why: whether it keeps a member list, asks for a waiver or a photo ID, offers text messages, or tracks staff hours. In privacy-law terms, the organization is the controller of that data and QR Gate is its processor: we process it for the organization, to run the features it turned on, under our data processing addendum. Questions about an organization's rules are best sent to that organization. We'll also help (see your requests).

QR Gate itself is responsible for its customers' accounts (the organization owners) and for two records that work across organizations: returning-visitor recognition and photo ID check results, both described below.

People at the door

• Your phone number, to text you a verification code. We store it as a keyed one-way code (made with a secret key we hold) plus the last 4 digits. Without that key, the code can't be turned back into a number or matched against a list of numbers.
• Each visit: the door, the time, the result (let in or turned away, and why) and how the door was opened (a code shown, or an unlock sent to a smart lock), plus your IP address and browser type.
• Full phone numbers are kept in these places only: an organization's own member list (members' name, number and email, as the organization enters them); and, encrypted, for a phone remembered at a door, for people who opted in to an organization's texts (until they reply STOP), for staff on an organization's staff clock, for park guests (until 30 days after check-out) and for event guests (until 90 days after the event).
• A remembered phone: after you verify, the organization can let this phone skip the text next time. Your number is kept encrypted on our side, tied to a random token in your browser, until the organization's remember period ends (30 to 365 days, its choice) or the phone is forgotten — by you clearing your browser, or by the organization.
• Waivers: if a door asks you to sign one, we keep the name you type, the last 4 digits of your number, which version you signed, the door, the time, and your IP address and browser type.
• Approval requests: at doors where someone approves each entry, the request (last 4 digits, door, time, answer) and a notification to the organization.
• Reports you send ("the code didn't work", "the door is stuck"), with any message you write.
• Passes: a member's access link or a guest pass holds the holder's name (if given), the keyed code of their number and the last 4 digits, and the doors and times it covers. The phone that confirmed a link keeps a token in its browser. If you add a pass or an event ticket to Apple Wallet or Google Wallet, the card holds the name on it, the doors or the event, and the dates; Apple or Google keeps it on your phone or account, and we update it when it changes or ends.
• Your name: if an organization asks for a name at the door, adds one, or takes it from a waiver you signed, it keeps that name with the keyed code of your number, for that organization only.
• Returning-visitor recognition: where an organization on a paid plan checks visitors (a member list, returning-visitor rules, owner approval, a trust code or a photo ID), we note that your keyed code was let in at that kind of place (for example, places of worship, or gyms). It never carries to a different kind of place, and goes dormant after 12 months without a visit.
• Photo ID checks: only the result, described in photo ID checks.
• Blocked numbers: an organization can block a number. We keep its keyed code and last 4 digits, and never tell the person they're blocked.

Guests of RV parks, campgrounds and marinas

When a park uses QR Gate for its bookings, it gives us each booking from its own booking system (forwarded confirmation emails, a spreadsheet, or typed in): the guest's name, phone number and email, the site, and the dates. We keep the phone number and email encrypted, use them only to send the guest their gate link and the park's texts about their stay (a welcome with the site number, and a warning before the site's power goes off), and clear them 30 days after check-out. The booking itself — dates, site, each time the gate let them in, and when the site's power went on and off — is kept 2 years as the park's record. The text of a forwarded booking email is cleared after 30 days.

Guests on an event's guest list

When an organizer uses QR Gate for an event, they give us their guest list: each guest's name, and an email or phone number if they have one. We keep the email and number encrypted and use them only to send that guest their invitation and reminders for that event. A guest's own page holds their ticket; we record when it was opened, their answer (going or not) and when they were checked in, and by which of the organizer's scanners. The email and number are cleared 90 days after the event; the guest list and check-ins are deleted 2 years after it.

Staff using the staff clock

• First and last name, the phone number (stored encrypted; the organization sees only its last 4 digits), and, if the organization adds them, an email address and pay rate.
• The number is used only to text that person about their own shifts: the link to clock in, and a reminder when they forget to clock out. It's kept while they're on the organization's staff, and deleted with their record.
• An identifier for the phone used to punch.
• Each punch in and out and each break, with the time and door, and any change the organization makes to them (who, when and why).
• The phone's GPS location at each punch, only when the staff member allows it, so the organization can see the punch happened at work. Refusing doesn't block the punch; it's noted.

Organization owners

• Your account: email, optional name, and a one-way hash of your password (never the password itself). Sign-ins on the QR Gate admin app, and that phone's push token. If you add a passkey, only its public key is kept; the secret part never leaves your device.
• Your team: if you invite people to help run your organization, their email (in the invitation), and once they join, their own account (as above) and their role. Invitations are deleted 30 days after they expire or are accepted.
• Your organization's setup: name, doors, hours, door codes (encrypted), member lists, waivers, branding, and any custom domain.
• Connections you choose: lock accounts (Seam, TTLock, SmartThings, Home Assistant) and calendar or schedule feeds you link. Their tokens, keys and private addresses are stored encrypted, and we don't keep lock-app passwords. Booking calendars (Airbnb, VRBO and similar) can include a guest's name and the last 4 digits of their phone; we keep what the calendar shows.
• Text-message registration, if you send messages to subscribers: your legal name, EIN, address and contact, which carriers require.
• Billing: handled by Stripe. We never see card numbers, only your plan, status and Stripe's references.
• Support tickets: your email and the messages you exchange with us.
• The changes log: every change to your organization's setup — doors, codes (never the code itself), locks, people, keys, settings — and who made it (you, someone on your team, QR Gate support, an API key, or QR Gate itself), shown in Activity → Changes.

Waitlists

If you join a waitlist for a product that isn't out yet, we keep your email and anything else you chose to give (your name, business, number of staff — or, for RV parks and marinas, the number of sites, your booking system, your gate today and where you are, plus which ad or link brought you). We use it only to tell you when the product launches — and, for a product we're piloting, to ask you a question or two about your place — and delete it when you ask or once it has launched and we've told you.

Cookies and browser storage

Owners get a sign-in cookie. Visitor pages store a token in your browser so a verified phone can skip the text next time, for as long as the organization chooses (always text, 30 days, 90 days, or a year). The token is only a random code: your number stays on our servers, encrypted, and the organization can make QR Gate forget a phone's browsers at any time (blocking a number does it too). Clearing your browser removes the token. The staff clock and kiosk screens store their own sign-in. Cloudflare's CAPTCHA reads browser signals to tell people from bots. There are no analytics or advertising cookies.

Some doors ask a newcomer to show photo ID once. The check is done by Stripe Identity, not by QR Gate:

• What's collected: a photo of your driver's license, passport or ID card, the details on it, and, at doors that ask for it, a selfie. Stripe compares your face in the selfie to the photo on the ID, which uses biometric data.
• By whom: Stripe collects and checks the images on its own page. QR Gate never receives them. We send Stripe only our own reference numbers, never your phone number.
• Why: to confirm you're the person on the ID before the organization lets you in.
• What we keep: only the result (verified or not), its level (ID, or ID and selfie), the door, the time and the keyed code of your phone, so no door on QR Gate asks you again.
• How long: as soon as the check is decided, we ask Stripe to delete the images and the details it collected. Stripe's own privacy policy also applies.
• Consent: the door tells you about the check before it starts, and nothing is collected unless you choose to begin. If you'd rather not, ask someone at the organization to let you in.

Apart from an organization's own updates (below), we text only what the service needs: verification codes, a door code you asked to have texted, and access links or guest passes someone sent to your number.

Some organizations also send updates by text. Those go only to people who opted in (ticked the box, then replied YES). We keep the exact wording you agreed to and when. Reply STOP at any time: messages stop and your number is deleted. A record that you opted in and out (with the last 4 digits) stays as proof. Message and data rates may apply. Each organization's texting terms are linked from its sign-up box.

• Sell, rent or trade any data.
• Use visitor data for advertising, or share it with advertisers or data brokers.
• Show one organization another organization's visitors, members or blocklist.
• Tell a blocked person they're blocked.

Visiting some places can say something sensitive about a person: attending a place of worship, or a firearm range. Organizations choose which features they use and what they collect. QR Gate processes visitor data only to run their doors.

We run our own app and database on rented servers. These companies help, each with only what its job needs:

• Hetzner: hosting. The servers our app and database run on.
• Amazon Web Services: sends our email through SES (recipients and content: alerts, password resets, access links, weekly summaries, support replies) and receives replies to support tickets. It also stores our encrypted database backups in S3 (us-east-1).
• Google Workspace: our own inbox, for email you send to support@ or privacy@.
• Twilio: phone verification and text messages. It gets the numbers we text or verify, the message content and replies like STOP, plus an organization's registration details if it sends messages.
• Stripe: payments. It gets owners' billing details and invoices; a photo ID check line names the door and the visitor's last 4 digits. Stripe Identity runs photo ID checks (see above).
• Cloudflare: the CAPTCHA (Turnstile) on visitor and staff-clock forms, our DNS, and organizations' own domains for their visitor pages (the domain name; visits to that domain pass through Cloudflare).
• Expo, Google Firebase and Apple: push notifications to owners' QR Gate app. They get the phone's push token and the alert text (a door name, a visitor's last 4 digits or a pass holder's name).
• Seam, TTLock and Samsung SmartThings: only for a lock an owner connects through them. They get the commands for that lock and temporary door codes labeled with the visitor's last 4 digits.
• Home Assistant: runs on the owner's own hardware when they connect it, and gets the lock commands for the doors they link.
• Calendar and schedule feeds an owner connects: Google Calendar or any calendar link (ICS), booking calendars, Planning Center, Masjidal, Smart Masjid, PushPress. We read schedules from them with the address or key the owner gives. We don't send them visitor data.
• Apple Wallet and Google Wallet: only when someone adds a pass or an event ticket to their wallet. They get the card's content (the name on it, the doors or event, the dates) and, for Apple, the phone's request for updates.

QR codes are drawn by our own software; no outside service sees a door's address.

If an owner sets up webhooks to their own systems, those receive the door, time, result and the visitor's last 4 digits.

• Visit history: 2 years by default — 1 or 3 years if the organization chooses.
• IP address and browser info on visits: 90 days.
• Staff GPS location: 1 year (the hours worked are kept).
• Intercom (approval) requests: 30 days.
• Remembered browsers (“skip the text”): 30 days after they expire or are forgotten.
• Visitor reports: 1 year after they're resolved.
• Support tickets: 2 years after the last activity.
• Changes log (who changed what): 2 years.
• Team invitations: 30 days after they expire or are accepted.
• Log of QR Gate staff opening an organization's data: 2 years.
• Park bookings: the guest's phone number and email 30 days after check-out; the booking and its gate and power record 2 years.
• Forwarded booking emails: their text 30 days; what was read from them 1 year.
• Event guest lists: guests' email and phone number 90 days after the event; the list and its check-ins 2 years.
• Signed waivers: kept while the organization exists.
• Members, visitor names, passes and blocked numbers: until the organization removes them.
• Text subscribers' numbers: deleted when they reply STOP.
• Waitlist sign-ups: until the product launches and we've told you, or sooner if you ask.

When an organization is deleted (Settings → delete organization), there's a 7-day window to undo it. After that, everything the organization holds is deleted, including its visit history, members, waivers, staff hours and settings. The owner's sign-in account remains until they ask us to delete it.

Database backups are kept 35 days, encrypted, then deleted.

• All traffic to QR Gate is encrypted (HTTPS/TLS).
• Phone numbers are stored as keyed one-way codes. Text subscribers' full numbers are encrypted.
• Door codes, lock-account tokens and calendar addresses are encrypted at rest (AES-256-GCM). Passwords, API keys and access-link tokens are stored only as one-way hashes.
• Backups are encrypted and stored separately from our servers.
• Owners can turn on two-factor sign-in or use a passkey. It's required for anyone on an organization's team who can open doors, and for the owner once they have a team. QR Gate staff accounts must use it, and every time staff open an organization's data it is logged.

QR Gate has no sign-up of its own for children. Where a child comes in through an organization, the organization decides how — usually under a parent's or guardian's phone number, which is the one verified. We don't knowingly collect information from children under 13; if you think we have, email privacy@qrgate.app and we'll delete it.

We hand over data only when the law makes us: a valid subpoena, warrant or court order. We check each request, give only what it names, and record it. Unless a court forbids it, we tell the organization whose data is asked for before we answer, so it can respond itself.

Organizations can export their own access log, members and other records from the dashboard and answer such requests directly.

QR Gate is offered to organizations in the United States. We don't offer it in the European Union or the United Kingdom.

Visitors: email privacy@qrgate.app with the phone number in question to get a copy of, or delete, the data tied to it. We may ask you to confirm the number is yours, and we answer within 30 days. Blocklist entries and signed waivers belong to the organization's records; if your request touches them, we'll tell you and the organization.

Organization owners: export your data as CSV from the dashboard (members, waiver signatures, staff hours, the changes log and, on paid plans, the access log), and delete your organization from Settings. If your organization needs a signed data processing addendum, see qrgate.app/dpa. To delete your sign-in account, or for anything else, email privacy@qrgate.app.

If this policy changes, we'll update it here with a new effective date, and email organization owners about significant changes.