Privacy policy

Last updated 27 October 2026 · QrWallet is a product of Star Logics

This policy explains what personal data QrWallet (the web portal at qrwallet.pk and the QrWallet mobile app) collects, why, who it is shared with and how long it is kept. QrWallet is operated by Star Logics (“we”).

In short: QrWallet is a tool for businesses to request payments with Raast QR codes. We collect only what is needed to create those QR codes, record the payments and tell the business's team when money arrives. We do not sell data, show ads, or use third-party analytics or tracking.

1. Who this applies to

Merchant team members (owners, admins, staff) who sign in to QrWallet. Accounts are created by QrWallet or by the business owner — not by the public.
Customers of those businesses whose name, phone or order number a staff member adds to a payment request, and who pay a QR code. For this data the business is responsible for its customers; we process it on the business's behalf.

2. What we collect

Data	Why
Team member name, phone number, optional email, role and permissions	To sign in and to show who created each payment request
Password	Stored only as a one-way hash (Argon2); we cannot read it
Sign-in times, device name (e.g. “QrWallet app · OPPO CPH2343”), IP address	Security, preventing misuse, audit log for the business owner
Payment requests: amount, reference, status, times, the staff member who made it; optionally a customer name, phone number, invoice/order number and note typed by staff	To create the QR code and keep the business's payment record
After a payment: payer name, masked bank account (for example PK36****6702), transaction reference and amount received, as reported by the bank network	To confirm the payment and show the receipt
Mobile app: push-notification token, phone platform and app version	To send “payment received” notifications to the right phones
Customers opening a payment link: standard server logs (IP address, browser)	Security and keeping the service running

Fingerprint / face sign-in: your fingerprint or face data never leaves your phone and is never sent to us. The app only asks the phone's own secure storage to unlock a login saved on that phone.

Not collected: contacts, photos, location, microphone, card numbers, bank passwords or PINs. Customers pay in their own banking app; QrWallet never sees their banking credentials.

3. How we use it

Provide the service: create QR codes, show payments and reports, send payment alerts.
Keep accounts and payments secure, investigate misuse and fix problems.
Give support when the business asks for it.
Meet legal and financial record-keeping obligations.

We do not use the data for advertising and we do not sell it.

4. Who we share it with

Payment network: to create a QR code and receive the payment confirmation, the amount, the business's merchant ID and the payment reference pass through our payment gateway to 1LINK / Raast (State Bank of Pakistan's instant payment system). Customer names, phone numbers and notes are not sent to the payment network.
Push notifications: Expo, Google Firebase Cloud Messaging and Apple Push Notification service deliver alerts. They receive the phone's push token and the alert text (for example “Rs 2,500 received · QR by Ahmed”).
Hosting and network: our server host and Cloudflare (network security and delivery) process data on our behalf.
The business: owners and admins see their team's payment records; staff see what their permissions allow.
Authorities: only when the law requires it.

5. How long we keep it

Payment records and audit logs: while the business's account is active, and afterwards for as long as the law requires financial records to be kept.
Team member accounts: until deleted by the business owner or on request (see Delete account). Payments a person made stay in the business's records, linked to their name.
Push tokens: removed when you sign out or when the phone stops accepting notifications.

6. Security

All traffic is encrypted (HTTPS). Passwords are hashed, bank accounts are shown masked, every login is checked against the person's permissions, and sign-in attempts are rate-limited. No system is perfectly secure, but we work to protect your data and will tell affected businesses about any breach as required.

7. Your choices and rights

You can ask to see, correct or delete your personal data. Team members can also ask their business owner, who can edit or remove logins in QrWallet. To delete an account, follow these steps. Customers of a business can contact that business, or us.

8. Children

QrWallet is a business tool and is not meant for children under 18.

9. Changes

We will post changes to this page and update the date above. Important changes will be announced to business owners.

10. Contact

Star Logics · [email protected] · WhatsApp / phone +92 303 3930338 · starlogics.io