Privacy Policy

1. Who is responsible

Authentiqa is operated by A Maze Venture Limited (“Authentiqa”, “we”, “us”, or “our”), registered in Dhaka, Bangladesh (Flat A5, House 19, Road 13, Block G, Niketon, Gulshan-1, Dhaka-1212). We act as the data processor for brand clients who use our physical product serialization and as the data controller for our direct web properties and telemetry services.

2. What we collect

When a consumer scans a physical signed QR code, we collect technical verification metadata:

• Timestamp and ephemeral cryptographic signature verification token.
• Coarse IP-derived geographic locality (city/district level) used strictly for duplicate-code anomaly alerts.
• User agent header and device OS category (iOS, Android, desktop browser).
• Consented contact information (phone number, name, warranty email) strictly when voluntarily submitted by the consumer.

3. How we use it

Telemetry data is used to: (a) verify that the physical item is authentic and factory sealed; (b) isolate counterfeit duplicate batches when simultaneous scans appear in geographically disjoint locations; (c) allow brands to engage with consumers who explicitly opted into post-purchase VIP rewards or warranties.

4. Advertising audiences

Audiences built in Authentiqa and synced with your connected advertising platforms, customer data platforms (CDPs), or custom audience networks are generated strictly on a consent-first basis. We do not engage in unauthorized third-party cookie tracking or cross-brand data pooling. Your customers belong solely to your brand.

5. Who we share it with

We never sell or rent consumer scan data to data brokers. Data is accessible only to the specific brand owner whose product was scanned and authenticated infrastructure sub-processors (cloud hosting, cryptographic ledger nodes).

6. Storage & hosting

All cryptographic verification ledgers and telemetry databases are encrypted at rest using AES-256 and in transit via TLS 1.3 across ISO/IEC 27001 certified cloud infrastructure.

7. Data retention

Raw ephemeral IP addresses and scan headers are aggregated and depersonalized after 90 days. Cryptographic signature validation proofs remain immutable for the shelf-life lifecycle of the serialized batch.

8. Your rights

Consumers who submitted contact details may request access, rectification, or immediate erasure of their opted-in profile at any time by contacting our data protection desk at [email protected].

9. Cryptographic security

Each QR code signature incorporates high-entropy ECC-P256 elliptic-curve cryptography with one-way mathematical hashes, preventing reverse engineering, duplication, or brute-force tampering.

10. Children's privacy

Our verification portals are not directed to individuals under the age of 16, and we do not knowingly collect personally identifiable information from minors.

11. Cookies & local storage

We use strictly necessary session cookies for authentication portal state and anti-bot rate-limiting. No third-party ad tracking scripts run on physical verification scan landing pages.

12. Changes to this policy

We may update this Privacy Policy from time to time. Updates will be published on this page with an incremented version indicator and effective timestamp.

13. Legal contact

For legal inquiries, GDPR/DPA data protection officer correspondence, or law enforcement queries: