Data & compliance

A short, factual summary of what OriginQR stores, who can see it, and which standards the product is built around. This is not legal advice.

What we store

For each brand account, OriginQR stores:

• Account basics — brand name, contact email, and subscription status (for billing and link resolution).
• Products — GTIN, product name, brand name, optional SKU, optional default redirect URL, and link status.
• Lots — lot code, expiration (and optional manufacture) dates, optional quantity, optional FDA FSMA-oriented key/value fields, and lot status (active or recalled).
• Recall details — when a lot is flagged recalled: reason, optional consumer-facing message, and timestamp; status changes are written to an audit history subcollection.

We do not invent product claims, customer testimonials, or regulatory certifications for you. Brands enter and own the accuracy of their own product and lot data.

Who can see it

• You (the brand account) — after sign-in, you can view and manage your own products and lots in the dashboard. Firestore security rules scope reads/writes to the owning brand.
• Anyone who scans a printed code — the public resolve endpoint returns product name, brand name, lot code, expiration, compliance status, and (if recalled) a safety message. It does not expose your full account, other lots, or billing details.
• OriginQR operators — infrastructure access is limited to running the service (Firebase project, Cloud Functions). We do not sell your product catalog or lot data.

Standards we reference

• GS1 Digital Link — web URIs that encode GS1 Application Identifiers such as GTIN (AI 01) and lot code (AI 10), so one printed 2D barcode can identify a product and batch and resolve online. OriginQR issues and resolves links in that shape.
• FDA FSMA Food Traceability Rule (concepts) — lots may include optional flexible fields aligned with common traceability concepts (for example traceability lot code, product description, location description). OriginQR is a software tool that helps you store and surface those fields; it is not a compliance guarantee or legal determination that your program meets FDA requirements.

What we are not

• Not a law firm, auditor, or certification body.
• Not a GS1 Member Organization — you still obtain GTINs through GS1 (or your existing source).
• Not a marketplace or consumer social network — no fabricated ratings or social proof.

Questions about your data? Email us.