Privacy Policy

Effective October 14, 2026

QRedential is visitor access software for buildings. It is operated by Blue Coast Water, LLC (“we”, “us”). This policy says what information QRedential collects, why, who it is shared with, and what you can do about it.

Whose data this is

QRedential is used by building operators and the companies in their buildings (our “customers”). When a customer uses QRedential to invite a visitor or manage its staff, the customer decides what is collected and why, and we process that information on the customer’s behalf and under our agreement with them. If you are a visitor or an employee of a customer, the building or company that invited you is your first point of contact for questions about your information. You can also write to us at the address below.

What we collect

People with an account (building and company staff)

Name, email address, and the company and role they are assigned.
A password, which we store only as a one-way hash, never in readable form.
Sign-in activity and a log of changes made in the account (the audit log).

Visitors

Name, email address, phone number and company name, entered by the host or by the visitor on their private registration link.
A photo, if the host or the visitor adds one.
The visit itself: which company invited them, the dates and times the pass is valid, and which doors or floors it opens.
A message the host chooses to send the visitor. Hosts can also keep internal notes about a visit; those notes stay with the host’s company and are never sent to the visitor.

Door scans

Each time a pass is scanned at a door reader we record the time, the reader and door, the pass, and the result (allowed or refused, and why). The door system receives the pass’s code, not the visitor’s name or contact details.

Demo requests and messages

The name, email address and message you send through the request a demo or feedback form. The form is protected by Google reCAPTCHA, which processes information about your browser under Google’s own privacy policy.

Our public pages

On the public pages only (the home page, the sign-in pages, the API documentation and these legal pages) we count visits with a first-party, cookieless counter. It keeps a random session id in your browser tab that disappears when you close it, reduces your IP address to a hash that changes every day, and stores counts only. It never runs inside the signed-in app or on a visitor’s registration page.
The signed-in app uses a cookie to keep you signed in, and stores your language and light or dark theme preference.

How we use it

To run the service: send invitations and passes, check a pass when it is scanned and open the door when it is allowed, and tell a host when their visitor arrives if the host asked for that.
To send the emails the service is built on: registration links, passes, arrival notices, password resets and a daily activity report to the customer’s staff.
To keep the service secure: logging scans and changes, enforcing roles and permissions, and investigating misuse.
To answer demo requests, questions and support requests.

We do not sell personal information, we do not use it for advertising, and we do not use visitor information for any purpose of our own.

Within the customer. Each company in a building sees only its own visitors, passes and scan records. One company cannot see another’s. The building operator’s staff see the activity in their building according to the roles they are given.
Service providers that run parts of QRedential for us and only on our instructions: our hosting and database provider, our file storage provider (for photos), our email delivery provider, and the door access platform the building uses (today, Avigilon Alta) to open a door after a pass is approved.
When the law requires it, or to protect the safety of people or property, and in connection with a sale or reorganization of our business, in which case this policy continues to apply to the information.

How long we keep it

A visitor’s registration link expires after 30 days, and a pass stops working at the end of the time it was issued for or when the host revokes it. Records are kept for as long as the customer’s account is active, or for a shorter time if the customer asks us to delete them. When a customer leaves, we delete or return its records on request.

How we protect it

Traffic to QRedential is encrypted in transit. Access inside the app is limited by role, each company’s records are kept apart from every other company’s, changes are written to an audit log, and API keys are limited to the permissions they are given. No system is perfectly secure, and we will tell affected customers without undue delay if we learn of a breach that affects their information.

Your choices

You can ask to see, correct or delete your information. If a building or company invited you, ask them first, since they control that information; we will help them answer. You can also write to us directly. We will not treat you differently for making a request.

Children

QRedential is a workplace tool and is not directed to children under 13. We do not knowingly collect information from them.

Where the information is processed

QRedential is operated from the United States and its information is stored and processed there.

Changes

If we change this policy we will post the new version here with a new effective date, and tell customers by email before a material change takes effect.

Contact

Blue Coast Water, LLC
hello@bluecoastwater.com