Privacy Policy

1. What We Collect

Account data (email address, hashed password), the QR codes you create (name, destination URL, design, settings), content you add such as Biz Pages and the contact details visitors submit through their lead forms, and the scan analytics described below.

When you create an account we also record the broad source of your first visit to our website (for example “search engine”, “social” or a campaign label such as “newsletter”) and the page you landed on, so we can tell which channels are worth continuing. We do not store your IP address or the full address of the page that referred you.

2. Scan Analytics & GDPR

When someone scans one of your QR codes, we record what is needed to show you useful analytics, and no more:

• the time of the scan, and the country and state/province, taken from the request headers of our edge network;
• device type, browser, operating system and their major versions (as reported by the browser), the browser’s language setting, and the time zone implied by the country and state/province (a time zone such as “America/Toronto” covers a large region; we do not work out the visitor’s city);
• the app the link was opened in, if any (for example a messaging app), the referring page, an optional placement tag you add to a link, and which smart-routing variant was served;
• a daily-rotating pseudonymous visitor identifier: a keyed hash (HMAC-SHA256) of the network address and the date. It lets us count unique visitors within a day and cannot be linked across days.

We do not store IP addresses — neither in full nor truncated. The address is used only in memory, to produce the pseudonymous identifier above. (Our infrastructure providers listed in section 6 may keep their own standard network logs, which can include IP addresses.) Automated visits from bots and link-preview services are recognised and excluded from your statistics.

You decide where each QR code points and who scans it. For that scan data you are generally the controller and we process it on your behalf; you are responsible for having a lawful basis and for informing the people who scan your codes. Business-plan customers can retrieve their own scan data through our API for use in their own systems.

3. Signing In with Google

If you choose “Continue with Google”, we receive only your email address from your Google account (scopes: openid, email, profile). We use it solely to create and identify your account. We never receive your Google password, and we do not read, modify, or access any other Google data such as Gmail, Drive, Contacts, or Calendar. You can revoke this access at any time from your Google Account permissions page.

4. Payments

Payments are handled by Stripe. We store only a Stripe customer reference to manage your subscription — never your card number.

5. Automated Checks & AI

Our AI-powered features (summaries, content suggestions, translation) are currently switched off, so no content is sent to an AI service. Destination URLs are checked for phishing and abuse using our own rules and blocklists; for some checks we fetch the destination page to look for warning signs. If we turn AI features back on, we will update this policy first and will not use your data to train third-party models.

6. Service Providers & Where Data Is Processed

We use these providers to run the service, each only for the purpose shown:

• Bunny.net — edge network that performs the redirect, our database, and file storage;
• Fly.io — application servers (United States, East Coast);
• Netlify — website hosting;
• Stripe — payments;
• Brevo — transactional email (verification codes, notifications);
• Google — sign-in, only if you choose it.

Our primary database is in the United States, with read-only copies in Europe and Asia-Pacific so the service is fast worldwide. Daily backups are stored in private storage in Germany. By using the service you understand that your data is processed in these locations.

7. Data Retention & Deletion

You can delete your QR codes at any time; deleted codes stop redirecting immediately. Scan records are kept together with the QR code they belong to. We keep daily backups for a limited time, so deleted data can remain in backups for up to about two months before it is overwritten. Contact us to delete your account and associated data.

8. Cookies

We use a single authentication cookie/token to keep you signed in, and store a few display preferences (such as theme and language) in your browser. No third-party advertising trackers are used in the scan-redirect path.

To measure our own website, we count page loads per day by page and by source category (for example “search engine”), in aggregate and without any identifier. For visitors outside the European Economic Area, the United Kingdom and Switzerland, we additionally set a first-party cookie named qm_attr for 30 days. It holds only the domain of the website that referred you, a campaign label if the link had one, and the first page you visited; it is copied to your account only if you sign up, and it is never shared with third parties. Visitors from the EEA, the United Kingdom and Switzerland do not receive this cookie.

9. Your Rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, and to object to or restrict certain processing. To exercise any of these rights, email us at the address below.

10. Contact Us

Questions about this policy, or want your account and data deleted? Email us at support@qrmaker.ai and we will respond within 30 days.