Privacy Policy

Last updated: 14 September 2026

This Privacy Policy explains how QRecode ("we", "us", "our"), operated from the United Kingdom, collects, uses, and protects your personal data when you use qrecode.com. We are committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

QRecode operates at qrecode.com and acts as the data controller for personal data collected from registered users. For privacy matters, contact us at: privacy@qrecode.com

2. What data we collect

Account data

When you create an account: email address, name (if provided), encrypted password. If you use Google Sign-In: your Google account name, email, and Google user ID.

QR code and landing page data

The names, destination URLs, content, customisation settings, and creation dates of QR codes and landing pages you create.

Scan analytics data

When someone scans your QR code we collect: time and date of the scan, approximate location (country and city — derived from IP address which is not stored), device type, operating system, browser, and a one-way hash of the IP address used only to count unique scans. The original IP cannot be recovered from this hash. We do not identify the individuals who scan your codes.

Payment data

Payments are processed by Square. We store only your Square Customer ID, Subscription ID, and the last 4 digits of your card for display. We never store your card number or CVV.

3. How we use your data

Purpose	Legal basis (UK GDPR)
Providing the QRecode service — your account, QR codes, analytics	Contract (Article 6(1)(b))
Processing subscription payments	Contract (Article 6(1)(b))
Sending transactional emails — receipts, trial reminders	Contract (Article 6(1)(b))
Preventing fraud and ensuring security	Legitimate interests (Article 6(1)(f))
Improving the platform through aggregate analysis	Legitimate interests (Article 6(1)(f))
Complying with legal obligations (e.g. HMRC tax records)	Legal obligation (Article 6(1)(c))

We do not use your personal data for advertising. We do not sell or share your data with third parties for marketing.

4. Data sharing

Third party	Purpose	Location
Square	Payment processing and subscription management	USA (Standard Contractual Clauses apply)
Google	Optional: Google Sign-In authentication	USA (Standard Contractual Clauses apply)
Web hosting provider	Storing our database and files	UK / EU

We share your data with no other third parties except where required by law.

5. Data retention

Data type	Retention period
Account data	While your account is active, plus 30 days after deletion
QR codes and landing pages	Until you delete them or your account
Scan analytics	2 years, then automatically deleted
Billing records	7 years (HMRC requirement)

6. Your rights

Under UK GDPR you have the right to: access your data, correct inaccuracies, request erasure, restrict processing, data portability, and object to processing. To exercise these rights, email privacy@qrecode.com. We will respond within 30 days.

You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk · 0303 123 1113

7. Cookies

We use only essential and functional cookies. See our Cookie Policy for full details.

8. Security

We use HTTPS encryption, bcrypt password hashing, hashed IP storage, and restrict database access to authorised personnel. Card data is handled entirely by Square and never passes through our servers.

In the event of a personal data breach likely to affect your rights and freedoms, we will notify you and the ICO within 72 hours as required by UK GDPR.

9. Children

QRecode is not directed at children under 18. If you believe a child has provided us with personal data, contact privacy@qrecode.com and we will delete it promptly.

10. Changes to this policy

We will notify you of material changes by email and by updating the date at the top of this page.

11. Contact

QRecode — Privacy Team
Email: privacy@qrecode.com
Website: qrecode.com