Privacy Policy

1. Information we collect

Account information such as your name, email address, authentication provider identifiers and a securely derived password hash when password sign-in is used.

Business content you choose to provide, including business names, descriptions, contact details, links, offers, prices and uploaded images.

QR scan analytics such as scan time, source or placement label and a shortened hash derived from the browser user-agent. Infrastructure providers may also process network information such as IP addresses for security, delivery and operational logging.

Technical information required to operate the Service, including session cookies, language preferences, temporary OAuth state and security/request logs.

2. How we use information

We use information to provide and secure the Service, authenticate accounts, verify email addresses, process password resets, host and publish customer content, generate QR destinations, provide scan analytics, prevent abuse and communicate important service messages.

We do not sell personal information or QR visitor information to advertisers.

3. Legal bases

Where applicable, we process information because it is necessary to provide the Service you request, because we have legitimate interests in operating and securing the Service, because you have given consent where consent is required, or because we must comply with legal obligations.

4. Service providers

We use infrastructure and service providers to operate QR-Appy. These may include Render for application hosting, Supabase for storage or database-related services, Resend for transactional email, Google for optional Google sign-in and Cloudinary for selected website media. Each provider processes information under its own terms and privacy commitments.

Payment and billing information for paid plans is handled by Paddle, our payment provider and merchant of record for purchases where applicable. QR-Appy does not store full payment card numbers.

5. Retention

We retain account and business information while your account is active and for a reasonable period afterward where needed for security, backups, dispute resolution or legal obligations. Authentication and reset tokens expire automatically. Operational logs and scan analytics may be retained for a limited period appropriate to the Service.

6. Your choices and rights

Depending on your location, you may have rights to access, correct, delete or export personal information, object to or restrict certain processing, and withdraw consent where processing is based on consent. You can also update much of your business information directly in the dashboard.

7. Cookies and similar technology

QR-Appy uses essential cookies for signed-in sessions, language preferences and secure Google OAuth state. These are used to make the Service function and protect account access. We do not currently use advertising cookies on the core Service.

8. Security

We use reasonable technical and organizational safeguards, including HTTPS, secure session cookies in production, password hashing and access controls. No online service can guarantee absolute security, so you should also protect your account credentials and devices.

9. International processing

Our providers may process information in countries other than your own. Where required, appropriate contractual or legal safeguards may apply to those transfers.

10. Changes and contact

We may update this Policy as the Service changes. The date at the top shows the latest revision. For privacy or legal requests, use the support/contact address provided in QR-Appy account communications or any dedicated contact address published by the Service.