Privacy Policy

Online-QR ("we", "us", "our") respects your privacy. This Privacy Policy explains what information we collect, how we use it, and the choices you have. It applies to the online-qr.com website, the public QR-generation API (/v1/make-qr), the dynamic redirect service (/r/<code>), and the authenticated dashboard at app.online-qr.com.

1. Data we collect

• Account data — when you create an account: your email, name, an optional company name and role, your subscription tier, and your Stripe customer ID (once you have a paid subscription).
• QR content — the destination URLs / vCard data / WiFi credentials etc. you encode in a QR code, plus any optional password protection or expiry you set.
• Scan events — when someone scans one of your dynamic QR codes we record: timestamp, a SHA-256 hash of the visitor's IP (truncated to 16 hex chars; the raw IP is never stored), a coarse geolocation (country + city), and a parsed User-Agent (device type / OS / browser family). We do not record the full User-Agent string and do not set any tracking cookies on the visitor's browser.
• Billing data — Stripe stores your payment method on our behalf. We see only the last 4 digits of your card and the brand, plus invoice metadata.
• Logs — request paths, status codes, response times, and an X-Request-ID per request. Retained 30 days for debugging; aggregated metrics may be retained indefinitely.

2. How we use it

• Run the service you signed up for (generate QR codes, redirect scans, produce analytics dashboards).
• Process payments through Stripe.
• Send transactional email about your account: trial-ending reminders, scan milestones, payment failures, subscription renewals. You can opt out of milestone notifications in Settings; transactional emails about billing remain mandatory.
• Detect and prevent abuse — rate limits, fraud scoring, blocking obviously malicious QR destinations.
• Improve the product — aggregate, anonymized usage trends.

3. Who we share with

We only share data with sub-processors strictly required to run the service:

We do not sell, rent, or trade your data to third parties for advertising or analytics. We never load third-party ad networks (Google Ads, Meta Pixel) on the public redirect path unless YOU explicitly attach a pixel to one of your own QR codes, in which case the pixel fires only on that code's interstitial.

4. Cookies & tracking

The marketing site (online-qr.com) uses one cookie: a theme preference (light / dark / system). The dashboard uses session (authentication, httpOnly, SameSite=Lax) and banner-dismissed-YYYY-MM-DD (localStorage, dismisses the trial-ending banner for one day). The public scan path /r/<code> sets no cookies at all — analytics are derived from server-side scan events keyed on a hashed IP.

5. Data retention

• Account data: until you delete your account, then 30 days for backups.
• QR codes and scan events: until you delete or archive them.
• Logs: 30 days.
• Audit log: 1 year (configurable per enterprise contract).
• Stripe invoices: retained by Stripe per their policy.

6. Your rights (GDPR / CCPA)

If you're in the EEA, UK, or California you have the right to access, correct, export, or delete your personal data. The dashboard's Settings page covers most of this; for anything else email [email protected] and we'll respond within 30 days.

7. Security

All traffic is encrypted in transit (TLS 1.3). Passwords are hashed with bcrypt. Database connections use SSL with channel binding. Secrets are stored in a managed secret store, never in plaintext on disk. We rotate signing keys when a compromise is suspected.

8. Children

The service is not directed at children under 13. We don't knowingly collect personal data from anyone under 13; if you become aware that we have, contact us and we'll delete it.

9. Changes to this policy

We'll post any material change here with a new "Last updated" date. If the change affects how we use your data we'll also email you 30 days in advance.

10. Contact

Online-QR
Data Protection Officer
[email protected]

This policy is provided as a template tailored to online-qr.com's actual data flows. If your jurisdiction requires specific additional disclosures, consult counsel.