Privacy Policy

qrthatworks (“we”) operates qrthatworks(the “Service”). We respect your privacy and only collect the information we need to deliver the Service.

This Policy applies to personal information we collect when you visit our website, create an account, purchase credits, or upload images for processing.

You provide:

• Account details: email address and password (hashed).
• Billing details: name and billing address processed by Stripe (we never see your full card number).
• Images and files you upload for AI processing.
• Support requests, feedback, and other content you send us.

Collected automatically:

• Log data: IP address, browser type, pages visited, timestamps.
• Device data: operating system, screen size, language.
• Cookies and similar identifiers (see Section 6).

We use personal information to:

• Provide, maintain, and improve the Service.
• Process payments, fulfill orders, and credit your account.
• Respond to support requests and customer enquiries.
• Detect, prevent, and address fraud, abuse, or technical issues.
• Comply with our legal obligations and enforce our Terms.
• Send transactional and security-related messages (e.g. receipts).

We do not sell your personal information. We do not share the destinations of the links you shorten with advertisers, data brokers, or any third party other than the trusted sub-processors required to run the Service.

When you shorten a URL, we store the destination URL, your chosen slug, the owning account, an aggregate click counter, and a creation timestamp on our managed Redis infrastructure. This is the minimum data required to resolve the short link and show you how many times it has been clicked.

We do not log individual visitor IPs, referrers, or user agents alongside short links, and we do not use the destinations of your links for marketing, profiling, or any purpose other than providing the Service to you.

Payments are processed by Stripe, Inc. Stripe collects and processes your payment information in accordance with its Privacy Policy. We receive a token from Stripe along with the last four digits of your card, card brand, billing country, and the amount charged never your full card number.

We use a small number of essential cookies to keep you signed in and to remember checkout state. We may also use privacy-respecting analytics (such as Vercel Analytics or Plausible) to understand aggregate traffic patterns. No third-party advertising cookies are placed without your consent.

You can clear or block cookies through your browser settings. Some parts of the Service may not work without essential cookies.

We share personal information only with:

• Service providers (sub-processors) that help us run the Service for example Stripe (payments), Vercel (hosting), and our managed Redis provider. Each is bound by contract to use data only on our instructions.
• Authorities, where required by law, court order, or to protect rights, safety, or property.
• Successors, in connection with a merger, acquisition, or sale of assets with prior notice to you where required.

• Account data: retained while your account is active.
• Uploaded images and derived outputs: deleted within 24 hours of processing.
• Transaction records: retained for the period required by tax and accounting law (typically 7 years).
• Support tickets: retained for up to 24 months.

We use industry-standard administrative, technical, and physical safeguards to protect your data, including TLS in transit, encryption at rest, and access controls. No system is perfectly secure, however, and we cannot guarantee the absolute security of your data.

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your account and personal information.
• Object to or restrict certain processing.
• Receive a portable copy of your data.
• Withdraw consent, where processing is based on consent.
• Lodge a complaint with your local data-protection authority.

To exercise any of these rights, email us at support@qrthatworks.com. We will respond within 30 days.

We are based in United States. If you access the Service from outside United States, your information may be transferred to, processed, and stored in countries whose data-protection laws may differ. Where required, we rely on Standard Contractual Clauses or other lawful transfer mechanisms.

The Service is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

We may update this Policy from time to time. Material changes will be communicated by email or in-app notice. The “Last updated” date at the top reflects the current version.

Privacy questions, data-rights requests, or complaints:

support@qrthatworks.com

See also our Terms of Service, Refund Policy, and Acceptable Use Policy.