CodeQR privacy & data

For account, billing, marketing and mobile app data, CodeQR is the controller. For visitor event data generated by our customers' links, QR codes and pages, CodeQR is a processor and the customer is the controller.

Account data: name, email address and password, workspace and company name, and the settings you configure.

Billing data: plan, subscription status and payment information, processed by our payment provider (Stripe).

Approximate location (country, city and region).

User-agent information (device type, browser and operating system).

Referrer (the page that led to the click or visit).

Communications: messages you send to our support and privacy channels.

Provide, operate and maintain the Service.

Provide analytics dashboards and reports to our customers.

Process payments and manage subscriptions.

Detect, prevent and respond to fraud, abuse and security incidents.

Send marketing communications where you have agreed to receive them.

Retention commitment: event-level identifiers are retained for up to 90 days.

usage events for up to 14 months

Crash and error reports from the mobile app are kept for 90 days before deletion starts

We keep account data for as long as your account exists and, after that, only for the periods required by law (for example, tax and accounting obligations).

Our infrastructure is located primarily in the United States.

Transfers of personal data from the European Union and the United Kingdom are covered by Standard Contractual Clauses (and, for the UK, the UK Addendum) entered into with our subprocessors.

The current list is available at codeqr.io/legal/subprocessors.

Our Data Processing Agreement (DPA) is available at codeqr.io/legal/dpa and is incorporated by reference into our customer contracts.

Erasure — ask us to delete your personal data, under certain conditions.

Access — request a copy of the personal data we hold about you.

Rectification — ask us to correct inaccurate or incomplete data.

Erasure — ask us to delete your personal data, under certain conditions.

Restriction — ask us to restrict the processing of your data, under certain conditions.

Objection — object to processing based on legitimate interests.

Portability — receive your data in a structured, machine-readable format.

Opt out of the "sale" or "sharing" of personal data — we do not sell personal data.

We do not sell personal data.