QuickQRC Privacy Policy

Last updated and effective: 16 October 2026

This policy explains what personal data QuickQRC handles, why, who else sees it, how long it is kept and what you can ask us to do with it. The free generator runs in your browser, so what you put into a static QR code never reaches our servers. The optional Pro plans need an account and store what they need to run dynamic codes.

The short version

1. Who we are

QuickQRC (quickqrc.com) is run by Quick Espirt, a business based in Pakistan ("we", "us"). For the data described in this policy, Quick Espirt is the data controller: we decide why and how it is used.

Privacy questions and requests go to contact@quickqrc.com or through the contact page. We have not appointed a separate data protection officer.

2. Free generator and tools

When you type a URL, WiFi password, contact card or other content into the free generator:

1. Your browser runs our QR code library locally on your device.
2. The library turns your input into a QR pattern in your browser's memory.
3. The finished image is drawn on screen and saved straight to your device when you download it.
4. Your input is not sent to our servers at any point.

The same applies to the scanner, decoder, bulk generator, logo uploads and the other free tools: files and camera images are read in the browser and not uploaded. None of the free tools needs an account, and we do not build a profile of people who only use them.

A static code has no middleman. The data is printed into the pattern itself, so scanning it never touches QuickQRC, and we cannot see who scans it or when.

3. Visiting the website

• Server logs. Like any website, our servers and hosting provider log each request: IP address, the page asked for, time, and the browser's user-agent string. We use them to keep the site running, investigate errors and block attacks. They are not linked to QR content.
• Google Analytics. We run it with Consent Mode set to "denied" and client storage turned off. It sends anonymous, aggregate page-view pings with no analytics cookies and no identifiers that follow you to other sites.
• Fonts and scripts from other hosts. Pages load fonts from Google Fonts and a couple of form-validation scripts from the jsDelivr CDN. Your browser connects to those services directly, so they receive your IP address and browser details under their own privacy policies.
• Social links. Share buttons are plain links. Nothing is sent to a social network unless you click one.

4. Pro accounts

Dynamic codes point to a short link on our server so you can change where they go after printing. That only works if we keep some data:

• Account details: name, email address, a hashed password (never the password itself), two-factor settings, and the sign-in provider if you use Google, Microsoft or company single sign-on. From a sign-in provider we receive your name, email address and an account ID, nothing else.
• What you create: dynamic codes and their destinations, designs, folders, hosted pages, files you upload to them (images, PDFs, audio), API keys (stored hashed), and responses visitors send through your feedback pages.
• Teams: the members of a team account, their roles and pending invites, including the invitee's email address.
• Account activity: a log of security-relevant actions, such as sign-ins, plan changes and changes to team members, and counts of feature use for plan limits.
• Settings: preferences such as date and number formats.

5. Payments

Paid plans are sold by Paddle (Paddle.com Market Ltd and its affiliates) as merchant of record. You enter card or other payment details on Paddle's checkout, not on our servers, and Paddle handles them under its own privacy policy. We receive what we need to run your subscription: a customer and subscription ID, the plan, its billing interval, status and renewal or cancellation date. We never see or store your full card number.

6. People who scan dynamic codes

A scan of a dynamic code passes through our server on its way to the destination. The Scan Privacy Policy explains this for people who scan, in more detail. For the code owner's statistics we record:

• the time of the scan;
• a device type and operating system family (for example "mobile, iOS"), not the full browser string;
• country and city, looked up from the IP address in an offline DB-IP database on our own server, so the address is not sent anywhere. The IP address itself is not stored;
• a salted hash used only to count unique visitors. The salt changes every day, so it cannot be turned back into an IP address or used to follow someone across days.

Ad screen on Free-plan codes. Scans of dynamic codes made on the free plan may show a short countdown screen with an advertisement before continuing. The ad comes from a third-party ad network, which may set its own cookies and collect device data under its own privacy policy. Paid plans skip this screen, and static codes never show ads.

Password-protected and feedback pages. A password you type to open a protected code is checked and not stored. If you answer a feedback page, your answers are saved for the code owner.

7. Contact form and emails

Messages sent through the contact form, with the name and email address you give, are emailed to our inbox so we can reply. We use them only to answer you.

Account emails (verification, password reset, team invites, security and billing notices) are sent through our email provider, Brevo. We do not send marketing newsletters. If we ever start, it will be opt-in.

8. Cookies and browser storage

QuickQRC itself only sets cookies that are needed for a feature you use:

We use no advertising or tracking cookies of our own, and Google Analytics runs without cookies. You can block or delete cookies in your browser settings; if you block the sign-in cookie, the Pro dashboard will not work. The Cookie Policy lists every cookie and browser-storage item in detail.

9. Why we use data

Where laws such as the GDPR require a legal basis, these are ours:

10. Who we share data with

We do not sell personal data or share it for cross-context behavioural advertising. We share it only with service providers that help us run QuickQRC, each limited to what it needs:

• Hosting provider: runs our servers and database.
• Paddle: payments, invoices, tax.
• Brevo: sends account emails.
• Google, Microsoft, WorkOS or your company's identity provider: only if you choose to sign in with them.
• Google Analytics: anonymous aggregate page views.
• Ad networks: only on the Free-plan scan ad screen, as described above.

We may also disclose data when the law requires it, to protect people from harm or fraud, or to a company that takes over QuickQRC, which would remain bound by this policy.

11. International transfers

We are based in Pakistan and our providers operate in several countries, including the United States and the EU, so your data may be processed outside the country where you live. Where the GDPR or UK GDPR applies, we rely on our providers' transfer safeguards, such as the European Commission's Standard Contractual Clauses or an adequacy decision.

12. How long we keep data

• Account, codes, pages and uploads: until you delete them or your account.
• Scan records: for the life of the code; deleted with the code or account. Your plan sets how far back the dashboard shows.
• Account activity log: for the life of the account.
• Server logs: only as long as needed for security and troubleshooting, then overwritten.
• Contact-form emails: as long as needed to handle your question.
• Billing records: kept by Paddle and us for as long as tax and accounting law requires, even after the account is deleted.
• Backups: deleted data can stay in encrypted backups until they are overwritten on their normal cycle.

13. Security

All traffic uses HTTPS. Passwords and API keys are stored as hashes, two-factor authentication is available on every account, sign-in attempts are rate-limited, uploaded files are checked by their actual content before they are accepted, and staff access to data is limited to what is needed to run and support the service. No system is perfectly secure; if a breach affects your personal data, we will tell you and the authorities where the law requires.

14. Your rights

Depending on where you live, laws such as the GDPR, UK GDPR and US state privacy laws (including California's CCPA) give you rights over your personal data. We offer the following to everyone, wherever you are:

• Access a copy of the personal data we hold about you.
• Correct data that is wrong. Most account details can be changed in your profile.
• Delete your data. You can delete your account yourself from Pro settings.
• Export your data in a common machine-readable format.
• Object to or restrict processing based on legitimate interest.
• Not be treated differently for using any of these rights.

Send requests to contact@quickqrc.com. We may ask you to confirm the request from your account email address so we know it is you. An authorised agent may make a request for you with your signed permission. We reply within one month (45 days under US state laws), and will tell you if we need longer for a complex request. If we turn a request down, you can ask us to reconsider by replying to our answer.

If you are in the EU, EEA or UK, you can also complain to your local data protection authority. If you only use the free tools, we hold nothing that identifies you.

15. If you collect data with QuickQRC

When a Pro user collects information from other people, for example answers on a feedback page or data from their own Google Analytics or Meta Pixel tag added to a code or page, that user decides what is collected and why and is the controller of that data. We process it on their behalf. If you scanned someone's code and want your data removed, please contact the owner of that code first; we will help if you cannot reach them.

16. Children

Pro accounts are for people aged 16 or over. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

17. Changes to this policy

We update this policy when our service or the law changes, and the date at the top shows the current version. If a change materially affects how we use account holders' data, we will email them before it takes effect.

18. Contact

Questions about your data or this policy: email contact@quickqrc.com or use the contact page.