Privacy Policy

This policy explains how QRCraft, 41 Radostovets Street, Almaty, Kazakhstan ("we") collects and uses personal data when you use QRCraft.

Data we collect

• Account data: email address, name and a hashed password.
• Content: QR code settings, destination URLs, landing page content and uploaded logos.
• Scan data: when someone scans a dynamic QR code we record the time, device type, operating system, browser, country and a one-way hash of the IP address. We do not store raw IP addresses of people who scan codes.
• Billing data: payments are processed by Paddle.com, our Merchant of Record. We do not receive or store your full card details; we store your Paddle customer and subscription identifiers.

How we use data

• to provide the Service, including scan analytics for code owners;
• to process subscriptions and send service emails;
• to prevent abuse such as phishing links;
• to comply with legal obligations.

The legal bases are performance of a contract, our legitimate interests and compliance with law.

Security processing

• Destination links of dynamic QR codes and published pages are checked against Google Safe Browsing to block phishing and malware. Only the URLs are sent, never your account details.
• IP addresses are used briefly in memory to limit abusive request rates; they are not stored.
• Passwords are stored only as bcrypt hashes. Sessions can be revoked from the account settings.

Cookies

We use a strictly necessary session cookie to keep you signed in. We do not use advertising cookies.

Sharing

We share data only with service providers needed to run the Service (hosting, email delivery, Paddle for payments) and when required by law. We do not sell personal data.

Retention

Account data is kept while your account exists. Deleting a QR code deletes its scan data. Deleting your account deletes your data within 30 days, except where we must keep records by law.

Your rights

Depending on where you live (for example under the GDPR or CCPA) you may access, correct, export or delete your data and object to processing. You can download all your data and delete your account yourself in the account settings. Contact support@qr-craft.app.

Contact

QRCraft, 41 Radostovets Street, Almaty, Kazakhstan. Email: support@qr-craft.app