Privacy
Privacy Policy
How HonestQR handles account data, QR campaign data, scanner analytics, hosted files, payments, and customer rights.
Controller and contact
Kian Wanner, a sole trader established in England and trading as HonestQR, is the controller for HonestQR customer and website data. Contact support@honestqrcodes.com for privacy questions or rights requests.
Why we use data
We use account, billing, QR, and support data to perform the customer contract; security and limited service analytics for legitimate interests; tax and accounting records for legal obligations; and optional Google Analytics and Google Ads conversion measurement only with consent. When accepted, we may retain the Google click identifier that brought someone to HonestQR so a later first payment can be attributed to the advert.
Account data
We process account email, email verification status, session records, subscription status, support requests, invoices, receipts, and audit events so customers can use and manage the product.
QR campaign data
We store QR slugs, destinations, design settings, hosted-file metadata, static payloads, password-protection state, and export records needed to operate customer QR codes.
Scan analytics and IP truncation
When a code is scanned, we briefly truncate the IP address to make a daily scan bucket, then discard it. We do not store the raw or truncated address. Reports can include the time, code, country, city where available, device class, browser, operating system, and referring site.
- Raw scanner IP addresses are not stored in product analytics.
- Truncated scanner IP addresses are not stored after the daily bucket is derived.
- Location is stored at city granularity at most.
- Public redirect scans do not set cookies.
- Aggregate analytics are used for customer reports, abuse detection, reliability, and improving the service.
File hosting
Hosted QR codes can store uploaded files and metadata such as filename, MIME type, size, hash, storage key, status, and related QR code. Files may be scanned or blocked for safety, abuse, legal, or service-reliability reasons.
Processors and payments
Cloudflare provides hosting, storage, security, and network infrastructure; Stripe handles checkout, card details, subscriptions, invoices, and tax information; Resend delivers account and service email; Google Analytics and Google Ads measure consented website use, trials, and first payments attributed through Google click identifiers; and Google Web Risk checks destinations for known threats. The Google Ads payment feed does not contain customer email addresses. HonestQR stores Stripe identifiers, invoice links, receipt links, and subscription state, but not complete card details.
Retention
Account sessions expire after 30 days. Operational account and QR data is kept while an account is open. Support, billing, fraud-prevention, consent, and tax records are kept only as long as needed for legal, accounting, security, or dispute purposes. Account deletion removes data that is no longer required, but limited records and the last redirect destination may be retained where needed to meet legal duties and the code-longevity promise.
International transfers
Providers may process data in the United States, United Kingdom, European Economic Area, and other locations where they operate. Where UK data protection law requires safeguards, we rely on adequacy regulations or approved contractual safeguards provided by the relevant processor.
Customer rights and exports
Depending on the circumstances, you may ask for access, correction, deletion, restriction, objection, or portability, and may withdraw consent at any time. Customers can download an account ZIP or request account deletion from Billing. You can also complain to the UK Information Commissioner's Office at ico.org.uk.
Account email and billing details are required to create and operate a paid account. Without them, we cannot provide Pro or meet payment and security obligations. HonestQR does not use solely automated decisions that produce legal or similarly significant effects.