Your privacy at LinkToQR

1. Scope and who is responsible

This policy applies to LinkToQR.co, its website, account dashboard, hosted dynamic QR redirects, support, and billing features (the “Service”). LinkToQR.co is responsible for the personal information described here. We do not control websites a QR code links to; their privacy policies apply after you leave our Service.

2. Information we process

Information you provide

• Account: email address, optional name, authentication details, and information received if you choose Google sign-in. Passwords are handled by our authentication provider; we cannot read them.
• Saved QR content: QR name, destination or payload, short alias, design settings, status, folders, and account activity. Dynamic destinations must be stored so redirects work.
• Billing: plan, billing email, customer, subscription and transaction identifiers, payment status, invoice details, and upgrade requests. Our payment provider processes payment-card details; we never receive or store them.
• Communications: your name, email, message, and other information you send us.

Information processed automatically

• Dynamic scans: scan time, referring page when supplied, UTM source/medium/campaign, general device type, browser and operating-system names, and approximate country, region, and city derived from network headers. One-way hashes derived from IP address and user agent help estimate unique scans; the raw values are not stored in scan records.
• Website analytics: pages viewed, actions such as generating or downloading a code (never what you type into the generator), device and browser type, approximate location, and how you found us. We measure this with Google Analytics, subject to your cookie choices.
• Service and security logs: hosting, database, authentication, and security providers may process IP address, user agent, request path, timestamps, and diagnostics to deliver and protect the Service.
• Sessions: authentication cookies and short-lived security values used to sign you in, prevent abuse, and maintain necessary state.

Dynamic QR owners can see scan counts and aggregated breakdowns by date, source, device, browser, operating system, and approximate location. We do not give them a scanner’s raw IP address.

3. How and why we use information

We use information to create and manage accounts and QR codes, resolve dynamic links, report scan analytics, process subscriptions, send service messages, provide support, secure the Service, prevent fraud and abuse, troubleshoot, comply with law, and improve reliability.

Where a legal basis is required, we rely on performing our contract with you, legitimate interests in operating and protecting the Service, legal obligations, and your consent, for example for analytics and advertising cookies where the law requires it. Consent can be withdrawn without affecting earlier processing.

4. Service providers and sharing

We rely on service providers to run the Service and share personal information with them only as far as their work requires. They provide:

• hosting, content delivery, and network infrastructure;
• database, authentication, and storage services;
• payments, tax, subscriptions, and invoicing;
• security, abuse prevention, and error monitoring;
• email delivery and customer support; and
• analytics and advertising.

Providers that process information on our behalf must protect it and may use it only to provide their services to us. Some act independently under their own privacy policies, such as Google for advertising, and our payment provider, which acts as merchant of record for purchases and handles your payment details under the privacy notice shown at checkout.

If you choose Google sign-in, Google shares the account details needed to sign you in, under Google’s own terms and privacy policy.

We may disclose information to comply with law, protect rights or safety, investigate abuse, or complete a merger, financing, acquisition, or asset sale. We do not sell or rent your account details or saved QR codes.

5. Cookies and browser storage

We use four kinds of cookies and similar technologies:

• Essential: sign-in, session security, abuse prevention, and remembering your cookie choice. The Service cannot work without them, so they are always on.
• Functional: browser storage that remembers things like a QR code you are about to save to your account.
• Analytics: Google Analytics cookies that show us how the website is used.
• Advertising: cookies from Google and its partners that show and measure ads, including personalized ads.

On your first visit, a cookie banner lets you accept or decline analytics and personalized-ad cookies. You can change your choice at any time with Cookie settings at the bottom of every page. If you decline, Google Analytics stops using cookies and you see non-personalized ads, which may still use cookies to limit repeated ads and prevent fraud.

If you keep browsing without choosing, the banner closes and the default for your region applies. In the European Economic Area (EEA), the United Kingdom (UK), and Switzerland, analytics and personalized-ad cookies stay off unless you accept, and Google’s own consent message handles personalized ads. Elsewhere they stay on unless you decline.

Security checks, Google sign-in, and checkout may set their own necessary cookies when you use them.

6. Advertising and analytics

Our website shows ads served by Google AdSense. Google and its partners use cookies to show ads based on your visits to this website and other websites. We do not share your account details or saved QR codes with advertisers.

We use Google Analytics to understand how the website is used, such as which pages and tools people use most. It does not receive what you type into the generator.

You can turn off personalized ads in Google’s Ads Settings, opt out of other vendors’ advertising cookies at aboutads.info, and block Google Analytics with Google’s opt-out browser add-on. Google explains its use of this information in How Google uses information from sites or apps that use our services.

7. How long we keep information

We keep account and saved QR information while your account is active or as needed to provide the Service. Deleted QR codes may first be marked deleted and made unavailable. Scan analytics, logs, audit records, support messages, and backups are kept as reasonably needed for analytics, security, disputes, and continuity. Billing records may be kept longer for tax, accounting, fraud-prevention, or legal obligations.

When information is no longer required, we delete or anonymize it. Backup copies may remain until overwritten in the normal backup cycle.

8. Your choices and privacy rights

You can update your name in Account settings, manage or delete saved QR codes in the dashboard, change your cookie choices with Cookie settings at the bottom of every page, and use the public static generator without an account. Depending on where you live, you may request access, correction, deletion, restriction, objection, or portability, and may complain to your local data-protection authority.

You can delete your account yourself from Account settings. Deleting erases your name and email address and revokes access; it cannot be undone. Because printed QR codes belong to the people who scan them as much as to you, dynamic codes you created keep redirecting under our print-safe guarantee unless you choose to switch them off during deletion. Codes that go unscanned for 24 months after an account closes may then be archived, and records we must retain for tax, accounting, fraud-prevention, security, or legal reasons are kept as described above.

To make a privacy request or close your account, use our contact form and submit the request using the email address connected to your account. We may verify your identity. We may retain information required by law or needed for security, fraud prevention, or legal claims.

9. Security and international processing

We use reasonable technical and organizational safeguards, such as encrypted connections, access controls, secure session cookies, restricted administrative access, and hashed scan identifiers. No online service is completely secure, so use a unique password and protect your email account.

Providers may process information outside your country. Where required, we rely on recognized transfer mechanisms and provider safeguards.

10. Children’s privacy

The Service is not directed to children under 13, and we do not knowingly collect their personal information. A higher local age for independent consent applies where required. Parents or guardians can contact us to request review and appropriate deletion.

11. Changes and contact

We may revise this policy as the Service, providers, or legal requirements change. We will post the revision here, update the date above, and provide additional notice for material changes when appropriate.