Privacy Policy

QR-hi OÜ, 17076409, Kadaka tee 7, Mustamäe, 12915 Tallinn, Harjumaa.

1. Who we are

QRhi (“we”, “us”) provides tools for creating QR codes and short links and viewing statistics about how they are scanned. This policy explains what personal data we process, why, and what rights you have. The data controller is QR-hi OÜ, contactable at [email protected].

2. Data we collect from account holders

When you create an account we store your email address, a hashed password and optional profile details (name, language, time zone). The content you attach to codes — destination links, uploaded files, contact card details, texts — is stored so your codes can work.

3. Data we collect when a code is scanned

When someone opens a QR code or short link we record the event: time, country and city derived from the network, device and browser type from the user agent, and a salted one-way hash of the IP address used only to count unique visitors and prevent abuse. We do not store raw IP addresses of visitors and we cannot identify a visitor from the hash.

4. How we use the data

We use account data to provide and secure the service, content data to serve your codes, and scan events to show you statistics, enforce plan limits and fight abuse. We do not sell personal data and we do not use it for third-party advertising profiles.

5. Cookies and local storage

We use strictly necessary cookies for signing in (session tokens) and a language preference cookie. The QR designer keeps an unsent draft in your browser’s local storage so your work survives a page reload. We do not use third-party tracking cookies.

6. Processors and transfers

Data is processed by infrastructure providers acting on our behalf: Supabase (database, authentication and file storage) and Cloudflare (hosting and content delivery). When payments launch, billing will be handled by Stripe, which processes card details on its own systems — card numbers never reach us. Processing may involve transfers outside the EEA under standard contractual clauses.

7. Retention

Account and code data is kept while the account exists. Scan statistics are retained for the period included in your plan. If you delete your account, your codes, files and profile are deleted; residual backups expire on a rolling schedule.

8. Your rights

Under the GDPR you can request access to, correction or deletion of your personal data, restrict or object to processing, and receive a portable copy. Write to [email protected]. You also have the right to lodge a complaint with your supervisory authority; in Estonia this is the Data Protection Inspectorate (Andmekaitse Inspektsioon).

9. Security

Access to production data is limited and authenticated, passwords are stored hashed, traffic is encrypted in transit, and per-user isolation is enforced at the database level. No method of storage is perfectly secure; we will notify affected users of a breach as the law requires.

10. Children

The service is not directed at children under 16 and we do not knowingly collect their data. If you believe a child has provided us personal data, contact us and we will delete it.

11. Connected apps and AI assistants

You can let an AI assistant such as Claude act on your account through our connector. Access is granted by you on a consent page and can be removed at any time from the assistant’s settings. A connected app can read and change the codes and statistics in your account; it cannot change your password, email or billing. We receive only the requests the assistant makes on your behalf, not your conversation with it, and we do not share your data with the assistant’s provider beyond answering those requests.

12. Changes and contact

We may update this policy as the service evolves; material changes will be announced on this page with a new date. Questions about privacy: [email protected].