Privacy Notice

1. Data we collect and why

• Account data — name, email address, avatar, company name and login credentials. Used to create and secure your account and to provide the Service. Legal basis: performance of our contract with you.
• Workspace content — QR codes, campaigns, projects, landing pages, brand kits, uploaded files and client records you enter. Used to deliver the features you use. Legal basis: performance of our contract.
• Scan and visit data — when someone scans a QR code or opens a landing page we record a timestamp, approximate country/city, device, browser, operating system, referrer and a truncated, salted hash of the IP address. We do not store raw IP addresses for scan analytics. Used to provide campaign analytics to the workspace owner and to detect abuse. Legal basis: legitimate interests in providing and securing the analytics product.
• Support messages — the content of emails or in-app messages you send us. Used to answer you. Legal basis: legitimate interests.
• AI assistant prompts — the messages you send to the in-app assistant and its responses. Used to generate answers and keep your conversation history. Legal basis: performance of our contract.
• Technical and security logs — device identifiers, IP address and request metadata used for security, fraud prevention and debugging. Legal basis: legitimate interests and legal obligation.

2. Who we share data with

• Service providers / subprocessors — hosting, database, storage, email delivery and AI model providers that process data on our instructions.
• Paddle.com — our reseller and Merchant of Record for the sale of QRForge Pro subscriptions. Paddle handles checkout, subscription management, payments, tax compliance, invoicing and refunds, and processes the data you provide at checkout under its own privacy notice.
• Professional advisers — legal and accounting advisers where necessary.
• Authorities — where we are required to disclose by law or to establish or defend legal claims.

We do not sell personal data.

3. International transfers

Some of our providers process data outside the EEA. Where that happens we rely on adequacy decisions or EU Standard Contractual Clauses together with appropriate technical safeguards.

4. Retention

Account and workspace data is kept while your account is active and for up to 30 days after deletion, after which it is deleted or anonymised. Scan and landing page analytics are retained for up to 24 months. Records required for accounting and tax are kept for the period required by Spanish law.

5. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict and port your data, to object to processing based on legitimate interests, and to withdraw consent where processing relies on it. Email support@qrforgepro.com and we will respond within one month. You may also complain to the Spanish supervisory authority (Agencia Española de Protección de Datos, aepd.es) or the authority in your country of residence.

6. Security

We apply appropriate technical and organisational measures, including encryption in transit, encryption at rest for stored files, row-level access controls that scope data to its owner, hashed credentials and least-privilege access for administrators.

7. Cookies and similar technologies

We use strictly necessary cookies and local storage to keep you signed in, remember workspace preferences and secure the checkout flow. We do not use advertising cookies. Any analytics we run is limited to aggregate product usage. You can clear or block cookies in your browser settings, though the app may not work correctly without the essential ones.

8. Changes and contact

We will update this notice when our processing changes and will note the new date above. Contact Ioan Adrian Mursa, Barcelona, Spain — support@qrforgepro.com.