This Privacy Policy explains how to be confirmed ("Qrcado", "we", "us"), a NextFly product, collects, uses, and protects personal data when you use Qrcado and the pages served through the QR codes you create. Qrcado is a dynamic QR code platform: you create codes, and we host the destinations and record scan activity so you can measure them.
Information we collect
- Account information. Name, email address, password (stored hashed), and workspace or organisation details you provide when you register or invite teammates.
- QR content and destinations. The links, text, files, menu items, contact details, and other content you attach to your codes, along with the branded pages we host for you.
- Scan analytics. When a dynamic code is scanned we record aggregate scan events: a timestamp, an approximate location derived from the IP address (typically at country/city level), and coarse device and browser information. We do not use scans to build advertising profiles of the people who scan your codes.
- Billing information. Plan and subscription status. Card and payment details are handled by our payment provider (see Terms of Service); we do not store full card numbers.
- Cookies and similar technologies. See our Cookie Policy for the categories we use and how to manage them.
How we use information
- To provide, operate, and secure the service and the pages served by your codes.
- To resolve dynamic codes to their current destination and record scan analytics for you.
- To authenticate you, manage your account, and provide customer support.
- To process payments, manage subscriptions, and send service-related notices.
- To detect, prevent, and investigate abuse, fraud, and security incidents.
- To improve the product and, where permitted, to send product updates you can opt out of.
Legal bases for processing (GDPR)
Where the GDPR applies, we rely on the following legal bases:
- Contract — to provide the service you sign up for and to bill you.
- Legitimate interests — to secure, maintain, and improve the service and to prevent abuse, balanced against your rights.
- Consent — for optional cookies and any marketing communications, which you can withdraw at any time.
- Legal obligation — to meet accounting, tax, and other legal requirements.
Data retention
We keep account and content data for as long as your account is active. If you delete a code or close your account, we remove or anonymise associated personal data within a reasonable period, except where we must retain records to meet legal, accounting, or security obligations. Aggregate scan statistics may be retained in de-identified form. Specific retention periods are set out in to be confirmed.
Sharing and sub-processors
We do not sell personal data. We share data only with service providers that help us run Qrcado — such as cloud hosting, payment processing, email delivery, and analytics — under contracts that require them to protect it and use it only on our instructions. Our current list of sub-processors is available at to be confirmed. We may also disclose data where required by law or to protect our rights, users, or the public.
Your rights
Depending on where you live, you may have the right to access, correct, delete, export (portability), restrict, or object to our processing of your personal data, and to withdraw consent. You can exercise many of these directly in your account settings, or by contacting us using the details below. You also have the right to complain to your local data protection authority.
International transfers
We may process and store data in countries other than your own. Where we transfer personal data across borders, we use appropriate safeguards such as Standard Contractual Clauses or an equivalent lawful transfer mechanism. Details of the safeguards we rely on are available on request at to be confirmed.
Children
Qrcado is not directed to children and is not intended for use by anyone under the age required to consent to online services in their country (generally 16, or as set by local law). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
Contact and data protection officer
For privacy questions or to exercise your rights, contact us athello@qrcado.com. Our data controller of record isto be confirmed, to be confirmed. Data protection contact / DPO: to be confirmed.
Changes to this policy
We may update this policy from time to time. When we make material changes, we will update the date below and, where appropriate, notify you. Continued use of Qrcado after an update means you accept the revised policy.
Questions? Contact hello@qrcado.com.
Last updated: to be confirmed