Last updated: April 2026

This Privacy & Cookies Policy explains how QRFollow (“we”, “our”, “us”) collects, uses, and protects your personal information when you use our website, application, and services at qrfollow.com. QRFollow is operated by SPACESTREAM.com Ltd.

1. Information We Collect

• Account details such as your name, email address, and password (hashed)
• QR code data, titles, destinations, and content you create
• Analytics data such as scan counts, timestamps, country, and referrer
• Technical information such as IP address, browser type, and device type

2. How We Use Your Information

We use the collected information to:

• Provide, operate, and improve our services
• Track QR code scans and provide analytics
• Process payments and manage subscriptions
• Send transactional emails (verification codes, password resets)
• Communicate with you about your account and service updates
• Maintain security and prevent abuse

3. Payments

Payments are processed by Stripe. When you make a purchase, your payment card details are handled entirely by Stripe. We do not see, store, or have access to your full card number. We receive only a confirmation of payment, your email address, and a Stripe customer ID to manage your subscription.

Stripe's privacy policy applies to payment data: stripe.com/privacy.

4. Data Sharing

We do not sell your personal data. We may share data with trusted service providers to help us deliver our services, including:

• AWS — hosting, database, email delivery (Amazon SES), and content delivery
• Stripe — payment processing
• OpenAI — AI content refinement (only text you explicitly submit via the AI Refine feature)

We may also disclose information if required by law or to protect our legal rights.

5. Cookies

We use a single, strictly necessary cookie to maintain your sign-in session. This cookie is encrypted (AES-256), HttpOnly, and Secure. It does not track you for advertising or analytics purposes. You can disable cookies in your browser settings, but the application will not function correctly without them.

6. Data Security

We take reasonable measures to protect your information from loss, theft, misuse, and unauthorised access. Passwords are hashed using scrypt. Session cookies are encrypted with AES-256. All traffic is served over HTTPS via CloudFront.

7. Data Retention

QR code scan events are retained for 60 days and then automatically deleted. Aggregated analytics (daily and all-time counts) are retained indefinitely. Account data is retained until you request deletion.

8. Your Rights

You may request access, correction, or deletion of your personal data by contacting us. If you are in the UK or EU, you have additional rights under the UK/EU GDPR, including the right to data portability and the right to lodge a complaint with a supervisory authority.

9. Changes to This Policy

We may update this Privacy & Cookies Policy from time to time. The latest version will always be available on this page.

10. Contact

For questions about this policy, contact us at support@qrfollow.com.