Privacy policy

QRArchive is run by Spendjot Ltd (company number 16431337), 86-90 Paul Street EC2A 4NE, London, England (“we”, “us”). This policy explains what personal data we handle and why, whether you have an account, scan one of our customers’ QR codes, visit a landing page or send an enquiry.

For account data, billing and keeping the service secure, we are the controller. Scan analytics, landing page analytics and enquiries are collected for the business that owns the code or page. For that data, the business is the controller and we act as its processor, handling the data only on its instructions.

When you scan a dynamic QR code made with QRArchive, we record that a scan happened, together with:

• the date and time;
• the device type, operating system and browser family (for example “iPhone, Safari”);
• the country (not your town or exact location);
• the language your browser prefers;
• the domain of the website that referred you, if your browser shares it.

We do not store your IP address. We use it briefly, in memory, to work out the country, to stop abuse and to count unique visitors. To count unique visitors we combine it with a secret key, the date and the specific code, and keep only a scrambled one-way fingerprint. The fingerprint changes every day and is different for every code, so it can’t be used to recognise you across days, across codes or across businesses.

We don’t set cookies when you scan, we don’t build profiles, and we don’t sell or share scan data for advertising. Once we send you on, the destination’s own privacy policy applies.

Landing pages hosted by QRArchive record page views and clicks on buttons and links in the same privacy-friendly way as scans: no IP address is stored and no cookies are set.

If you send an enquiry through a page’s contact form, we store the name, email address, phone number and message you enter. We pass them only to the business that owns the page, so it can reply to you. That business decides how it uses your details after that. Please read anything it tells you on the page. To block spam we use a short-lived, anonymised network fingerprint, and we never store your IP address.

Videos on landing pages come from YouTube or Vimeo, using their privacy-enhanced players. Nothing loads from them until you press play, and after that their privacy policies apply.

We collect:

• Account details: your email address, name, password (stored only as a secure hash), and your profile picture if you sign in with Google;
• Your content: the QR codes, destinations, designs, logos, landing pages, folders and tags you create;
• Workspace and team data: the workspaces you belong to, your role and the invitations you send;
• Billing records: your plan, subscription status and Stripe customer ID. Stripe processes your card details, and we never see or store full card numbers;
• Security and activity records: sign-in events (our sign-in provider records the IP address and device for security), and an audit log of important actions in your workspace, such as changes to destinations, team or billing;
• Messages: anything you send to support.

• To provide the service you signed up for, including redirects, analytics, reports, team features and billing. Our legal ground is the contract with you.
• To keep the service and the people who scan codes safe, including fraud and abuse checks, rate limiting, security logs and checking destinations against Google Safe Browsing. Our legal ground is legitimate interests.
• To understand and improve the service, using aggregated, non-identifying usage figures. Our legal ground is legitimate interests.
• To send emails: service emails about your account and security, and reports or alerts you turn on. You can turn optional emails off in Settings.
• To meet legal duties, such as keeping tax records and responding to lawful requests.

• To measure our own advertising, using Google Ads cookies on our website only if you accept them (see Cookies below). Our legal ground for the cookies is your consent, and for the basic cookieless signals sent when you haven’t accepted, our legitimate interest in knowing whether our ads work.

We never use the content of your account, your scan analytics or anyone who scans your codes for advertising. We don’t sell personal data, and we don’t make decisions about you based solely on automated processing.

We use cookies that are strictly necessary to keep you signed in, to protect your session and to remember your cookie choice. These are always on.

On our own website and dashboard we also ask whether we may use Google Ads cookies. If you accept, Google sets cookies that tell us when someone who clicked one of our ads signs up or upgrades, so we know which ads work, and that let us show our ads to people who have visited. Google receives details of your visit and of those two events (never the content of your account), under Google’s privacy policy. Until you accept, Google’s tag runs in a restricted mode: it sets and reads no cookies, and only sends Google basic, cookieless signals (such as that a page was viewed or a sign-up happened, with ad click identifiers removed) that Google uses to estimate how our ads perform overall. If you reject, or change your mind later with “Cookie settings” at the bottom of our website, it returns to that mode and we remove its cookies. Our legal ground for the cookies is your consent.

QR redirects and our customers’ public landing pages never show this banner or load Google’s tag, whatever you chose.

We use a small number of trusted providers to run QRArchive. Each is bound by a contract to protect the data and use it only to provide its service to us.

We also share data:

• with the members of your workspace, according to the roles the owner sets;
• when the law requires it, or to protect people from harm. We push back on requests that are too broad;
• with a buyer or successor if our business is merged or sold. We will tell you first, and this policy will continue to protect your data.

Our providers may process data outside your country, including in the United States. When data leaves the UK or the European Economic Area, we rely on adequacy decisions or the European Commission’s Standard Contractual Clauses (with the UK addendum), plus extra safeguards where needed.

• All connections are encrypted with HTTPS, and data is encrypted at rest by our database provider.
• Database-level access rules mean each workspace can only ever read its own data.
• Passwords and API keys are stored only as secure hashes, and webhooks are signed so you can verify they came from us.
• Access to production systems is limited to the people who need it, and important actions are recorded in audit logs.
• If a breach affects your personal data, we will tell you and the relevant authorities as the law requires.

Depending on where you live, you can ask us to:

• give you a copy of your personal data, or send it to another service in a portable format;
• correct data that is wrong, or delete data we no longer need;
• stop or limit how we use your data, or withdraw consent you have given;
• explain how we handle your data.

Account holders can update details, export analytics and delete their account in the dashboard at any time. For anything else, email support@spendjot.app. We will reply within one month, and we may need to confirm your identity first.

If you scanned a code or sent an enquiry, the business that owns it controls that data, so contact it first. We will help it respond, and you can always write to us too.

You also have the right to complain to your local data protection authority. We would appreciate the chance to sort things out first. California residents: we don’t sell or share personal information as those terms are defined in the CCPA, and we won’t treat you differently for exercising your rights.

QRArchive accounts are not for children under 16. If you believe a child has created an account, contact us and we will delete it.

We will update this page when our practices change, and change the date at the top. If a change is significant, we will email account holders or show a notice in the dashboard before it takes effect.

Privacy questions or requests: support@spendjot.app. Post: Spendjot Ltd, 86-90 Paul Street EC2A 4NE, London, England. For everything else, see our terms or email support@spendjot.app.