Privacy notice

QR Studio Pro ("QR Studio Pro", "we", "us") operates this website and the QR code generation service available on it. QR Studio Pro is the data controller for the personal data described in this notice, which means we decide why and how that data is processed. You can reach us at support@qrstudio.pro.

• Account data — your email address, account identifier, plan status (free or unlimited) and role. Passwords are handled by our authentication provider and are never stored by this application.
• Generation data — the destination a QR code encodes, the source type (website link, image link or upload), the chosen dimensions, the styling options, and the time of generation.
• Uploaded images — files you upload so a QR code can point at them, stored under a folder tied to your account.
• Export data — whether a PNG or a PDF was downloaded, and when.
• Technical data — IP address and basic request metadata processed by our hosting provider for security and abuse prevention.
• Purchase data — the fact that an upgrade was purchased, its amount, currency and status. Card details and billing addresses are collected and held by Paddle, not by us.

• To provide the service — creating your account, generating and storing QR codes, hosting uploaded images, applying free and unlimited plan limits. Legal basis: performance of our contract with you.
• To take and record payment — fulfilling your order for the unlimited upgrade and activating it on your account. Legal basis: performance of a contract, and compliance with tax and accounting obligations.
• To keep the service secure and working — preventing abuse, fraud, and misuse of uploads, and understanding aggregate usage. Legal basis: our legitimate interests in running a safe, reliable service.
• To answer support requests. Legal basis: performance of a contract and our legitimate interest in supporting customers.

A static QR code contains your destination directly, so scans never reach our servers. We do not, and cannot, report scan counts or profile the people who scan your codes. Every dashboard figure refers to codes generated and files downloaded.

• Paddle.com Market Ltd — our online reseller and Merchant of Record. Paddle handles checkout, payment processing, invoicing, sales tax compliance, subscription and order management, and refunds. When you buy the unlimited upgrade, Paddle collects your payment and billing details directly and sends us confirmation that the purchase completed.
• Hosting, database, storage and authentication providers — acting as processors on our instructions to run the website, store your account, and hold uploaded images.
• Professional advisers such as accountants or legal advisers, where necessary.
• Authorities, where we are legally required to disclose data.

We do not sell personal data or share it with advertisers. Some providers are located outside the UK/EEA; where that is the case, transfers are covered by an adequacy decision or Standard Contractual Clauses.

Because a QR code points at the address of your uploaded image, anyone holding that code or link can view the image. Do not upload private or sensitive pictures. You, or an administrator, can delete a stored image, which permanently breaks any QR code pointing at it.

• Account data: for as long as your account exists, then deleted within 30 days of closure.
• Generation and export records: up to 24 months, after which they are deleted or aggregated into anonymous statistics.
• Uploaded images: until you or an administrator delete them, or 24 months after your account is closed, whichever comes first.
• Purchase records: retained by us and by Paddle for as long as tax and accounting law requires, typically 7 years.

Subject to applicable law, you have the right to access the personal data we hold about you, to have it corrected, to have it erased, to restrict or object to processing, to receive a portable copy in a machine-readable format, and to withdraw consent where processing is based on consent. You may also lodge a complaint with your local data protection supervisory authority.

To exercise any of these rights, email support@qrstudio.pro. We respond within one month.

We apply appropriate technical and organisational measures, including encryption in transit, row-level access rules on our database so accounts can only reach their own records, scoped storage permissions on uploads, and restricted administrator access.

We use strictly necessary cookies and local storage to keep you signed in and to run the checkout. We do not use advertising or cross-site tracking cookies. You can clear or block cookies in your browser, though signing in will not work without them.

We will update this notice when our practices change and revise the date above. For anything privacy related, contact support@qrstudio.pro.