Privacy Policy

Last updated 26 October 2026. This policy explains how PixQR handles personal data for customers, site visitors, administrators, API users and people who scan QR codes.

1. Who controls your data

PixQR is owned and operated by ZypherLock LLC. ICO registration ZB973673. For privacy matters, use the Privacy Request page or the Contact page.

2. Data we collect

• Account data: name, email, password hash, workspace membership, role, plan and account status.
• QR data: QR names, destinations, static or dynamic mode, slugs, saved design JSON, logos/background data embedded in saved designs, safety scores and edit history.
• Batch data: uploaded row values after validation, generated QR records, batch manifests, source filename and batch run history.
• Scan analytics: QR id, workspace id, time of scan, country if supplied by infrastructure, and technical metadata needed for security and abuse prevention.
• Billing data: plan, payment provider references, subscription state and payment method notes. Full card details should be handled only by Stripe, PayPal or another configured payment provider.
• Support and privacy requests: name, email, subject, message, request type, hashed IP address, user agent and request status.
• Security data: audit logs, admin actions, failed or suspicious actions, destination changes and abuse reports.

3. Why we use data

• Provide accounts, workspaces, QR generation, redirects, downloads, batch processing and dashboards.
• Secure the service, prevent fraud, investigate abuse and keep audit logs for sensitive actions.
• Process billing, plan changes, customer support and service notices.
• Measure QR usage and provide analytics where the plan and privacy settings allow this.
• Comply with legal duties, enforce terms and respond to lawful requests.

4. Lawful bases

Depending on the situation, we rely on contract performance, legitimate interests, legal obligation and consent. Consent is used where required for optional marketing, optional analytics cookies or similar technologies. You can withdraw consent where processing is based on consent.

5. QR scanner privacy

People scanning a PixQR dynamic QR may be redirected through PixQR so we can resolve the destination and record basic analytics or security events. Dynamic redirects must not use arbitrary query parameters as final destinations. Customers are responsible for ensuring their QR campaigns provide any extra notices required by their own use case.

6. Sharing and processors

We may use hosting, database, email, security, analytics, payment and customer support providers. We only share data needed for the relevant service. Payment card information should be processed by the payment provider, not by PixQR support forms or ordinary database fields.

7. International transfers

ZypherLock LLC and service providers may operate in more than one country. Where international transfer safeguards are required, we aim to use appropriate mechanisms such as adequacy decisions, standard contractual clauses, data processing agreements or equivalent safeguards.

8. Retention

• Account and workspace records are retained while the account is active and for a reasonable period afterward for security, billing and legal reasons.
• QR records may be retained after deletion as soft-deleted records to preserve audit integrity and prevent abuse.
• Audit/security logs are retained as needed for fraud prevention, service integrity and legal defence.
• Support and privacy requests are retained only as long as needed to handle and evidence the request.

9. Your rights

Depending on your location, you may have rights to access, correct, delete, restrict, object to processing, receive a portable copy of data, withdraw consent, opt out of certain uses, or complain to a supervisory authority. Use Privacy Request to exercise these rights.

10. Security

We use server-side validation, hashed passwords, workspace isolation, role checks, audit logs, soft deletion for sensitive records, hashed tokens, environment-based secrets and security-conscious admin controls. No internet service can be guaranteed completely secure, so customers must keep credentials safe and report suspected compromise quickly.

11. Children

PixQR is intended for business and professional use. It is not directed to children. Customers must not knowingly upload children’s personal data unless they have a lawful basis and appropriate notices.

12. Changes

We may update this policy as the service, law or providers change. Material changes should be reflected by updating this page and, where appropriate, notifying customers.