Privacy policy

This policy covers qrcode.business, the QrB app and the pages and QR codes you publish with it. Z7 Studio is responsible for the data described here. We follow the laws that apply to us, including those of Bangladesh, where Z7 Studio is based.

When you have an account we store:

• your email address, name and profile picture from your Google account
• your pages, sites, settings and version history
• files you upload, such as photos, logos and PDFs
• your plan, payment status and payment references from our payment gateway; we never see your card number or wallet PIN
• a one-way fingerprint of your email address when you use a free code, so each code works once per person
• basic analytics about visits to your pages, described below

We do not ask for your national ID number, date of birth or home address.

When someone opens a published page or scans a QR code, we count the visit so the owner can see scans, views and clicks. We record the time, the page, the referring site, the rough type of device and the rough city.

The visitor’s IP address is turned into a one-way hash. We do not store the raw address, and we do not build profiles of individual visitors.

Published pages and QR redirects set no cookies and run no tracking scripts.

On our own site and app we use only what you need: a cookie that keeps you signed in, a cookie that remembers your language, and a theme setting kept in your browser’s local storage. We use no advertising cookies.

We use data to run and secure the service, to show owners their analytics, to process payments, to answer support requests and to send service emails such as sign-in links, receipts and renewal reminders. We do not sell your data and we do not use it for advertising.

We share data only with providers that help us run QrB, under terms that limit what they can do with it: Netlify (hosting), Turso (database and file storage), Google (sign-in), PortPOS (payments) and, when email is switched on, Resend (email delivery). Some of them process data in other countries.

We may disclose data when a valid legal order from a Bangladeshi authority, or another authority with jurisdiction, requires it, or to protect people from fraud or harm. Pages you publish are public by design.

We keep account data while your account is open. When you close it, we delete your pages and uploads within 30 days and remove them from backups within 90 days. Payment records are kept for as long as Bangladeshi tax and accounting rules require. Visit analytics are kept in detail for 12 months, then only as totals.

Traffic uses HTTPS. You sign in with Google, so QrB never stores a password for you. Access to production data is limited to the people who need it.

No system is perfectly secure. If a breach affects you, we will tell you promptly.

You can see, correct, export or delete the data we hold about you. Most of it is in your dashboard. For the rest, write to hello@qrcode.business and we will reply within 30 days.

If you visited someone’s page and want something removed, contact the page owner or us.

QrB accounts are for people aged 18 or over, or with a parent or guardian’s consent. We do not knowingly collect personal data from children. If you believe we have, write to us and we will delete it.

We will update this page when our practices change and announce material changes by email or in the app before they apply. The date at the top shows the latest version.

Privacy questions and requests: hello@qrcode.business.