Privacy Policy

1. Introduction

QR Code Pro ("we," "our," or "us") is operated by Allsorts Web Designers, a company registered in South Africa. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our QR code generation and analytics platform (the "Service").

We are committed to protecting your privacy and complying with applicable data protection laws, including the Protection of Personal Information Act (POPIA) of South Africa and the General Data Protection Regulation (GDPR) for users in the European Economic Area.

Responsible party and Information Officer. Allsorts Web Designers is the responsible party for the personal information of QR Code Pro account holders. The Information Officer is the owner of Allsorts Web Designers, reachable at admin@allsortswebdesigners.co.za. For the people who scan a QR code made by a customer, the customer decides where the code points and what they do with the result, and we process the scan on the customer's behalf as an operator. Our PAIA manual is at /paia-manual.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Name and email address
• Password (stored in encrypted form)
• Company name (optional)
• Billing information for paid subscriptions

2.2 QR Code Content

We store data related to your QR codes:

• URLs and destination links
• QR code names and metadata
• Design configurations and custom styling
• vCard, WiFi, and other QR content types

2.3 Analytics Data

When someone scans your QR code, we collect:

• Timestamp of the scan
• Approximate geographic location (city/country level)
• Device type and operating system
• Browser information
• Referrer information (where applicable)
• The scanner's IP address, used to detect abuse and count repeat scans. It is stored with the scan record and removed after 24 months (see section 7). It is not shown to the QR code owner.

2.4 Technical Data

We automatically collect:

• IP addresses of people who sign in or use our website, kept in our security logs
• Browser type and version
• Operating system
• Pages visited and actions taken on our platform
• Cookies and similar tracking technologies

3. How We Use Your Information

We use the information we collect to:

• Provide our Service: Create and manage QR codes, process redirects, and display analytics
• Process payments: Handle subscriptions and billing through our payment processors
• Communicate with you: Send service updates, security alerts, and support messages
• Improve our Service: Analyze usage patterns to enhance features and user experience
• Ensure security: Detect and prevent fraud, abuse, and security threats
• Comply with legal obligations: Meet regulatory and legal requirements

4. Legal Basis for Processing (GDPR)

For users in the EEA, we process personal data based on:

• Contract performance: Processing necessary to provide our Service
• Legitimate interests: Improving our Service, security, and fraud prevention
• Consent: Where you have given explicit consent (e.g., marketing communications)
• Legal obligation: Compliance with applicable laws

5. Data Sharing and Disclosure

We may share your information with:

5.1 Service Providers

Third parties that process personal information for us as operators, under their own data-processing terms:

• Webway (Johannesburg, South Africa): hosts the application and database
• PayFast (South Africa): card and subscription payments. We never see or store your card number
• Cloudflare: content delivery and network security for all traffic to the Service
• Resend: sends our emails (sign-up, receipts, security and billing notices)
• Google: Web Risk checks the destination links of QR codes for malware and phishing; Analytics measures website usage; Sign-In, if you choose it

5.2 Legal Requirements

We may disclose information when required by law, court order, or government request, or when necessary to protect our rights, property, or safety.

5.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you of any such change.

6. Data Security

We implement industry-standard security measures to protect your data:

• Encryption in transit (TLS/SSL)
• Secure password hashing using bcrypt
• Security reviews of the code before releases
• Access controls and authentication mechanisms
• Secure data centers with physical access controls

However, no method of transmission or storage is 100% secure. We cannot guarantee absolute security but strive to protect your data using commercially acceptable means.

7. Data Retention

We retain your data as follows:

• Account data: Retained while your account is active and deleted immediately when you delete your account
• QR code data: Retained while associated with an active account; deleted with your account
• Scan analytics: The IP address on each scan record is removed after 24 months; the rest of the scan record is deleted with your account
• Billing records: Retained for 7 years as required by law, including after your account is deleted

You can delete your account at any time from the QR Code Pro Android app (Account → Delete account) or on the web at qrcodegen.allsortswebdesigners.co.za/delete-account. Deleting your account stops any PayFast subscription and permanently removes your QR codes, scan analytics, designs and account details. Codes you have already printed stop working.

7A. The QR Code Pro Android App

The Android app uses the same account and servers as the website, so everything above applies to it. In addition:

• Camera: used only to scan QR codes, and only while the scanner is open. Scanning happens on your device; camera images are never uploaded or stored.
• Photos you choose: when you scan a code from a picture or add a logo, you pick the image with Android's photo picker. A picture you scan stays on your device; a logo you add is saved with that QR code's design on our servers.
• Scan history: codes you scan with the app are kept only on your device, and you can clear them in the app.
• Sign-in: your session is stored in your device's encrypted storage. If you sign in with Google, we receive your name and email address from Google.
• No ads or tracking: the app contains no advertising and no third-party analytics or tracking SDKs.

8. Your Rights

Under POPIA and GDPR, you have the following rights:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data ("right to be forgotten")
• Portability: Receive your data in a machine-readable format
• Restriction: Limit how we process your data
• Objection: Object to processing based on legitimate interests
• Withdraw consent: Withdraw previously given consent at any time

To exercise these rights, contact us at admin@allsortswebdesigners.co.za

9. Cookies and Tracking

We use cookies and similar technologies for:

• Essential cookies: Required for the Service to function (authentication, security)
• Analytics cookies: Help us understand how you use our Service
• Preference cookies: Remember your settings and preferences

You can manage cookie preferences through your browser settings. Disabling essential cookies may affect Service functionality.

10. International Data Transfers

Our application and database are hosted in Johannesburg, South Africa. Some of the providers in section 5.1 process limited data outside South Africa: Cloudflare (all traffic passes through its network), Resend (the recipient address and email content), and Google (QR code destination links for Web Risk checks, website usage data for Analytics, and Google Sign-In details). We rely on these providers' data-processing terms and on POPIA section 72, which allows transfers where the recipient is bound by rules or an agreement that protect the information to a similar standard.

10A. If something goes wrong

If personal information is accessed or acquired by someone who should not have it, we will tell the Information Regulator and the people affected as soon as reasonably possible, as POPIA section 22 requires, and say what happened and what to do about it.

11. Children's Privacy

Our Service is not intended for children under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected data from a child, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by email or prominent notice on our platform. Your continued use of the Service after changes constitutes acceptance of the updated policy.

13. Contact Us

For privacy-related inquiries or to exercise your rights:

For South African users: You have the right to lodge a complaint with the Information Regulator if you believe your privacy rights have been violated. Complaints are lodged on the Regulator's eServices portal (enquiries@inforegulator.org.za, 010 023 5200).