xQR Platform Privacy Policy

Last Updated: July 15, 2025

1. Introduction

This Privacy Policy describes how xQR Platform (“xQR,” “we,” “our,” or “us”), operated by [Company Name], collects, uses, and protects your personal information when you use our advanced QR code and short‑link management platform (the “Service”). We are committed to safeguarding your privacy and being transparent about our data practices.

1.1 Data Controller Information

• Company: [Company Name]
• Contact: legal@xqr.co

1.2 Scope of This Policy

• The xQR web application (platform.xqr.co)
• Our short‑link service (xqr.co)
• Mobile applications and API integrations
• Analytics data collection through QR scans
• All associated services and features

2. Information We Collect

2.1 Personal Information

We collect personal information that you provide directly to us, including:

• Name and email address (via secure authentication)
• Profile information (name, profile picture)
• Unique user identifier
• Workspace and project associations
• Subscription plan and billing details
• Company name, industry, and use case (collected during onboarding)
• Team‑member information (for workspace invitations)

• Company size and type
• Industry vertical
• Primary use cases for QR codes
• Marketing‑campaign details
• Brand assets and logos

• Support‑ticket communications
• Feature‑request submissions
• Bug reports and technical feedback
• Sales inquiries and demo requests

2.2 Usage Data

We automatically collect information about how you use our Service:

• QR codes created (design parameters, error‑correction levels)
• Short links generated (xqr.co/[code])
• Link‑in‑Bio pages and customizations
• Routing rules and conditional logic configured
• API calls and integration usage
• Asset uploads and gallery management
• Workspace and project switching patterns
• Feature adoption and usage frequency

• Scan timestamp with microsecond precision
• Geographic location (IP geolocation: country, region, city)
• Device intelligence (mobile/tablet/desktop detection)
• Browser and OS identification
• Network‑latency metrics
• UTM parameters and campaign tracking
• Bot detection and filtering
• Referrer and traffic‑source analysis
• IP address (hashed SHA‑256)

2.3 Technical Information

We collect technical data to provide and improve our Service:

• User‑Agent string analysis
• Browser capabilities and version
• Screen resolution and viewport size
• WebGL and Canvas fingerprinting (fraud prevention)
• Language and locale preferences
• Time zone and local‑time offset
• Cookie support and JavaScript status

• API request logs and response times
• Redirect‑service performance metrics (<100 ms)
• CDN edge‑location and cache hits
• Event‑processing latency
• Database‑transaction logs
• Query‑performance metrics
• Error stack traces (sanitized)
• Security event logs (login attempts, API‑key usage)

2.4 Content Data

We store content you create using our Service:

• QR code payload (up to 2,953 bytes)
• Custom designs (colors, logos, corner‑radius)
• Error‑correction level (L/M/Q/H)
• Template configurations and presets
• Version and mask‑pattern settings
• Associated metadata and labels

• Target URLs and redirect destinations
• A/B testing and traffic‑split configurations
• Advanced routing rules (geographic, device, time‑based)
• Link‑expiration settings
• Custom slugs and vanity URLs
• QR‑to‑link associations

• Uploaded images (up to 25 MB per file)
• Logos and brand assets (private bucket)
• Published assets (CDN delivery)
• Asset metadata (dimensions, format, size)
• Gallery organization and tags

• Page layouts and themes
• Social‑media links and icons
• Custom HTML/CSS modifications
• Embedded content and widgets
• Analytics tracking codes

3. How We Use Your Information

3.1 Service Provision

• Provide and maintain the Service
• Process account registration and authentication
• Generate QR codes and short links
• Deliver analytics and reporting features
• Process payments and billing
• Provide customer support

3.2 Service Improvement

• Analyze usage patterns and trends
• Improve functionality and performance
• Develop new features and capabilities
• Conduct research and development
• Optimize user experience

3.3 Communications

We may use your contact information for:

• Account verification and security alerts
• Subscription confirmations and invoices
• API rate‑limit warnings
• System‑maintenance notifications
• Critical security updates

• New‑feature announcements
• Platform updates and improvements
• Best practices and tips
• Webinar and training invitations
• Industry insights and case studies

• Product newsletters
• Promotional offers and discounts
• Partner‑integration announcements
• Success stories and testimonials
• Event invitations

• QR‑scan threshold alerts
• Link‑expiration reminders
• Monthly usage reports
• Performance‑optimization suggestions

3.4 Security and Compliance

• Detecting and preventing fraud and abuse
• Ensuring platform security and integrity
• Complying with legal obligations
• Enforcing our Terms of Service
• Protecting our rights and interests

4. Information Sharing and Disclosure

4.1 Third‑Party Service Providers

We share information with carefully selected service providers for:

• Cloud hosting and infrastructure
• Content delivery and object storage
• Security, monitoring, and analytics
• User authentication and payment processing
• Email, SMS, and support communications

All providers sign Data‑Processing Agreements (DPAs) that include encryption, limited access, regular security audits, and breach‑notification requirements.

4.2 Business Transfers

If we are involved in a merger, acquisition, or asset sale, we will ensure your information remains protected under this Privacy Policy.

4.3 Legal Requirements

• Comply with legal processes or government requests
• Protect our rights, property, or safety
• Protect the rights or safety of users
• Prevent or investigate illegal activities
• Respond to emergencies

4.4 Consent‑Based Sharing

We may share information with your explicit consent for purposes not covered here.

5. Data Retention

5.1 Account Data

We retain your account information and content while your account is active or as required to provide the Service.

5.2 Analytics Data

Analytics‑retention periods depend on your subscription tier:

• QR‑scan events: 7 days
• Aggregated metrics: 30 days

• QR‑scan events: 3 months
• Aggregated metrics: 6 months

• QR‑scan events: 12 months
• Aggregated metrics: 24 months

• QR‑scan events: 24 months (customizable)
• Aggregated metrics: Unlimited

5.3 Deleted Data

• Content you delete is generally removed within 30 days.
• Some data may remain for legitimate business purposes.
• Back‑up copies may persist for a limited time.
• Legal requirements may extend retention periods.

5.4 Data Minimization

We regularly review and delete data that is no longer necessary.

6. Your Rights and Choices

6.1 Account Management

• Access and update account information
• Modify profile and preferences
• Download data via export features
• Delete content you have created

6.2 Communication Preferences

• Unsubscribe from marketing emails
• Adjust notification settings
• Opt out of certain communications
• Contact us to update preferences

6.3 Data‑Subject Rights (GDPR / CCPA)

Depending on your location, you may have additional rights to access, correct, delete, or restrict processing of your personal data.

6.4 Exercising Your Rights

To exercise any of these rights, email us at legal@xqr.co. We will respond within 30 days.

7. Data Security

7.1 Security Measures

• TLS 1.3 for all communications
• AES‑256 encryption for data at rest
• JWT tokens with 24‑hour expiration
• Role‑based access control (RBAC)
• Web Application Firewall (WAF) and DDoS protection
• Regular penetration testing and vulnerability scanning
• Audit logs for all data access

7.2 Infrastructure Security

• SOC 2 Type II certified data centers
• Network firewalls and intrusion detection
• Automated backup and recovery systems
• Geographic data replication

7.3 Data Breaches

• Immediate investigation of incidents
• Prompt notification to affected users
• Regulatory authorities informed when required
• Corrective measures to prevent recurrence

8. International Data Transfers

8.1 Global Service

Our Service operates globally and may involve cross‑border data transfers.

8.2 Transfer Safeguards

• Standard Contractual Clauses (SCCs)
• Adequacy decisions by regulators
• Binding Corporate Rules where applicable
• User consent for specific transfers

8.3 Data Localization

Some data may be stored in specific regions based on user preferences or regulatory requirements.

9. Children’s Privacy

9.1 Age Restrictions

The Service is not intended for children under 13. We do not knowingly collect data from children under 13.

9.2 Parental Notice

• Information collected from children will be deleted promptly.
• Parents or guardians will be notified if we become aware of such collection.

9.3 Teen Users (13‑17)

We recommend parental involvement for users aged 13‑17.

10. Cookies and Tracking Technologies

10.1 Types of Cookies

• xqr-session: Secure session management
• xqr-auth: Authentication token
• xqr-workspace: Current workspace context
• xqr-csrf: CSRF protection

• _analytics: Visitor tracking
• xqr-analytics-id: Internal correlation

• xqr-theme: UI theme preference
• xqr-lang: Language preference

• Payment processor (payment processing)
• Authentication provider (sign‑in)
• CDN (content optimization)
• Support platform (customer chat)

10.2 Cookie Management

• Browser settings and extensions
• Our cookie‑preference center
• Third‑party opt‑out tools

10.3 Do Not Track

We honor Do Not Track signals where technically feasible.

11. Third‑Party Integrations

11.1 External Services

• Social‑media networks
• Cloud‑storage providers
• Marketing and analytics tools
• Payment processors

11.2 Third‑Party Privacy

These integrations are governed by the privacy policies of the respective third parties.

11.3 API and Webhooks

Using our API or webhooks may involve additional data sharing based on your configuration.

12. Marketing and Communications

12.1 Marketing Communications

With your opt‑in consent, we may send newsletters, product updates, and promotional offers.

12.2 Personalization

Communications may be personalized based on your usage patterns and preferences.

12.3 Opt‑Out Options

You can opt out at any time via unsubscribe links or account settings.

13. Updates to This Policy

13.1 Policy Changes

We may update this Privacy Policy to reflect changes in practices, services, or legal requirements.

13.2 Notice of Changes

We will notify you of material changes via email, in‑app notifications, or prominent website notices.

13.3 Acceptance of Changes

Continued use of the Service after an update constitutes acceptance of the revised policy.

14. Regional Privacy Information

14.1 European Union (GDPR)

EU residents have additional rights and protections under the General Data Protection Regulation.

14.3 Other Jurisdictions

We comply with applicable privacy laws in all regions where we operate.

15. Contact Information

For any privacy‑related questions or concerns, please email us at legal@xqr.co.

This Privacy Policy is effective as of July 15, 2025 and supersedes all prior versions.