Privacy Policy

1. Who we are

qrmucho ("we", "us") provides QR codes, lead capture pages, and digital business cards for businesses. This policy explains what personal data we collect, why we collect it, and what rights you have over it.

For anything privacy-related, contact us at hello@qrmucho.com.

2. Data we collect

What we collect depends on how you interact with qrmucho:

• Account data. When you create an account, we collect your email address and a password (stored in hashed form), or your name and email address if you sign in with Google.
• Content you create. QR codes, destination links, digital business card details (such as your name, job title, company, contact details, and photos), and the lead capture forms you configure.
• Billing data. Payments are processed by Stripe. We never see or store your full card number. We keep records of your subscription status and billing history.
• Scan and visit analytics. When someone scans a dynamic QR code or visits a lead capture page, we record the IP address, browser and device type, referring page, approximate location (country, derived from the IP address), and the time of the visit. We use this to show scan statistics to the QR code owner.
• Lead submissions. Information visitors voluntarily submit through a lead capture form, such as their name, contact details, and answers to the form's questions.
• Website usage. We use Simple Analytics to understand how visitors use our website. Simple Analytics is cookieless: it does not set cookies, does not track you across sites, and does not collect personal data. It only reports aggregate numbers such as pages visited and how visitors arrived at the site.
• Meta pixel (only if you accept). If you reach our website from Facebook or Instagram, for example through one of our ads, we ask whether you accept Meta's cookies. If you do, we load Meta's pixel on our website and signup pages. It tells Meta that you visited a page, started building a page, or created an account, so we can measure our ads and Meta can show them to people likely to be interested. It never runs on the pages our customers share with their own visitors, or inside the app. If you decline, it doesn't load at all.
• Marketing campaign data. If you create an account after clicking a link from one of our ads or campaigns, we store which campaign it was (source, medium, campaign name, ad, and landing page) on your account, so we know which campaigns bring in customers.

3. If you scanned a QR code or submitted a form

When you submit your details through a lead capture page or digital business card, that information is collected on behalf of the business that created it. That business decides what to do with your data and is the data controller; we store and process it on their behalf.

If you want your submitted data accessed, corrected, or deleted, contact the business you shared it with. If you can't reach them, contact us at hello@qrmucho.com and we will help.

4. How we use your data

• To provide the service: generating QR codes, hosting lead capture pages, storing leads, and showing analytics.
• To process payments and manage subscriptions.
• To send transactional emails about your account, such as sign-in links and billing notices.
• To keep the service secure, prevent abuse, and debug problems.
• To understand how the product is used so we can improve it.
• To understand which marketing campaigns bring in accounts.
• To measure our ads on Meta, if you accept cookies.

We do not sell your personal data.

5. Legal bases

Where the GDPR applies, we rely on the following legal bases:

• Contract — to provide the service you signed up for.
• Legitimate interests — for scan analytics, security, product improvement, and knowing which marketing campaigns bring in accounts.
• Legal obligation — for keeping billing and tax records.
• Consent — for the Meta pixel. You can withdraw it at any time in section 7 below.

6. Third-party services

We use a small number of service providers to run qrmucho. They process data only as needed to provide their service to us.

Meta Platforms Ireland Limited, for ad measurement, only if you accept cookies. Meta may transfer this data to the United States, where Meta Platforms, Inc. is certified under the EU–US Data Privacy Framework.

7. Cookies

Essential cookies keep you signed in. Our website analytics (Simple Analytics) set no cookies at all. Meta's cookies (_fbp, and _fbc when you arrive from a Meta ad) are set only after you accept, and last up to 90 days. Your choice is remembered in your browser for six months.

Change your cookie choice

8. Data retention

We keep your account data, content, leads, and analytics for as long as your account is active. If you delete your account or a QR code, the associated data is deleted. We may retain billing records for as long as tax and accounting laws require.

9. Your rights

Depending on where you live, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your data.
• Receive a copy of your data in a portable format.
• Object to or restrict certain processing.
• Withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, email hello@qrmucho.com. If you are in the EU/EEA, you also have the right to lodge a complaint with your local data protection authority.

10. Security

We protect your data with industry-standard measures, including encryption in transit and access controls that restrict data to its owner. No online service can guarantee absolute security, but we work to keep your data safe and will notify you of any breach as required by law.

11. Children

qrmucho is a business tool and is not directed at children under 16. We do not knowingly collect personal data from children.

12. Changes to this policy

We may update this policy as the service evolves. We will post any changes on this page and update the date at the top. For significant changes, we will notify you by email.