Privacy Policy
Last updated: November 2026
1. Who We Are
Guru QR is operated by Chris Murphy ("we", "us"). Our service is available at qrguru.site. For privacy enquiries, contact support@qrguru.site.
2. Data We Collect
| Category | Data | Purpose | Retained |
|---|---|---|---|
| Account | Name, email address, password (hashed), Google ID (if OAuth) | Authentication, communication | Until account deleted |
| QR codes | Destination URLs, code type, design settings | Generating and redirecting codes | Until code deleted |
| Scan analytics | Timestamp, derived location (country/city), device type | Analytics dashboard | Until code deleted |
| Payment | Subscription status, Stripe customer ID (no card data stored by us) | Billing | Legal minimum (7 years) |
| Logs | Server access logs (IP + timestamp) | Security, debugging | 30 days |
3. How Scan Tracking Works
When someone scans one of your QR codes:
- We receive their IP address as part of the HTTP request.
- We use the IP address to derive a geographic location (country, region, city) using a local geo-IP database.
- We do not store the raw IP address in the scan record — only the derived location.
- We record the device type (mobile/desktop/tablet) and operating system from the User-Agent header.
- We do not use cookies, fingerprinting, or cross-site tracking on the redirect path.
4. Legal Basis (GDPR)
We process personal data on the following bases:
- Contract performance: Account data, QR code data, scan counts — necessary to provide the service.
- Legitimate interests: Aggregated scan analytics (location, device) — to provide analytics features to code owners. Scanners are not individually identifiable from this data.
- Legal obligation: Payment records retained for legal/tax purposes.
5. Data Sharing
We share data only with:
- Stripe — payment processing. Stripe's privacy policy applies to payment data.
- Google Safe Browsing API — destination URLs are checked against Google's threat database. Google's privacy policy applies.
- Hosting provider (Vultr) — infrastructure only; no data access for other purposes.
We do not sell, rent, or share your data with any other third parties.
6. Your Rights
Under GDPR and UK data protection law, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Delete your account and associated data
- Object to or restrict processing
- Data portability (export your QR code data)
To exercise any of these rights, email support@qrguru.site. We will respond within 30 days.
7. Cookies
We use strictly necessary session cookies for authentication only. No advertising, analytics, or tracking cookies are used. The QR code redirect path sets no cookies whatsoever.
8. Data Retention
Account data and QR codes are retained for as long as your account exists. You can delete your account at any time from your profile settings, which permanently removes all associated QR codes and scan data. Payment records are retained for 7 years as required by law.
9. Security
All data is transmitted over HTTPS. Passwords are hashed using bcrypt. Payment data is handled entirely by Stripe and never touches our servers.
10. Changes to This Policy
We will notify you by email at least 14 days before any material change to this policy takes effect.
11. Contact and Complaints
For privacy questions, email support@qrguru.site. If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.