Privacy notice

1. Who is responsible for your data

Hugh Halford-Thompson, trading as QRVane, decides how the personal data described here is used. For anything about your data, email privacy@qrvane.com.

2. What we collect, and why

Your account

Your email address, and your name if you give one, with the workspace you own. We need these to run your account, and the address is how a code is owned: whoever can read that inbox can change the codes made with it. A workspace holds one person, so we hold no invitations and no member list.

There is no password. The email we send you to sign in carries a link and a 4-digit code. The link works once and expires after 15 minutes, the code after 10; we store each only in a form that cannot be turned back into the link or the code.

Passkeys

If you add a passkey, we keep its public key, a label for the device it was made on (such as “Chrome on Windows”) and when it was added. The private key never leaves your device or password manager, so we never hold anything that could sign in as you.

Sign-in sessions

Each time you sign in, we keep a session record with the IP address and the browser details (the “user agent”) it came from. That lets you see where you are signed in and sign out a device you do not recognise. A session record is deleted when you sign out; one that ends without signing out is deleted 30 days after it expires.

Deleting your account

When you ask us to delete your account, it is locked at once and signed out everywhere, and we email you a link that restores it. We store that link only as a one-way hash. It works until the account is deleted, 30 days after you asked.

Keeping sign-in safe

To stop anyone flooding an inbox with sign-in links or guessing at accounts, we count requests. When anyone asks for a sign-in link, whether or not they have an account, we keep a count against their IP address, and against a one-way hash of the email address they typed. Counts are deleted about 48 hours after the last request they count.

Your codes and pages

Where each code points, the hosted pages you write and the files you upload, such as a logo or a menu. We keep them to provide the service, until you delete them or your account. When a workspace’s codes stop, we keep all of this, so that a plan with room for them brings every code back, and so that you can export your scan data at any time.

Each code’s 14 days, and your subscription

When each code was made and the moment its first 14 days end; and, if you subscribe, which plan, when it started, when it renews and when it ended. We need these to decide, on every scan, whether a code shows your destination or the QRVane page, and to send the notices about your subscription that the terms describe.

Scans of your dynamic codes

When someone scans a dynamic code, we record the time, the approximate place (country, region and city, which our host works out from the connection) and the kind of device, operating system and browser. No cookie is set, and the scan record holds no IP address. The IP address is used for a moment, together with the browser details and a random value that is replaced every day, to make a one-way code that lets us count unique scans for that day; the IP address itself is not stored. Each day’s random value is deleted when it is replaced, so a scan’s code can never afterwards be matched to an IP address. Unique scans are counted per day: the same phone scanning on two different days counts once on each day. Over a range they are added up, so someone who scanned on Monday and again on Friday counts twice. Scan records are deleted after 24 months.

Cloudflare, which forwards each scan, may keep its own request logs, which include the IP address, under its own privacy policy and for its own security purposes. We do not turn on log retention of our own for those requests, and we do not copy them anywhere else.

Screening links

When a code is made or its destination is changed, we check the link against our own rules, inside QRVane: no outside screening service receives it, and none is switched on. If we ever switch one on, we will name it here and in the list of processors below before we do. A link that fails the check can stop the code before anyone scans it; its owner is told why and can ask a person to look again, as the acceptable use policy explains.

Pages that are reported

Anyone who scans a code can report the page it opens. We keep the report, the code it names and any note or email address the reporter gives, and we email a copy to the address we use for abuse reports. Reports are read and decided by a person; nothing is stopped automatically by the number of reports.

Payments

Payments are taken by Paddle, which sells our plans as the merchant of record and sends the invoices. So when you subscribe, you buy from Paddle, which collects your payment details as a controller in its own right, under its own privacy notice. Paddle tells us your name, email address, country and plan, and whether each payment succeeded, was refunded or was reversed. We never see your card number. We keep Paddle’s statements of each sale in our own accounts for as long as HMRC requires: at least 5 years after the 31 January submission deadline of the tax year.

Source: GOV.UK, Business records if you're self-employed: How long to keep your records; read 22 October 2026.

Email

We email you what your account needs: the sign-in link and its code, a welcome when your account is made, notices about your account, and the notices about a subscription set out in the terms. We send no email about a code’s own 14 days. We send no product news to an address collected by “Get my code”, because that step offers no way to turn it down; if we ever send product news, it will go only to people who were offered that choice, and every such email will carry a one-click unsubscribe link.

Reports of misuse

If you report a code to abuse@qrvane.com, we keep your report and email address while we deal with it, then for 24 months as a record of what we did, in case the same code or account comes back.

This website

Our public pages set no cookies. If we ever switch on Cloudflare Web Analytics to count visits to this website, it sets no cookie either and keeps nothing that names a visitor; we would say so here before doing it. The cookie statement lists the sign-in cookies we set.

3. Why we are allowed to use it

• Running your account, your workspace, its codes and hosted pages, each code's first 14 days and your subscription. Contract: we need it to provide the service you signed up for.
• Sessions, passkeys, rate limits and send limits. Legitimate interests: keeping accounts secure and the service available to everyone.
• Counting scans of your dynamic codes. Legitimate interests: showing a code’s owner how it is used, with nothing stored that names the person scanning.
• Screening links and handling reports of misuse. Legitimate interests: protecting the people who scan codes from phishing and malware; and legal obligation, where the law requires us to act or keep a record.
• Emails your account needs, and product news to customers. Contract for the emails your account needs; legitimate interests for product news, which you can turn down when you sign up and unsubscribe from in one click in every email.
• Counting visits to this website, if we switch on Cloudflare Web Analytics. Legitimate interests: knowing which pages are read, with no cookie and nothing kept that names a visitor.
• Tax and accounting records. Legal obligation: HMRC requires a sole trader to keep business records for at least 5 years.

4. Who we share data with

Processors acting for us

These companies process personal data only on our instructions, under contracts that limit them to doing so:

• Cloudflare (United States). Hosts the website and the app, forwards every scan, stores the files you upload such as a logo or a menu PDF, and sends our emails. Its servers handle the requests your browser or a scanner’s phone makes, IP addresses included. Cloudflare’s privacy notice.
• Neon (United States). Runs our database in London: your account, your workspace, its codes, sessions and scan records. Neon is part of Databricks. Neon’s privacy notice.

The service that screens links will be named here before launch. It receives the link and nothing else.

Companies that decide for themselves

These companies are controllers in their own right: they decide what they do with the personal data they hold, under their own privacy notices, and we cannot change that.

• Paddle (United Kingdom). Sells our plans as the merchant of record: you buy from Paddle, which takes payment, works out tax, sends the invoice and handles refunds, under its own privacy notice and buyer terms. Paddle holds your card details; we never see them. It sends us: Your name, email address, country, plan, and whether each payment succeeded, was refunded or was reversed. Paddle’s privacy notice.

Our database runs in London, and the app runs on Cloudflare’s network. Cloudflare and Neon are based in the United States, so some of your data may be processed there. For each of them we rely on the safeguard in its data processing agreement: the UK Extension to the EU-US Data Privacy Framework where the company is certified under it, or otherwise the UK’s International Data Transfer Agreement or Addendum. Email privacy@qrvane.com for a copy. We do not sell personal data, and we do not share it for advertising.

5. How long we keep it

• Your account (email address, name, and the workspaces you own): While your account is open. When you delete it, it is locked at once and deleted for good 30 days later.
• Passkeys (the public key, a label such as “Chrome on Windows”, and when it was added): Until you remove the passkey or delete your account.
• Sign-in sessions (with the IP address and browser they were made from): Deleted when you sign out. A session that ends without signing out is deleted 30 days after it expires.
• Sign-in links (stored only as a one-way hash): Until they are used or expire, and deleted within a day after that.
• Account restore links (stored only as a one-way hash): Until you restore your account, or it is deleted for good 30 days after you asked.
• Rate-limit records (an IP address, or a one-way hash of an email address, with a count): About 48 hours after the last request they count, then deleted. They are kept for anyone who asks for a sign-in link, whether or not they have an account.
• Files you upload for a hosted page (a menu PDF, a photo for a business card, a logo): While the code that uses them exists. They are deleted when you delete the code or your account, and an upload that is never finished is deleted within a day.
• Scan records (time, approximate location, device type): 24 months, then deleted.
• Reports of misuse (the report, the reporter’s email address and what we did): 24 months after the case is closed, then deleted.
• What Paddle tells us about your purchases (plan, country and whether a payment succeeded): While your account is open, and deleted with it.
• Payment and invoice records: Held by Paddle under its own privacy notice, for as long as tax law requires.
• Our own accounting records (Paddle’s statements of each sale: the plan, the amount, the buyer’s country and the buyer’s name or email address where the statement shows it): At least 5 years after the 31 January filing deadline for the tax year of the sale, as HMRC requires of a sole trader, then deleted.

6. Your rights

You can ask us for a copy of your data, to correct it, to delete it, to limit how we use it, to object to how we use it, or to send it to you in a format you can take elsewhere. Where a decision about your code was made automatically, such as a link flagged by screening, you can ask a person to look at it again. Email privacy@qrvane.com. You can also delete your account yourself from its settings. A code's scans can be exported as CSV at every stage: in its first 14 days, in a grace period and after it stops.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint, though we would like the chance to put it right first.

7. Children

QRVane is a service for businesses, and is not meant for children.

8. Changes to this notice

When this notice changes, the date at the top changes too, and we email account holders about any change that affects them.