Privacy Policy

01Who is responsible for your data

EndureQR is the controller of the personal data described here. Contact us about privacy at privacy@endureqr.com.

For scan data about the dynamic codes you create, you decide why the codes are used and we process scan data on your behalf to give you analytics.

02What we collect

Free generator: what you type and any logo you upload are processed in your browser to draw the code and build the file. They are not sent to our servers, and we don't store them.

Account data: your name, email address, organisation name, settings and, if you use a password, a secure hash of it.

Billing data: your plan, order history and the country used for tax. Card and payment details are handled by Lemon Squeezy; we never see your full card number.

Code data: the destinations, names, folders and designs of the dynamic codes you create.

Scan data: when a dynamic code is scanned, we record the time, the approximate location to city level, device type, operating system and browser. We use the IP address only to work out the approximate location, then discard it; we don't store full IP addresses with scan records.

Messages: what you send when you email us.

03How we use it, and why we're allowed to

To provide the Service (create and redirect codes, show analytics, manage your account and send service emails): necessary to perform our contract with you.

To keep the Service safe (detect phishing and abuse, prevent fraud, investigate security issues): our legitimate interest in protecting you, people who scan codes, and us.

To improve the Service using aggregated, non-identifying statistics: our legitimate interest.

To show ads on the free generator and guide pages: with your consent where the law requires it (see Cookies and advertising).

To meet legal obligations, such as keeping order records for tax: legal obligation.

04Cookies and advertising

Essential storage: we store your light or dark theme choice in your browser, and when you log in we set a session cookie so you stay signed in. These are needed for the site to work and don't track you.

Advertising: the free generator and guide pages show ads served by Google AdSense. Google and its partners use cookies and similar technologies to serve ads, limit how often you see them and measure their performance. Ads may be personalised based on your visits to this and other sites, but only where you have given consent; otherwise Google shows non-personalised ads.

If you are in the European Economic Area, the UK or Switzerland, you will see a consent message before any advertising cookies are used, and you can change your choice at any time through the privacy settings link at the bottom of those pages.

You can learn how Google uses data from sites that show its ads at policies.google.com/technologies/partner-sites, and turn off personalised ads at adssettings.google.com.

We don't use third-party analytics or tracking cookies of our own.

05Who we share it with

Service providers that run parts of EndureQR for us, only for that purpose: Vercel (website hosting and delivery), Railway (database hosting), Resend (account emails (confirmation and password reset)), Lemon Squeezy (checkout, payments, tax and invoices (merchant of record)), Google (optional sign-in with a Google account, and AdSense advertising on the free generator and guide pages).

Authorities, if the law requires it, or to protect people from harm such as phishing.

A buyer or successor, if EndureQR is ever sold or merged, under the same commitments as this policy.

We never sell personal data, and we never share account or scan data with advertisers.

06International transfers

Our providers may process data in the United States, the European Union and other countries. Where data from the EEA, UK or Switzerland is transferred, we rely on the safeguards our providers offer, such as the European Commission's Standard Contractual Clauses.

07How long we keep it

Account and code data: while your account is open. When you delete your account, we delete it within 30 days, and it is gone from backups within 90 days, except that a cancelled code's redirect record is kept so the code keeps working (see Terms, section 6).

Scan analytics: 12 months on Pro, and for as long as your account exists on Lifetime.

Order records: held by Lemon Squeezy and by us for as long as tax law requires, usually up to 7 years.

Emails with us: up to 2 years after the conversation ends.

08Your rights

Depending on where you live, you can ask to access, correct, export or delete your personal data, or to object to or restrict some uses. Email privacy@endureqr.com and we will reply within 30 days.

Where we rely on consent, such as for personalised ads, you can withdraw it at any time.

If you are unhappy with how we handle your data, please tell us first. You can also complain to the data protection authority where you live.

California residents: we don't sell personal information. Advertising cookies on our free pages may count as "sharing" under California law; you can opt out through the privacy settings link on those pages or by turning on Global Privacy Control in your browser.

09Children

EndureQR is not meant for children under 16, and we don't knowingly collect their data. If you think a child has given us personal data, contact us and we'll delete it.

10Changes and contact

We'll post changes here and update the date above. For significant changes, we'll also email account holders before they take effect.

Questions or requests: privacy@endureqr.com.