Privacy Policy

1. Who we are

FLIPR GROUP LTD is a private limited company registered in Cyprus under company number HE 443704, with registered address at 23 Ploutonos, 3096 Limassol, Cyprus, and VAT number CY 60184306Q.

For privacy questions or requests, use https://www.iloveqr.com/contact or write to our registered address.

2. Our data protection roles

FLIPR GROUP LTD is the controller for account administration, billing, product security, our own communications, and our website analytics and advertising activities.

A customer is normally the controller for personal data they choose to place in QR content or collect through a QR destination. For processing performed on that customer's instructions to provide the service, FLIPR GROUP LTD acts as processor.

3. Personal data we collect

• Account and contact data, such as name, email address, language, organisation, and authentication records.
• Subscription and billing data, such as plan, billing address, tax information, payment status, Stripe customer identifiers, invoices, and transaction metadata. We do not store full card details.
• QR and customer content, such as destination URLs, uploaded files, designs, landing-page content, folders, and configuration choices.
• Scan and technical data, such as date and time, truncated or logged IP address where necessary, approximate location derived from IP, device, operating system, browser, referrer, and QR identifiers.
• Usage, support, and communications data, including product interactions, consent choices, support messages, and email delivery or engagement events where enabled and lawful.
• Cookie, analytics, and advertising data collected according to your consent choices and our Cookie Policy.

4. How we obtain data

We receive data directly from you, automatically from your device or QR scans, from the customer that created a QR experience, and from service providers such as Stripe, authentication providers, analytics services, and advertising platforms.

5. Purposes and legal bases

• To create and administer accounts, deliver QR functionality, process subscriptions, and provide support, based on performance of a contract.
• To secure the service, prevent abuse, troubleshoot, measure reliability, and improve core features, based on our legitimate interests or legal obligations as applicable.
• To issue invoices, calculate taxes, keep statutory records, and respond to authorities, based on legal obligations.
• To send service notices and respond to requests, based on the contract or our legitimate interests.
• To use non-essential analytics, personalisation, and advertising technologies, based on consent where the law requires it.
• To establish, exercise, or defend legal claims, based on our legitimate interests and applicable law.

6. Customer QR content

Customers decide what their QR codes link to and what information they collect. Their own privacy notice should explain that processing. If you scanned a customer's QR code and want to exercise rights over information controlled by that customer, contact the customer first; we will assist them where required by our processor obligations.

7. Who receives data

We disclose only what is reasonably necessary to:

• Stripe for payments, subscriptions, invoicing, fraud prevention, tax calculation, and permitted currency localisation;
• Vercel and Heroku for website, application, and infrastructure hosting;
• Resend for transactional email delivery and related delivery events;
• Cookiebot for consent management and consent records;
• Google Analytics, Google Tag Manager, and Google Ads for consented measurement and advertising;
• Sentry for error monitoring, diagnostics, and service security;
• professional advisers, auditors, insurers, acquirers, courts, regulators, or public authorities where necessary and lawful.

8. International transfers

Some providers may process data outside Cyprus or the European Economic Area. Where required, we use an adequacy decision, Standard Contractual Clauses, or another lawful transfer mechanism and assess appropriate safeguards.

9. Retention

We keep personal data only for as long as needed for the purposes described here. Retention depends on account status, customer instructions, product configuration, security needs, limitation periods, and legal accounting, tax, or regulatory requirements.

Account and QR data are generally retained while the account is active and for a limited period afterwards to support recovery, disputes, and secure deletion. Backup copies are removed on a rolling schedule. Payment, invoice, and tax records are kept for the period required by law. Consent records and support communications are retained as needed to demonstrate choices and resolve issues.

Customers can delete QR content and account data using available controls, subject to backups, legal holds, and mandatory records.

10. Cookies, analytics, and advertising

Necessary technologies support authentication, security, language, and core functionality. Where required, analytics and advertising technologies remain disabled until you consent through Cookiebot. You can change or withdraw consent at any time through the cookie settings control.

11. Security

We use organisational and technical measures designed to protect personal data, including access controls, encryption in transit, monitoring, backups, and restricted provider access. No online service can guarantee absolute security, and you should protect your credentials and report suspected misuse promptly.

12. Your rights

Depending on applicable law, you may have the right to:

• access and receive a copy of your personal data;
• correct inaccurate or incomplete data;
• request erasure or restriction of processing;
• object to processing based on legitimate interests or to direct marketing;
• receive portable data where the legal conditions apply;
• withdraw consent at any time without affecting earlier lawful processing;
• lodge a complaint with the Cyprus Commissioner for Personal Data Protection or your local supervisory authority.

13. How to exercise your rights

Submit a request through https://www.iloveqr.com/contact and identify the account or interaction concerned. We may request information needed to verify identity and protect other people. We normally respond within one month; the period may be extended where legally permitted for a complex or numerous request, and we will explain any extension.

14. Children

iloveQR is not intended for people under 18 and we do not knowingly create accounts for children. If you believe a child has provided personal data, contact us so we can investigate and take appropriate action.

15. Automated decisions

We do not use personal data to make solely automated decisions that produce legal or similarly significant effects for users. Automated fraud and security signals may flag activity for restriction or human review.

16. Changes and complaints

We may update this Policy when our service or legal obligations change. The date above identifies the current version, and we will give appropriate notice of material changes.

Please contact us first if you have a concern. You may also complain to the Office of the Commissioner for Personal Data Protection in Cyprus or the competent authority where you live or work.