Privacy Notice

QRCodeMaster is operated by LaventeCare (Jeffrey Lavente), Dronten, the Netherlands, Chamber of Commerce 88162710. Questions or privacy requests can be sent to support@qrcodemaster.nl.

• Account and organization data supplied through Clerk, such as user identifier, email address, role, and active organization.
• QR content and settings, uploaded files, custom domains, API-key metadata, and webhook configuration.
• Scan events: time, device/browser/OS category, referrer and UTM values, and approximate country/region/city supplied by the hosting platform. The application does not store the raw IP address; where configured it stores a rotating pseudonymous daily visitor hash.
• Voluntary review feedback and contact-form submissions, including the supplied name, contact details, message, and recorded contact consent.
• Security and operational metadata needed to prevent abuse and diagnose failures. Request bodies, passwords, tokens, and raw API keys are not intentionally written to application logs.

• Providing accounts, QR routing, analytics requested by a customer, feedback, contact requests, and developer features: performance of the agreement, steps before entering it, or the visitor's explicit contact request.
• Security, fraud prevention, service reliability, and limited operational analysis: legitimate interests, balanced against user privacy.
• Google Analytics and Vercel Analytics on the website: consent. They do not load before opt-in and consent can be withdrawn at any time.
• Legal and tax records after billing is activated: compliance with legal obligations.

For customer-created campaigns, the business customer may be the controller and QRCodeMaster its processor. Appropriate processing terms can then apply.

The service uses Clerk (authentication), Convex (database and server functions), and Vercel (hosting). Google and Vercel analytics are used only after consent. These providers may use approved subprocessors or process data outside the EEA under applicable transfer safeguards. Their current documentation and contractual terms determine the exact locations.

• Detailed scan events: no longer than approximately 13 months.
• Voluntary review feedback and contact-form submissions: no longer than approximately 24 months.
• Webhook delivery logs: 90 days; short-lived rate-limit counters: at most 2 days.
• Consent preference: 180 days. Billing event audit metadata, once billing is active: up to 7 years where required.
• Account content remains until deletion, account closure, or a valid deletion request, unless a longer period is legally required.

Depending on the situation, you can request access, correction, deletion, restriction, portability, or object to processing. You can withdraw consent without affecting earlier lawful processing. We may verify your identity and normally respond within one month.

You may also complain to the Dutch Data Protection Authority or another competent supervisory authority.

Customers can configure routing rules based on time, device category, language, approximate geography, or scan count. These rules select content and are not intended to make decisions with legal or similarly significant effects. We update this notice when processing materially changes and show the revision date above.