Privacy Policy.

CirculateQR ("we", "us") is a QR code platform based in Arizona, United States. This policy explains how we handle personal information of people who use circulateqr.com and our dashboard ("customers") and of people who scan QR codes or visit pages created with CirculateQR ("visitors").

From customers:

• Account details: email address, name and profile picture, plus a securely hashed password.
• Billing: your plan, subscription status and Stripe customer ID. Card details are collected and stored by Stripe, not by us.
• Content you create: QR code names, destinations and designs, uploaded logos and images, hosted pages, digital business cards, workflows and marketplace listings.
• Creator payouts: if you sell in the marketplace, Stripe collects identity and bank details to pay you.

From visitors who scan a code or open a hosted page:

• Scan analytics: date and time, approximate location (country, region, city and approximate coordinates estimated from the IP address), device type, operating system, browser, language, referrer and time zone, and a salted one-way hash of the IP address used to count unique scans (no cookie is used to count scans).
• Information visitors choose to submit through forms, lead capture or access gates created by the code's owner (for example, an email address), together with the IP address of the submission.
• If a visitor joins a loyalty card or plays a game on a code's page (a scratch card, mystery box or scavenger hunt): a random visitor ID (see Cookies) and their progress, such as stamps, points, prizes won, hunt team and check-ins, plus anything the page asks for (for example a first name or birthday for a loyalty card, or photos taken for a hunt).

Security logs: IP addresses and browser details for sign-ins and administrative actions, used to protect accounts and investigate abuse.

• Sign-in cookies (essential): keep you logged in. While our support staff view an account to help (read-only), their browser also gets a cookie that marks that session.
• Scan cookies (2 to 5 minutes): when a scan opens a page hosted by CirculateQR, a short-lived cookie for that code stops a refresh from being counted as another scan, and makes sure a scavenger hunt step is only checked in by a real scan.
• Visitor ID (one year): a random ID, set only when you join or use a loyalty card or play a game on a code's page (a scratch card, mystery box or scavenger hunt). It lets that page remember your stamps, points, prize or hunt team when you come back. It is not set when you just scan a code or open a page, and it is not used for scan analytics. If your browser doesn't keep it, these features use a one-way hash of your IP address and browser details instead.
• Privacy choice (one year): remembers whether you chose "Opt out" or "OK" on a scan page's privacy notice. That notice also explains the scan and visitor ID cookies.
• Your browser's storage: some pages keep small things on your device, such as a Studio draft, an order basket or whether game sounds are muted. They aren't sent to us.
• Tracking pixels: if a code's owner connects Meta, Google Analytics or TikTok, those services may set their own cookies on that owner's pages under their own policies.

• to provide the Service, including redirecting scans, hosting pages and generating designs;
• to show customers analytics about their own codes;
• to process payments, subscriptions and creator payouts;
• to prevent fraud, phishing and abuse, and to keep the Service secure;
• to provide support and send service messages, such as receipts and security notices;
• to comply with legal obligations.

When you use AI design features, your prompts and any reference images you provide are sent to our AI providers (Google Gemini and Replicate) to generate results. We do not use your content to train our own models.

We do not sell personal information. We share it only with service providers that run the Service for us:

• Supabase: database, sign-in and file storage
• Vercel: website hosting
• Stripe: payments, subscriptions and creator payouts
• Google (Gemini) and Replicate: AI generation
• Mapbox: maps shown in your dashboard
• IP geolocation services: estimating a scan's approximate location

If a code's owner turns on tracking pixels, scan events for that owner's codes are sent to the advertising or analytics service they chose (or to the owner's own systems, if they connect a webhook). Visitors can opt out of this from the notice on scan pages; it then stops for later visits from that browser, and the owner still sees their usual scan analytics. We treat Global Privacy Control and Do Not Track signals the same way. We may also disclose information when required by law or to protect our users and the Service.

For scan analytics and form submissions, we process information on behalf of the customer who created the code. That customer decides what to collect and is responsible for telling their audience. If you scanned a code and have a question about your data, please contact the business that created it; we will help them respond.

We keep account information and content for as long as your account is active. Scan analytics are kept while the owner's account is active; plans show different history windows.

You can delete your account yourself in Settings > Security. When you do, we cancel any paid plan straight away (you aren't charged again, and the rest of the billing period isn't refunded) and immediately delete your account, QR codes, hosted pages, uploaded files, form responses, leads, scan analytics, the loyalty and game data on your codes, and everything else linked to your account, such as reviews, API keys and webhooks. Your codes stop working. Marketplace items you sell are taken off sale; people who already bought them keep their copies. If we still owe you money for marketplace sales or referrals, the account can't be deleted until we have paid you: email us and we will.

We keep some records because tax and accounting rules require it: purchases (credit packs, code unlocks and marketplace purchases), creator payouts and referral commissions. We keep them without your name or email. Stripe keeps its own payment records, such as invoices, under its own policy. Copies in our database backups are removed as those backups expire.

Sign-in and activity logs about your account are deleted with it. Records of actions our staff take on accounts are kept for security.

You can update your account details in Settings, and delete your account yourself at any time in Settings > Security (see How long we keep information). You can also ask us to access, correct, export or delete your personal information by emailing support@circulateqr.com. We respond within 30 days and may need to verify your identity.

Depending on where you live (for example California, or the EU and UK), you may have additional rights, such as the right to object to processing or to complain to a data protection authority. We do not sell personal information and do not use it for cross-context behavioral advertising ourselves.

Data is encrypted in transit, and access to it is restricted by account-level permissions in our database. No system is perfectly secure, so please use a strong, unique password.

CirculateQR is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has given us personal information, contact us and we will delete it.

We are based in the United States and our service providers mainly process data in the United States.

We will post any changes here and update the date above. For significant changes we will notify customers by email or in the app. See also our Terms of Service.

Privacy questions or requests: support@circulateqr.com.