Privacy Policy

Last Updated: 6 February 2026

1. Introduction

The QR Vault ("we", "us", or "our") is operated by Malaga Web Designs, based in Spain. We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

2. Information We Collect

2.1 Personal Information

When you register for an account (via email or Google Sign-In), we collect:

  • Email address
  • Display name
  • Password (encrypted) — or Google account ID if you sign in with Google
  • Subscription tier and payment information (processed securely by Stripe)
  • Company name, logo, and social media links (if you choose to provide them)
  • Language preferences for your guest upload page

2.2 Uploaded Content

We store photos, videos, and other files that you or your guests upload through your QR code. This content is stored securely on our servers and is only accessible to you as the account holder.

2.3 Usage Data

We automatically collect certain information when you use our service:

  • IP address
  • Browser type and version
  • Device information
  • Pages visited and actions taken
  • Date and time of visits
  • QR code scan events

2.4 Guest Uploader Data

When a guest uploads content via a QR code (without creating an account), we collect:

  • IP address at the time of upload
  • Device type and browser information (user agent)
  • Date and time of the upload
  • Record of consent acknowledgement (agreeing to our Upload Terms)

If the account owner has enabled guest messaging, guests may also send a text message from the upload page. When a message is sent, we collect and store the message content, the sender's optional name, their IP address, and the date and time the message was sent. This data is visible to the account owner and retained for security and abuse prevention purposes.

Guests do not need to create an account or provide their name or email to upload or send messages.

3. How We Use Your Information

We use the collected information for:

  • Providing and maintaining our service
  • Processing your subscription payments
  • Managing your account and QR code
  • Storing and organizing uploaded content
  • Sending service-related notifications
  • Improving our service and user experience
  • Detecting and preventing fraud or abuse
  • Complying with legal obligations

4. Data Storage and Security

Your data is stored on secure servers. We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the Internet or electronic storage is 100% secure.

Payment information is processed by Stripe, our payment processor, and we do not store your full credit card details on our servers. Stripe is PCI-DSS compliant.

5. Data Sharing and Disclosure

We do not sell your personal information. We may share your information with:

  • Stripe: Payment processing — Stripe receives your email and payment details to manage subscriptions. Stripe Privacy Policy
  • Google: If you use Google Sign-In, Google provides us with your name and email. We do not share data back with Google. Google Privacy Policy
  • Legal Requirements: When required by law or to protect our rights
  • Business Transfers: In connection with a merger, sale, or acquisition

6. Your Rights (GDPR Compliance)

Under GDPR and applicable data protection laws, you have the right to:

  • Access: Request a copy of your personal data
  • Rectification: Correct inaccurate or incomplete data
  • Erasure: Request deletion of your personal data
  • Portability: Receive your data in a structured format
  • Objection: Object to processing of your data
  • Restriction: Request restriction of processing
  • Withdraw Consent: Withdraw consent at any time

To exercise these rights, contact us at hello@theqrvault.com

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you services. If you cancel your subscription, your data will be retained for 30 days before permanent deletion, unless you request immediate deletion.

8. Cookies and Tracking

We use the following cookies:

  • Session cookie (QRVAULTSESSID) — Essential. Keeps you logged in. Expires when you close your browser.
  • Cookie consent (qrvault_cookie_consent) — Remembers your cookie preference. Expires after 1 year.
  • CSRF token — Essential security cookie to prevent cross-site request forgery. Session-based.

We do not use any third-party advertising or marketing cookies. You can instruct your browser to refuse cookies, but this will prevent you from logging in or using core features of our service.

9. Third-Party Links

Our service may contain links to third-party websites. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies.

10. Children's Privacy

Our service is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If you become aware that a child has provided us with personal information, please contact us.

11. International Data Transfers

Your information may be transferred to and maintained on servers located outside of your country. We ensure appropriate safeguards are in place to protect your data in accordance with this Privacy Policy.

12. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. You are advised to review this Privacy Policy periodically for any changes.

13. Contact Us

If you have any questions about this Privacy Policy, please contact us: