Privacy Policy

This policy explains what Elate QR collects, why, and what your choices are. It covers two very different groups of people:

• Account holders — people and organizations who sign up to create and manage QR codes; and
• Visitors — people who scan a QR code created with Elate QR or view a landing page it serves.

Our starting principle is to collect as little as the Service needs. Most notably, we never store the raw IP address of anyone who scans a QR code — see If you scanned a QR code below.

When you create and use an account, we collect:

• Account details — your name, email address, and a securely hashed password (we never store passwords in plain text).
• Workspace data — your organization’s name, its members and their roles, and invitations you send.
• Billing information — if you subscribe to a paid plan, payment is handled by Stripe. We receive your subscription status and plan; your card details go directly to Stripe and never touch our servers.

We store the content you create in the Service so we can serve it: destination URLs, QR code designs and logos, landing page text and imagery, and digital business card (vCard) details such as names, phone numbers, and email addresses. This content is yours; we use it only to operate the Service and display it to the visitors you direct to it. Contact details you put on a vCard or landing page are, by design, shown to anyone who scans that code.

When you scan a Elate QR QR code, we redirect you to the destination or show a landing page, and we record one telemetry event for the code’s owner. That event contains:

• An anonymous visitor token — a one-way hash derived from your IP address and browser signature combined with a secret salt that rotates every day. Your raw IP address is never stored, the hash cannot be reversed into it, and because the salt rotates, the token cannot link your scans across days.
• Approximate location — country, region, and city derived from your IP address at the moment of the scan; the IP itself is then discarded.
• Device context — device type (phone, desktop, tablet), operating system, and browser family, parsed from your user-agent string.
• Request context — the referring page, if your browser sent one, and your preferred language.

Scan and landing pages served by Elate QR set no cookies and no tracking identifiers. We do not build profiles of visitors, and scan telemetry is never sold or used for advertising. The destination a QR code points to is operated by the code’s owner and has its own privacy practices — this policy stops where that site begins.

For scan telemetry, the QR code’s owner decides what to collect it for; we process it on their behalf. If you have questions about a specific QR code, the owner is your first point of contact — but you can always reach us too (see Contact).

The Elate QR dashboard uses strictly necessary cookies to keep you signed in and to protect your session. We do not use advertising or cross-site tracking cookies anywhere, and public scan pages set no cookies at all. Because we only use essential cookies, there is no cookie consent banner to click through.

We use the information described above to:

• operate the Service — resolve QR codes, serve landing pages, and show account holders their scan analytics;
• manage accounts, workspaces, subscriptions, and support;
• enforce plan limits and protect the Service against abuse, fraud, and security threats;
• send transactional messages such as invitations, billing notices, and material changes to the Service or its policies.

We do not sell personal data, and we do not use it for third-party advertising.

We share data only with the providers that run the Service:

• Stripe, for payment processing and subscription management;
• Infrastructure providers, for hosting the application and its database.

These providers process data under their own contractual confidentiality and security obligations. Beyond that, we disclose data only if required by law or to protect the rights, safety, or integrity of the Service — and account holders’ analytics are shared with the members of their own workspace, which is the point of the product.

• Account and workspace data is kept while your account is active and deleted or anonymized after the account is deleted.
• Scan telemetry is kept while the related QR code exists so its owner can see long-term analytics; deleting a QR code or workspace removes its telemetry.
• Billing records are retained as long as tax and accounting laws require.

Depending on where you live (for example under the GDPR or similar laws), you may have the right to access, correct, export, restrict, or delete your personal data, and to object to certain processing. Account holders can exercise most of these directly: edit your profile and content in the dashboard, or delete QR codes, workspaces, or your account.

For anything you cannot do yourself, contact us at [email protected] and we will respond within the timelines the law requires. Note that scan telemetry contains no stored identifiers we could use to look a visitor up — that data is anonymous by construction.

All traffic to the Service is encrypted in transit. Passwords are stored only as salted hashes. Every workspace’s data is isolated with database-enforced row-level security, so one organization’s data is never visible to another — the database itself refuses cross-tenant queries. No system is perfectly secure, but if a breach ever affects your personal data, we will notify you as required by law.

The Service is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has created an account, contact us and we will delete it.

We may update this policy as the Service or the law changes. If a change is material, we will notify account holders by email or in-app notice before it takes effect. The “Last updated” date at the top always reflects the current version.

Questions, concerns, or requests about privacy? Email us at [email protected]. See also our Terms & Conditions.