Privacy policy

1. Who we are

QRSalt is run by , a company registered in Norway. For the personal data this policy describes as ours, we are the controller. We have not appointed a data protection officer; the people who run the service answer privacy questions themselves.

Privacy contact: support@qrsalt.com. It is the same inbox as support, so there is one address to remember and it is read by the people who can actually act.

2. The short version

• A free static code involves no account and nothing is sent to us about it.
• For an account we need your email address, and not much else.
• Scans of dynamic codes are counted without storing a raw IP address, with a visitor hash that changes every day so nobody can be followed from one day to the next.
• Ad and analytics cookies are optional. In Europe they are off until you accept; in the US and elsewhere they are on with no banner and you can switch them off at the foot of any page. Global Privacy Control switches them off everywhere, without being asked.
• We do not sell personal data. Besides service email, we may send a small number of emails about getting started, and you can turn them off.
• You can export your data and delete your account from Settings.

3. What we collect, and why

Visiting our website

Your IP address and browser details reach Cloudflare, which protects and speeds up the site, and our server, which uses the IP address to limit abuse (for example, too many sign-in attempts from one address). Rate-limit counters keyed on an address are deleted when their window ends, within a day at most. Starting a checkout is the one exception, described under Paying below. We work out which cookie rules apply to you from the country Cloudflare reports, and do not store it.

If you allow ad measurement (see cookies), Google Ads learns that you visited from an ad and whether you went on to sign up or subscribe. We keep the ad click identifier in your browser for up to 90 days, and the site, campaign and first page that brought you for up to 30 days, and save them with your account if you sign up. If you sign up on the way to connecting an app to your account, we also note that, and the name the app gave itself. When you subscribe, the page that confirms your payment tells Google Ads that a purchase happened and what you paid. Only with ad consent, it also gives Google's tag your account email so the purchase can be credited to the right ad (Google calls this enhanced conversions); the tag turns it into a hashed (SHA-256) form in your browser, and the address itself never reaches Google. Because that page does not always get to report (an ad blocker, a closed tab, a payment that arrives late), our server also tells Google about the same purchase through Google's Data Manager API: the ad click identifier, the amount and time, and your account email in the same hashed (SHA-256) form, never the address itself. Google counts the purchase once. The server does this only for a purchase whose ad click identifier we kept, which means you allowed ad measurement when you signed up, and never after your browser has told us you refused it (in Cookie settings or with Global Privacy Control). Sign-ups are not sent from our server.

The same choice covers Google Analytics, which tells us how the public pages of the site are used: the pages viewed, the device and browser, approximate location (city or coarser, as Google works it out), and that an account was created (and whether by email or with Google) or a plan bought, with the plan and the amount. It sets its own cookies on our domain. It never runs in the signed-in dashboard, and it receives no name or email address. If you reject these cookies, the Google tag sets no cookies and sends Google only cookieless signals, without identifiers. If your browser sends Global Privacy Control, the tag is not loaded at all and Google receives nothing. In the EEA, the UK and Switzerland nothing loads until you accept.

Separately, and with no cookies, our server keeps a daily total for each public page: how often it was viewed, its tool was used, a code was downloaded, what you typed was taken along to sign-up, and sign-up was started. It also counts, against the page an account was signed up from, how often a checkout was started and a first payment was made. Each total is a number for one page and one day, and nothing else is kept with it: no cookie is set or read, no identifier is made, and your IP address and browser details are not stored. A browser that sends Global Privacy Control or Do Not Track is not counted, and neither is a payment made through a checkout that browser started.

Making a free static code

We collect nothing about you or what you made; the download only adds one to that page's daily total above. Static codes are generated in your browser: the content you type, the design you choose and the file you download never reach our servers. There is no account and no record of what you made. The exceptions are a logo or a PDF you add and then choose to sign up with: we store that file privately so it is waiting in your new account, and record the upload, with your IP address, in our security log. The link to it in your browser expires after 24 hours. The same goes for a list in the free bulk generator: its static codes are made in your browser, and only the rows you mark dynamic, and only if you press Continue, are stored privately for the importer in your account.

Reading a code from an image

The free reader and the keyless read endpoint take the picture itself, up to 12 MB. It is held in memory only for as long as the decode takes and then discarded: no file is written, no row is created, and neither the image nor the text found in it is logged or shown to anyone. There is no account attached to any of it. The only thing recorded is what every keyless request records: a short-lived count, held against the address the request came from, so the hourly allowance can be enforced. That counter is deleted once its hour is over, and it says nothing about what was in the picture.

Your account

• Your email address, and a name if you give one. If you sign in with Google, Google sends us your name, email address and Google account identifier; we ask for nothing else.
• A salted hash of your password, if you set one. Never the password itself.
• If you turn on an authenticator app: its secret, encrypted, and your backup codes, stored only as hashes.
• Your workspaces, team members and roles, plan and subscription status, and your settings.
• What you create: codes and their destinations and history, designs, uploaded logos, PDFs and pictures, pages, menus, contact cards, forms, folders, tags, UTM presets, custom domains, API keys (stored only as hashes) and webhooks.
• Apps you connect by signing in with QRSalt: the name the app gave itself, the workspace and permissions you chose, who connected it, when, and when it was last used. Its access tokens are stored only as hashes. We do not record the app’s IP address.
• Our Chrome extension, QRSalt for Chrome, is one of these apps. It keeps its sign-in tokens in your browser. When you make a dynamic code with it, it sends us the link and the page’s title as the code’s destination and name. Static codes are made in the extension and send us nothing.
• Security records: when each session started, and its IP address and browser; one-time sign-in codes (stored as hashes, deleted once used or expired); and a log of important account actions.
• If you answer the optional question we ask once after you pay, how you found us and, if you name an AI assistant, roughly what you asked it. If you skip it, we note that so we don't ask again. It stays with your account and isn't shared with anyone.
• How often your workspace reached a plan limit or asked for something your plan does not include, kept as a daily count per feature. It records what was refused and on which plan, never who asked or from where. We read it to see whether our plans are drawn and priced in the right places.

Paying

Checkout and payments are handled by Whop. Whop collects your payment details under its own privacy policy; we never receive your card number. We receive and keep the plan, price, billing interval, status, dates and Whop's reference numbers, and the notices Whop sends us about your subscription.

We used to keep scrambled fingerprints of email and IP addresses to limit free trials to one per person. We no longer offer free trials, and those fingerprints are deleted.

Email

We send service email: sign-in codes, one welcome when you sign up, receipts, notices about your plan and codes, team invitations and replies to you. It is sent through Resend, which uses Amazon Web Services to deliver it. Our emails carry no tracking pixels. If you write to us, we keep the conversation.

We may also send a small number of emails about getting started. Today there are four, and each is sent to you at most once: a reminder about a day after you sign up, only if your account has not made a code yet; a note when the first dynamic code you made passes 10 scans within 30 days of making it; a note when a Free workspace you own has used all 3 of its free dynamic codes; and a reminder about a day after you start a checkout that you did not finish, unless you have subscribed since. Each of these emails has an unsubscribe link that works without signing in and a one-click unsubscribe your mail app can show, and you can turn them off in Settings, under Your data. Service email still arrives either way.

QR Menus and search engines

A QR Menu you publish is a public web page at qrsalt.com/p/…. Anyone with the link can open it, and that has always been true.

Since 19 September 2026 a published menu can also appear in search results, but only when all of these are true: you have not switched the listing off, it has a title, a description, at least three link buttons and a real paragraph of text, it is at least a fortnight old, and enough separate days of visitors have opened it for us to see that somebody actually uses it. A free workspace also needs a logo and a cover image. Every menu that does not meet all of that asks search engines not to list it, and most menus never will.

The switch is on the menu's own page in your dashboard: turn off “Show in search results” and we ask search engines not to list it. Search engines keep their own copies of what they have already fetched and we cannot delete those for you, so a page that has been listed may take a while to disappear from them. Nothing about your analytics is ever public, and the links on your menu are always marked so that they pass no search credit to wherever they point.

People who scan your codes, and use your pages and forms

When someone scans one of your dynamic codes, opens a page or menu you host with us, or answers one of your forms, we record it for you. You decide why; we are your processor, under our data processing agreement. If you scanned a code or answered a form and have a question about your data, the business that made it is the one to ask first; we will help them answer.

For a scan or a page view we record:

• the time;
• an approximate location: country, region, city and a position rounded to about 11 km, as reported by Cloudflare. Scans through a customer's own domain reach our server directly, not through Cloudflare, and usually carry no location;
• the device type, operating system family and browser family;
• the referring site, when there is one;
• a visitor hash, which lets the customer see how many different people scanned today.

We never store the raw IP address of a scan. The visitor hash is computed from the address, the browser and the code under a key that changes every day and is then thrown away. The same person counts once within a day, cannot be recognised the next day, and cannot be followed from one code to another, not even by us. No cookie is set when a code is scanned, no device is fingerprinted, and no advertising or analytics tag runs on these pages.

A form answer holds whatever the form asked for, plus the time, an approximate country and the same kind of daily hash. The customer decides what to ask and deletes answers when they choose.

We also use scan and request data ourselves, as controller, for one purpose only: keeping the redirect service safe and working (for example, spotting a code being used for phishing).

Keeping the service safe

• Code destinations are checked against Google Safe Browsing when they are set and again from time to time. Google receives the destination URL only.
• Sign-in, registration and forms that anyone can submit use Cloudflare Turnstile to tell people from bots.
• Pictures uploaded for QR Menus and logos get a fingerprint, computed on our own server, so a picture we have removed cannot be uploaded again. We may also use automated tools, our own or our providers', to detect illegal pictures.
• If you report a code or a page as abusive, we keep the report and the email address you give (if any). We keep the IP address it came from only as a scrambled fingerprint, to stop repeated false reports.
• Our server writes a technical log (errors and background-job summaries) that can contain an IP address or email address when something fails.

4. Legal bases

5. How long we keep things

6. Who else receives it

We use a small number of providers to run the service, and they act only on our instructions, under contract:

• DigitalOcean: the server in New York that runs the service, its database, uploaded files and local backups;
• Cloudflare: network, security, caching, approximate location, bot checks, access control for our own staff, and storage for our encrypted backups (R2);
• Resend, which sends our email through Amazon Web Services;
• Google Safe Browsing, which checks code destinations.

The full list, with what each handles and where, is on the sub-processor page.

Some recipients decide for themselves how to use what they receive, under their own privacy policies: Whop (payments), and Google for Sign in with Google and, only as your cookie choice allows, Google Ads (including the server report through the Data Manager API) and Google Analytics.

We may also disclose data when the law requires it or the authorities lawfully ask for it, when we believe it is needed to protect someone's safety or to report illegal content, or to establish, exercise or defend a legal claim. If our business or the service were ever sold or merged, the data would pass to the new owner, who would have to keep to this policy.

7. Transfers outside Europe

The service runs on a server in New York, and most of our providers are American companies, so your data is transferred to the United States. We rely on the European Commission's Standard Contractual Clauses in our contracts with those providers, and on the EU–US Data Privacy Framework for providers that are certified under it. We are a European company ourselves and are not certified under that framework. The sub-processor page shows the safeguard for each provider. You can ask us for a copy of the relevant safeguards.

8. Cookies

We use strictly necessary cookies to keep you signed in and to remember choices, and optional ad measurement and analytics cookies only as described in the cookie policy, which lists every one by name. You can change your choice at any time from Cookie settings at the foot of every page.

9. Your rights

Wherever you live, you can:

• get a copy of your data, and take it elsewhere in a machine-readable format: use the export in Settings, or email us;
• correct it: change it in the dashboard, or email us;
• delete it: delete individual items, or your whole account from Settings;
• restrict our use of it while a complaint is looked into;
• object to anything we do on the basis of legitimate interests;
• withdraw consent to ad measurement and analytics, as easily as you gave it, in Cookie settings. Withdrawing does not affect what happened before.

For anything the dashboard does not do, email support@qrsalt.com. We answer within one month. We may ask you to confirm the request from your account's email address, so we do not hand your data to someone else. Using your rights costs nothing.

10. Deleting your account

You can delete your account from Settings. For 30 days afterwards you can change your mind and restore it exactly as it was. After that it is permanently deleted: your account, codes, destinations, uploads, pages, forms, responses and analytics.

A few things outlast that. We keep a minimal bookkeeping record of each payment for as long as Norwegian law requires, with your name and email address removed. Backups made before the deletion expire on their own schedule: the copies on our server within 30 days, and the encrypted copies in Cloudflare R2 within 12 months. Until then they are kept locked away and unused, and if we ever had to restore one we would delete your account again first. One exception applies only to accounts we had to act against for abuse (a blocked code or a suspended workspace): we keep a one-way scrambled fingerprint of the email address for two years, so the same person cannot simply sign up again to repeat it. It cannot be turned back into the address.

During the 30 days your dynamic codes keep redirecting, so a mistaken deletion does not break anything you have printed. Once the account is permanently deleted they stop, because there is no longer a destination to send anyone to. If you want your codes to keep working, cancel the subscription instead; see the terms.

11. Complaints

Please tell us first if something is wrong, and we will try to put it right. You also have the right to complain to a data protection authority. Ours is Datatilsynet, the Norwegian Data Protection Authority. You can also go to the authority where you live or work, or where you think the problem happened.

12. Automated decisions

We make no decisions about people by automated means that have legal or similarly significant effects. Automated checks can block a code's destination if it appears on a malware or phishing list, or refuse a picture that matches one we removed; those are decisions about a link or an image, and a person reviews them if you ask.

13. Children

QRSalt is a business tool and is not directed at children. You must be at least 16 to hold an account. We do not knowingly collect personal data from children under 16, and we do not sell or share it. If we learn that we hold such data, we will delete it.

14. California and other US states

US state privacy laws, such as California's CCPA as amended by the CPRA, apply to businesses above certain sizes. Whether or not they apply to us, we give residents of every state the rights below.

• What we collect (in the last 12 months): identifiers (email address, IP address, account and ad click identifiers); commercial information (plan and purchase history); internet activity (pages visited and how you arrived, and scan records described above); approximate geolocation (city or coarser, never precise); and account login credentials, which are sensitive personal information used only to let you sign in. The sources, purposes and retention periods are in sections 3 to 5, and the providers we disclose it to for business purposes are in section 6.
• We do not sell personal data.
• Sharing for advertising. When ad measurement is on, the Google tag (Google Ads and Google Analytics), the purchases and sign-ups it reports, and our server's purchase report to Google may count as "sharing" for cross-context behavioural advertising. To opt out, choose Your privacy choices at the foot of any page and switch it off, or turn on Global Privacy Control in your browser, which we treat as an opt-out automatically, with or without a click, and confirm on the cookie page. There is no banner to get past first: in the US the tag loads with the page and the opt-out is always one click away. An opt-out made in the browser applies to that browser; to apply it to your account as well, email us.
• Sensitive information. We use it only for the purposes the law permits, so there is nothing to limit.
• Your rights: to know what we hold, to get a copy, to correct it, to delete it, and to opt out of sharing, with no discrimination for using them. Use Settings or email support@qrsalt.com; an authorised agent can ask for you with your signed permission. We confirm requests within 10 days and answer within 45.
• Appeals. If we turn down a request, reply to our answer to appeal, and we will reply within 60 days. If you are still unhappy, you can contact your state attorney general.

15. Changes

If we change this policy in a way that affects you, we will email account holders before it takes effect. The date at the top always shows the current version.