Meet Cleo , the AI that lives inside your QR codes

Privacy Policy

How we collect, use and protect your personal data.

Last updated:

This Privacy Policy explains how QRCodeKIT collects, uses, discloses, and otherwise processes Personal Data when you visit our websites, use our QR-code services, create or manage an account, scan a QR code using QRCodeKIT-operated infrastructure, connect your account to an external platform, contact us, or otherwise interact with our Services.

The Personal Data involved depends on how you interact with QRCodeKIT. For example, visiting our website, maintaining a customer account, scanning a QR code, and using an authorized integration involve different types of information and different processing activities.

This Privacy Policy should be read together with our Cookie Policy and, where applicable, our Terms and Conditions.

QRCodeKIT is operated by MOBILE LEAVES CORP, a company incorporated in Delaware, United States.

For questions about this Privacy Policy or our processing of Personal Data, you may contact us at:

Privacy email: [email protected]

Support email: [email protected]

Mailing address: MOBILE LEAVES CORP, 874 Walker Road, Ste. C, Dover, Delaware 19904, United States

You may also contact us through our contact page.

This Privacy Policy applies to QRCodeKIT’s QR-code creation, management, hosting, redirection, analytics, API, integration, and related services, including services made available through:

  • qrcodekit.com and its language versions;
  • hub.qrcodekit.com;
  • app.qrcodekit.com;
  • app.v2.qrcodekit.com;
  • QRCodeKIT API and integration services;
  • mcp.v2.qrcodekit.com;
  • help.qrcodekit.com;
  • QR redirection services operated through uqr.to; and
  • QRCodeKIT-operated hosted content and features, including customer-configured AI functionality where available.

Together, these are referred to as the “Services.”

This Policy may apply to website visitors, prospective customers, account holders, members of customer teams, API and integration users, people who contact us, people whose information customers provide through the Services, and people who scan QR codes or interact with QRCodeKIT-hosted content.

This Policy does not govern the independent privacy practices of our customers, websites or services reached through a QR code, or other third-party platforms. Those parties may process Personal Data under their own privacy notices.

Depending on the activity, QRCodeKIT may process Personal Data for its own purposes or on behalf of a customer.

We determine the purposes and means of processing for activities such as:

  • creating and administering QRCodeKIT accounts;
  • managing subscriptions and customer relationships;
  • processing billing and transaction information;
  • providing customer support;
  • operating and protecting our Services;
  • analyzing the use and performance of our own Services;
  • conducting our own marketing and attribution activities;
  • administering integrations;
  • complying with legal obligations; and
  • handling privacy requests.

For these activities, QRCodeKIT acts as the controller or equivalent regulated entity under applicable privacy law.

Customers use QRCodeKIT to create QR codes, configure destinations, publish content, manage campaigns, analyze scans, and use other customer-selected features.

When we process Customer Content solely to provide those services on a customer’s instructions, the customer generally determines the purpose of the processing and QRCodeKIT acts as a processor, service provider, or equivalent role, as applicable.

Customers are responsible for ensuring that the Personal Data they provide to or process through QRCodeKIT is collected and used lawfully, for providing any notices required by law, and for obtaining any required permissions or consents.

Our processing on behalf of a customer does not prevent QRCodeKIT from separately processing limited information for its own legitimate purposes, such as account administration, security, fraud prevention, service integrity, legal compliance, and the protection of our rights.

The information we process depends on the Services you use and how you interact with us.

When you create or use an account, we may process information such as:

  • name;
  • email address;
  • account identifiers;
  • authentication information;
  • organization or company information;
  • team membership;
  • account roles and permissions; and
  • account settings.

If you use a third-party sign-in method, we receive the information made available through the applicable authentication process.

We may process:

  • subscription plan and status;
  • billing information;
  • invoices;
  • transaction identifiers;
  • payment status;
  • purchase history; and
  • information needed to administer your subscription or transaction.

Payment information submitted through a payment provider may be processed directly by that provider.

4.3 Customer Content and QR-code information

Depending on the feature used, Customer Content may include:

  • QR-code titles and configurations;
  • destination URLs;
  • contact information;
  • telephone numbers;
  • email recipients and subjects;
  • application or store links;
  • images and documents;
  • hosted-page content;
  • HTML content;
  • materials uploaded or configured by a customer;
  • information associated with customer-configured AI functionality; and
  • other information selected by the customer for use through a QR code.

Customers may include Personal Data relating to other people in Customer Content.

Information published through a QR code, publicly accessible hosted page, or public destination may be accessible to anyone who obtains the relevant QR code or link.

When a QR code uses QRCodeKIT-operated redirection or hosting infrastructure, we receive information necessary to process the request.

Depending on the interaction, this may include:

  • IP address;
  • date and time of the request;
  • requested URL or QR identifier;
  • browser information;
  • device information;
  • operating system information;
  • request headers;
  • referral information where available; and
  • technical or diagnostic information.

We may use scan-related information to provide scan analytics and reporting to customers, including scan counts, information about activity over time, approximate location information, and device characteristics.

When you contact us, request information, submit a form, participate in a survey, communicate through chat, or request support, we may process:

  • name;
  • email address;
  • company;
  • telephone number where provided;
  • message content;
  • attachments;
  • support history;
  • feedback; and
  • other information you choose to provide.

When you submit an abuse report through our report form or by email to [email protected], we process the reported link, the reason for the report, and any details, supporting materials, and related correspondence you provide. This information may include Personal Data about you or other individuals. Providing your email address in the form is optional; when you report by email, we receive your sender address. Please provide only information relevant to the report.

We may process information about how our websites and applications are used, including:

  • pages and features accessed;
  • interactions with the Services;
  • session and browser identifiers;
  • referral sources;
  • campaign parameters;
  • device and browser information;
  • performance information;
  • error events;
  • product events; and
  • other usage information.

Where advertising or attribution technologies are used, we may process information such as:

  • advertising or browser identifiers;
  • campaign information;
  • referral sources;
  • conversion events;
  • interactions with advertisements;
  • page or service interactions; and
  • associated technical information.

Further information about cookies and similar technologies is available in our Cookie Policy.

When an authorized integration or AI-related feature is used, information may include:

  • authorization information;
  • integration requests;
  • instructions or tool parameters;
  • QR-code information;
  • Customer Content selected for the requested operation;
  • tool results;
  • questions submitted to an automated assistant;
  • responses; and
  • related technical information.

The exact information depends on the integration or feature being used.

We may process information necessary to record and respond to:

  • cookie and privacy preferences;
  • marketing preferences;
  • opt-out requests;
  • access, deletion, correction, or other privacy requests; and
  • information reasonably necessary to verify or manage those requests.

We obtain Personal Data from several sources, including:

  • directly from you;
  • automatically when you access or use the Services;
  • from QRCodeKIT customers and their authorized users;
  • from your organization;
  • from authentication providers;
  • from payment providers;
  • from integrations you authorize;
  • from analytics, advertising, and attribution providers; and
  • from service providers that support the operation of our Services.

We may associate information from different sources where reasonably necessary for the purposes described in this Policy.

We process Personal Data for purposes including:

  • providing, operating, maintaining, and improving the Services;
  • creating and administering accounts;
  • authenticating users;
  • managing customer organizations and permissions;
  • creating, hosting, managing, and delivering QR codes and related content;
  • providing redirects and hosted pages;
  • generating scan analytics and reports;
  • operating APIs and authorized integrations;
  • processing subscriptions, transactions, and billing;
  • communicating with users and customers;
  • responding to support requests;
  • providing requested materials;
  • preventing fraud, abuse, and unauthorized activity;
  • maintaining security and service reliability;
  • detecting and resolving technical problems;
  • analyzing website and product usage;
  • measuring marketing and acquisition;
  • conducting advertising and remarketing where permitted;
  • managing marketing preferences;
  • complying with legal obligations;
  • establishing, exercising, or defending legal claims;
  • managing corporate transactions where relevant; and
  • responding to privacy requests.

We do not use Personal Data for materially different purposes without providing any notice or obtaining any consent required by applicable law.

Where the EU GDPR or UK GDPR applies and QRCodeKIT acts as controller, our processing is generally based on one or more of the following legal grounds.

PurposeLegal basis
Creating and administering accounts and providing requested ServicesPerformance of a contract or steps requested before entering into a contract
Managing organizational accounts and authorized team usersLegitimate interests in administering customer relationships and authorized use of the Services
Processing subscriptions, transactions, and billingContractual necessity, legitimate interests, and applicable legal obligations
Providing support and responding to inquiriesContractual or pre-contractual necessity where applicable, or legitimate interests in assisting users
Operating, securing, and protecting the ServicesLegitimate interests in maintaining secure, reliable, and lawful Services
Detecting fraud, misuse, errors, and security incidentsLegitimate interests and, where applicable, legal obligations
Receiving, investigating, responding to, and taking action on abuse reportsLegitimate interests in preventing misuse and protecting our Services, users, and third parties
Analytics and optional product or website measurementConsent where required; otherwise another applicable lawful basis
Advertising, remarketing, and optional trackingConsent where required by applicable law
Marketing communicationsConsent or legitimate interests where permitted by applicable direct-marketing rules
Authorized integrationsContractual necessity or legitimate interests in providing the requested integration
Privacy requests and complianceLegal obligations and legitimate interests in documenting and handling requests
Legal claims and corporate transactionsLegitimate interests and applicable legal obligations

Where we rely on legitimate interests, we consider those interests together with the rights and interests of affected individuals.

Where consent is the applicable legal basis, you may withdraw that consent at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

Requirements concerning cookies or access to information stored on a device may apply separately from the legal basis for processing Personal Data.

8. QR Codes, Customer Content, Scans, and Redirects

8.1 Customer Content

Customers determine the information and destinations associated with the QR codes they create.

QRCodeKIT processes Customer Content to provide the functionality selected by the customer, including creating, managing, rendering, hosting, modifying, redirecting, and analyzing QR-code activity.

Authorized administrators and team members may access Customer Content according to their account permissions.

Some QR codes contain information directly. Others direct a scanner to a URL.

Where a scan uses QRCodeKIT-operated infrastructure, we receive the technical request necessary to provide the redirect or requested hosted content.

If a QR code directs you to a customer-operated or other third-party website or service, that destination may separately collect information according to its own privacy practices.

QRCodeKIT may provide customers with analytics relating to their QR codes.

Such analytics may include scan totals and information relating to time, approximate location, and device characteristics.

Where QRCodeKIT processes scan information solely to provide a customer-requested service, our processing is carried out for that customer. We may separately process limited technical information for security, service integrity, legal compliance, and other purposes described in this Policy.

If your request concerns information submitted to or processed primarily for a QRCodeKIT customer, the customer may be the appropriate party to handle the request.

You may nevertheless contact us at [email protected]. Where appropriate, we will assist the relevant customer or direct the request to the appropriate party.

We process the information required to create, authenticate, secure, and administer QRCodeKIT accounts.

Users are responsible for protecting their credentials and should not send passwords, authentication tokens, or other account secrets through ordinary support messages or email.

We use Google Identity Services, including Google One Tap, where available, to support Google-based registration and authentication.

If you choose this option, Google authenticates your Google account and provides QRCodeKIT with information made available through the sign-in process, such as your account identifier, name, email address, and related profile information.

QRCodeKIT does not receive your Google account password through this process.

Google separately processes information in accordance with its own terms and privacy practices.

If you join an organization or team account, authorized administrators may manage your membership, role, permissions, and access to the organization’s QR codes, content, and related account information.

An organization may retain information associated with its account even after an individual team member no longer has access.

We use Stripe for subscription and payment functionality.

Payment information entered through Stripe payment interfaces is processed by Stripe. QRCodeKIT receives transaction, subscription, billing, payment-status, and related information needed to administer the transaction and customer relationship.

Stripe may separately process information for payment, fraud-prevention, legal, financial, and security purposes under its own privacy practices.

We process information provided through contact forms, support requests, chat, surveys, feedback, and other communications.

External providers help us manage communications, support requests, and feedback. A CRM provider supports our website chat widget. Website form submissions are handled separately and do not use that CRM integration.

Contacting us for support or requesting information does not, by itself, constitute consent to unrelated marketing.

You may unsubscribe from marketing communications using the unsubscribe mechanism in the relevant message or by contacting us.

Service, account, transaction, security, and other non-marketing communications may continue where necessary.

10. Analytics, Performance, Advertising, and External Content

We use third-party services to operate, protect, analyze, and improve the Services and to support marketing and attribution activities.

Services we use for analytics or product measurement include technologies provided by providers such as:

  • Google Analytics;
  • HubSpot; and
  • PostHog.

These services may process online identifiers, browser and device information, pages or features accessed, events, referral information, and related usage information.

PostHog may also be used for session replay and product analysis to help us understand application usage, diagnose problems, and improve usability.

Optional analytics and similar tracking technologies are subject to applicable privacy choices and consent requirements.

We use services such as Sentry and New Relic to identify technical errors, monitor performance, troubleshoot failures, and improve the reliability of our Services.

These services may process technical information associated with requests, devices, browsers, errors, and application activity.

We use advertising and attribution services to understand how users reach QRCodeKIT, measure advertising campaigns, record conversions, and support advertising and remarketing where permitted.

Providers used for these purposes may include:

  • Google Ads;
  • Meta;
  • LinkedIn;
  • Microsoft Advertising;
  • Reddit;
  • G2; and
  • HubSpot.

Depending on the technology and interaction, these providers may receive browser or device information, identifiers, referral or campaign information, page or service interactions, conversion information, and other information associated with the relevant advertising or attribution activity.

Not every provider operates on every QRCodeKIT page or application, and the information received by each provider depends on the relevant integration.

Certain advertising activities may be considered a “sale,” “sharing,” or processing for targeted advertising under some U.S. privacy laws. Where applicable, the rights described in Section 17 apply.

We may use first-party attribution information, including referral and campaign parameters, to understand how registrations and customer activity are associated with marketing campaigns or referral sources.

We may use OpenAI attribution technology associated with the ChatGPT integration for attribution and measurement purposes.

This attribution functionality is separate from the QRCodeKIT MCP connector and from the QR-management operations performed through that connector.

We use infrastructure and network service providers, including Amazon Web Services and Cloudflare, to host, deliver, secure, and operate different parts of the Services.

These providers may process network requests, IP addresses, technical metadata, hosted information, and other information necessary to provide their services.

The QRCodeKIT platform is hosted in the European Union. Certain Personal Data may be accessed or otherwise processed outside the EU, including in the United States, and external service providers may also store it outside the EU, as described in Section 14.

10.7 Embedded and external content

Our websites may include content or functionality supplied by third parties, including services such as:

  • Trustpilot;
  • YouTube;
  • Google Maps; and
  • externally delivered fonts, icons, or other website resources.

When third-party content is loaded, the relevant provider may receive technical information associated with the request.

Where appropriate, optional content may be subject to consent or other privacy controls.

QRCodeKIT offers features that interact with external AI platforms and customer-configured automated assistants.

Different AI-related features are separate processing activities.

An authorized connector allows an external platform to request specified actions involving a QRCodeKIT account.

Authorization is provided through the applicable connection process and does not require QRCodeKIT to receive the password for the user’s external AI-platform account.

QRCodeKIT receives the information transmitted to it through the connector for the requested action. Relevant QRCodeKIT information or results may then be returned to the external platform so that it can complete the user’s request.

Users should connect only accounts they are authorized to use and should consider whether information submitted through an integration contains Personal Data or confidential information belonging to another person.

QRCodeKIT offers a connector for use with Anthropic's Claude AI platform via the Model Context Protocol (MCP). When a user interacts with QRCodeKIT through this connector, data submitted through the integration, including QR code content, configuration options, and associated metadata, may be processed to create, list, update, render, and delete QR codes in the user's QRCodeKIT account. The Personal Data processed through this connector includes Usage Data and data communicated while using the service. No additional Personal Data is collected beyond what is described in this Privacy Policy. All data processed through the Claude MCP Connector is subject to the same collection, usage, retention, and sharing practices outlined in this Privacy Policy. Users may exercise their rights regarding such data by contacting us using the contact details provided in this document.

QRCodeKIT offers a connector for use with ChatGPT and OpenAI’s Apps SDK via the Model Context Protocol (MCP). When a user interacts with QRCodeKIT through this connector, data submitted through the integration may be processed to create, list, update, render, manage, delete, and retrieve QR codes and related statistics in the user’s QRCodeKIT account. The Personal Data processed through this connector may include Usage Data and data communicated while using the service, including QR code titles, destination URLs, phone numbers, email recipients, email subjects, app store URLs, HTML page content, scan totals, QR code configuration options, and associated metadata, depending on the type of QR code created or managed by the user. This data may be transmitted to and processed by OpenAI as the provider of ChatGPT and the OpenAI Apps SDK in order to enable the integration and respond to the user’s requests. No additional Personal Data is intentionally collected through this connector beyond what is necessary to provide the integration and what is otherwise described in this Privacy Policy. All data processed through the ChatGPT Apps / OpenAI Apps SDK Connector is subject to the same collection, usage, retention, sharing, and user rights practices outlined in this Privacy Policy. Users may exercise their rights regarding such data by contacting us using the contact details provided in this document.

OpenAI, Anthropic, and other external platforms may separately process information received through their services under the terms, privacy notices, settings, and account arrangements applicable to the relevant user.

Their independent processing is governed by their own privacy practices.

Disconnecting an integration prevents subsequent use of that authorization but does not necessarily delete information previously transmitted to the external platform.

QRCodeKIT may provide customer-configured automated assistant functionality, including Cleo, through QR-linked experiences.

Depending on the customer’s configuration and the user’s interaction, this may involve:

  • questions or instructions submitted by the user;
  • customer-provided reference content;
  • generated responses; and
  • related technical information.

Users should avoid submitting unnecessary sensitive or confidential information through automated assistants.

Customers are responsible for the purposes for which they configure and use these features and for complying with applicable privacy requirements relating to the processing they control.

We may disclose Personal Data to the following categories of recipients where appropriate for the purposes described in this Policy.

We use service providers for functions such as:

  • cloud hosting and infrastructure;
  • network delivery and security;
  • authentication;
  • payment processing;
  • communications and support;
  • analytics;
  • performance and error monitoring;
  • advertising and attribution; and
  • integration functionality.

These providers receive information reasonably necessary to perform the relevant service.

Information may be available to QRCodeKIT customers, account administrators, or authorized team members according to the relevant account structure, feature, and permissions.

When a user connects an external service or requests an integration action, information necessary for that integration may be transmitted to the selected provider.

Where permitted, information may be disclosed to advertising and attribution providers for measurement, attribution, advertising, and remarketing activities.

We may disclose information to legal, accounting, financial, insurance, security, and other professional advisers where reasonably necessary.

We may disclose information where required or permitted by applicable law, legal process, court order, regulatory request, or other lawful authority, or where reasonably necessary to protect our rights, users, Services, or other persons.

Personal Data may be disclosed or transferred in connection with an actual or proposed merger, acquisition, financing, reorganization, sale of assets, or similar corporate transaction, subject to applicable legal requirements.

Where a customer publishes information, selects a QR destination, connects an integration, or otherwise instructs us to make information available, the information may be disclosed to the selected recipient or people who access that content.

QRCodeKIT uses cookies, local storage, pixels, scripts, and similar technologies for purposes such as:

  • authentication;
  • security;
  • preferences;
  • analytics;
  • product measurement;
  • support functionality;
  • attribution;
  • advertising; and
  • embedded third-party content.

Some technologies are necessary to provide requested functionality. Others are optional and may require consent under applicable law.

Further information about the technologies used, their purposes, and available controls is provided in our Cookie Policy.

Where available, you may review or change applicable tracking preferences through the Cookie settings control provided on our website.

Withdrawing consent applies to future processing based on that consent and does not affect the lawfulness of processing carried out before withdrawal.

Cookie and privacy choices may depend on the browser, device, domain, and technology involved. A choice stored on one device or domain may not automatically apply to another.

QRCodeKIT is operated by a U.S. company and works with service providers and technology platforms that operate internationally.

As a result, Personal Data may be processed in the United States, the European Economic Area, and other countries in which QRCodeKIT or its service providers operate.

Where applicable data protection law restricts international transfers, we use an available lawful transfer mechanism or safeguard appropriate to the transfer. These may include:

  • an applicable adequacy decision;
  • approved contractual safeguards;
  • an applicable data-transfer framework; or
  • another mechanism permitted by law.

You may contact [email protected] for additional information about safeguards applicable to your Personal Data where you are legally entitled to receive that information.

We retain Personal Data for as long as reasonably necessary for the purposes for which it was collected or otherwise processed, taking into account:

  • the duration of the customer or user relationship;
  • the relevant feature or Service;
  • customer deletion instructions where we act on a customer’s behalf;
  • account and recovery functionality;
  • security and fraud-prevention needs;
  • financial, tax, and accounting requirements;
  • applicable legal obligations;
  • limitation periods and legal claims; and
  • the need to document privacy requests and preferences.

For example:

  • account and organization information is generally retained while needed to provide and administer the account and for appropriate periods thereafter where required for legal, security, financial, or dispute-related purposes;
  • Customer Content and QR configurations are retained in accordance with the relevant Service, customer instructions, deletion functionality, and applicable legal requirements;
  • transaction and invoice information may be retained for applicable accounting, financial, tax, and legal periods;
  • support and communication records may be retained as reasonably necessary to resolve requests and maintain relevant customer history;
  • analytics, diagnostic, and security information is retained according to the purpose for which it is processed;
  • authorization information for integrations may be retained while the connection remains active and for limited operational or security purposes thereafter;
  • marketing suppression information may be retained to ensure that an opt-out continues to be respected; and
  • backups may remain for a limited period under standard backup and recovery processes after information has been removed from active systems.

Personal Data relating to abuse reports, including associated correspondence and supporting materials, is retained for up to 12 months from receipt of the report and deleted sooner when no longer needed. Longer retention is limited to information necessary to comply with applicable legal obligations or to establish, exercise, or defend legal claims; that information is deleted when it is no longer required for those purposes.

We may retain information for longer where required by law, legal process, a valid legal hold, or the establishment, exercise, or defense of legal claims.

Where information is effectively anonymized so that it is no longer Personal Data under applicable law, it may be retained and used in anonymized form.

Third parties that independently control information they receive may apply their own retention periods.

We use technical and organizational measures designed to protect Personal Data against unauthorized access, loss, misuse, alteration, and disclosure.

These measures include controls relating to authentication, authorization, infrastructure security, monitoring, and access management as appropriate to the Services.

Customers and users are also responsible for protecting their credentials, managing account permissions, securing integration access, and considering the information they publish through QR codes or publicly accessible content.

No method of electronic transmission, processing, or storage can guarantee absolute security.

If you believe that your QRCodeKIT account or Personal Data may have been affected by a security issue, contact us at:

[email protected], [email protected] or [email protected].

Depending on where you live and the law applicable to your Personal Data, you may have rights relating to our processing.

These may include rights to:

  • obtain confirmation that we process your Personal Data;
  • access Personal Data we hold about you;
  • correct inaccurate information;
  • request deletion;
  • request restriction of processing;
  • object to certain processing;
  • receive certain Personal Data in a portable format;
  • withdraw consent;
  • object to direct marketing;
  • opt out of certain advertising-related processing;
  • obtain information about recipients of your Personal Data;
  • appeal certain decisions concerning a privacy request; and
  • lodge a complaint with a competent regulator.

These rights are subject to the conditions, limitations, and exceptions provided by applicable law.

You may submit a privacy request by contacting:

[email protected]

Please provide enough information for us to understand and locate the relevant processing.

We may request information reasonably necessary to verify a request where verification is appropriate and legally permitted.

Authorized agents may submit requests where permitted by applicable law, subject to any lawful verification of their authority.

Where QRCodeKIT processes Personal Data on behalf of a customer, we may direct the request to the relevant customer or assist that customer in responding.

We respond to privacy requests within the time required by applicable law.

You may object to or unsubscribe from direct marketing at any time.

Where required by applicable law, we will stop processing your Personal Data for that direct-marketing purpose.

Where applicable law provides a right to opt out of the sale or sharing of Personal Data, targeted advertising, or similar advertising-related processing, you may submit a request to:

[email protected]

You may identify the request as:

“Do not sell or share my personal information” or “Opt out of targeted advertising.”

Where applicable law requires us to recognize a legally valid opt-out preference signal, we will process it in accordance with that law.

Where the EU General Data Protection Regulation applies, you may have rights to:

  • access your Personal Data;
  • correct inaccurate or incomplete Personal Data;
  • request erasure;
  • restrict processing;
  • object to processing based on legitimate interests;
  • object at any time to direct marketing;
  • receive applicable Personal Data in a structured, commonly used, machine-readable format;
  • withdraw consent at any time where processing relies on consent; and
  • lodge a complaint with a competent supervisory authority.

The right to erasure and other rights are subject to the conditions and exceptions established by law, including where information must be retained for a legal obligation or legal claim.

Where applicable law provides rights concerning decisions based solely on automated processing that produce legal or similarly significant effects, the legally required information and safeguards will apply.

You may lodge a complaint with the data protection authority competent for your habitual residence, place of work, or the place of an alleged infringement.

Where UK data protection law applies, you may have rights including:

  • access;
  • correction;
  • erasure;
  • restriction;
  • portability;
  • objection;
  • withdrawal of consent; and
  • objection to direct marketing.

You may also submit a complaint to the UK Information Commissioner’s Office or exercise any other remedy available under applicable law.

Various U.S. state privacy laws may provide eligible residents with rights concerning their Personal Information.

The law and rights applicable to a particular person depend on factors such as the state of residence, the relationship with QRCodeKIT, applicable statutory thresholds, and available exemptions.

Depending on applicable law, rights may include:

  • confirmation of processing;
  • access;
  • correction;
  • deletion;
  • portability;
  • opting out of sale;
  • opting out of sharing for cross-context behavioral advertising;
  • opting out of targeted advertising;
  • opting out of certain profiling;
  • limiting certain uses or disclosures of sensitive Personal Information;
  • obtaining information about third-party disclosures where required by law; and
  • appealing certain denials of privacy requests.

You have the right not to be unlawfully discriminated against for exercising applicable privacy rights.

Depending on how you interact with QRCodeKIT, the categories of Personal Information we process may include:

  • identifiers, such as names, email addresses, account identifiers, IP addresses, and online identifiers;
  • customer-record information and contact information;
  • commercial information, including subscriptions and transactions;
  • internet or electronic network activity information;
  • approximate location information associated with service or scan activity;
  • professional or organization-related information;
  • electronic communications and Customer Content;
  • information generated from service, analytics, or attribution activity; and
  • sensitive Personal Information where it is included in information submitted through an applicable feature.

These categories are obtained from the sources described in Section 5 and are used for the purposes described in Sections 6 through 11.

They may be disclosed to the recipient categories described in Section 12.

Certain advertising or attribution activities may be treated as “sharing,” “sale,” or targeted advertising under applicable U.S. privacy laws. The legal characterization depends on the applicable law and the particular processing activity.

Where an applicable opt-out right exists, you may exercise it using the methods described in Section 17.

The retention criteria described in Section 15 apply to these categories of Personal Information.

QRCodeKIT does not require sensitive Personal Information as a general condition of using the Services.

However, users or customers may choose to include information that is considered sensitive under applicable law in Customer Content, communications, authentication information, or other supported features.

Where applicable law provides specific rights concerning sensitive Personal Information, those rights apply according to the relevant statutory conditions.

Where Swiss data protection law applies, you may have rights to obtain information concerning our processing of your Personal Data, request correction, and exercise other rights provided by applicable Swiss law.

Where applicable, you may also have rights concerning data portability and automated individual decisions.

You may contact the Swiss Federal Data Protection and Information Commissioner or exercise any other remedy available under Swiss law.

Where Brazil’s Lei Geral de Proteção de Dados Pessoais, or LGPD, applies, you may have rights including:

  • confirmation of processing;
  • access;
  • correction;
  • anonymization, blocking, or deletion of information processed contrary to applicable requirements;
  • portability as provided by law;
  • information about entities with which Personal Data is shared;
  • information regarding consent;
  • withdrawal of consent;
  • deletion of information processed on the basis of consent, subject to applicable exceptions;
  • objection where provided by law; and
  • rights concerning certain automated processing.

You may submit requests through [email protected].

You may also exercise rights available before Brazil’s competent data protection authority.

QRCodeKIT’s Terms and Conditions establish the eligibility requirements for creating an account.

QRCodeKIT accounts are not offered to children under 14. Individuals aged 14 through 17 must have the parental or guardian permission required under our Terms and applicable law.

These account requirements do not mean that every person who scans a QR code is an account holder. QR codes may be accessed without creating a QRCodeKIT account.

Customers using QRCodeKIT to provide content or services to children are responsible for evaluating and complying with the privacy requirements applicable to the processing they control.

If you are a parent or guardian and believe that a child’s Personal Data has been processed through QRCodeKIT in a manner that should be reviewed or deleted, contact:

[email protected]

Please provide sufficient information to identify the relevant account, QR code, or interaction without unnecessarily including sensitive information.

QR codes, hosted pages, integrations, advertisements, and other features may link to websites, applications, or services operated by customers or other third parties.

Those third parties may collect and process Personal Data independently.

QRCodeKIT does not control the privacy practices of independent third-party destinations, and this Privacy Policy does not replace their own privacy notices.

You should review the privacy information provided by a third-party service before submitting Personal Data to it.

We may update this Privacy Policy from time to time to reflect changes to our Services, processing activities, business practices, or applicable legal requirements.

The “Last updated” date at the top of this Policy identifies the current version.

Where applicable law requires additional notice or consent for a change in processing, we will provide that notice or obtain that consent as required.

Continued use of the Services does not, by itself, constitute consent to processing for which applicable law requires a separate consent.

For questions about this Privacy Policy, our processing of Personal Data, or the exercise of privacy rights, contact:

MOBILE LEAVES CORP, 874 Walker Road, Ste. C, Dover, Delaware 19904, United States

Privacy: [email protected]

Support: [email protected]

Back to top ↑