> Privacy & Cookie Notice

This notice explains how NiceQR.me collects, uses, shares, and retains personal data when you browse the site, sign in, create QR codes, buy a plan or design, or use public QR/check-in flows.

For users in the EEA, UK, and Switzerland, we rely on consent for optional browser telemetry and on contract, legal obligations, or legitimate interests for the rest of the service operations.

For applicable U.S. state privacy laws, we do not sell personal information for money and we do not switch on optional browser telemetry until you accept it.

Depending on how you use the product, we may collect:

• Account and profile data, such as your name, email address, avatar, authentication status, subscription records, and team membership. • QR and design data, such as payloads, templates, styling choices, uploaded assets, generated files, and related metadata. • Product and scan analytics, such as QR scan timestamps, country, browser, device type, referrer, and aggregated usage metrics used in dashboards. • Event check-in data, such as guest name, notes, session identifier, and location/network fields including country, region, city, ASN, and network organization when check-in analytics or anti-fraud flows use them. • Payment and purchase records, such as checkout intent data, provider, transaction identifiers, support/billing metadata, and purchase analytics events. • Technical and security data, such as request metadata, abuse-prevention signals, diagnostics, and server-side error traces.

We use data to provide and secure the service, authenticate users, generate QR assets, keep purchases attached to the right account, render analytics dashboards, prevent fraud and abuse, send operational emails, support customers, and comply with legal obligations.

With optional analytics consent, we use browser error/performance monitoring and first-party editor purchase journey measurement. The latter links random intent IDs and stage timestamps to purchase attempts; it adds no email, QR configuration or IP fields. Reports represent the opted-in sample, not all visitors. No marketing or cross-device identity is introduced.

Optional tracking stays off without consent. Refusing it does not prevent checkout. This expanded purpose requires a new consent choice, rather than reusing earlier Sentry-only consent.

NiceQR.me uses cookies and local browser storage.

• Strictly necessary items help keep sign-in, secure public check-in flows, cookie choices, and requested product behaviors working. • Current first-party auth/check-in cookies can include items such as `niceqr_token`, `niceqr_refresh`, and `checkin_sid` when those features are used. • Local browser storage can be used for theme preference, cookie preferences, banner dismissal state, studio drafts, and duplicate-submission protection on public check-in pages. • Optional browser telemetry for error/performance monitoring and first-party editor purchase journey measurement stays off until you choose “Accept all”. Journey state uses session storage, expires after seven days, and is removed when the app next reads expired state or you withdraw consent.

You can change your choice at any time from the Cookie settings link in the footer.

We share data only when needed to operate the service, fulfill your request or comply with law, including infrastructure, email, authentication, monitoring and payment partners. Google sign-in and LemonSqueezy/PayOS checkout use the relevant provider’s privacy terms. NiceQR does not store full payment card numbers.

If the planned contribution/reward program is enabled and you use it, we may process version, provenance, agreement and review records, reward/ledger history, recipient email, selected PayPal or Payoneer method, verification and transfer references. Only information necessary for an authorized manual payout is shared with the selected payout service under its privacy terms. These planned operational records are not optional analytics, require no provider passwords or OTPs, and do not mean payouts are already active. Restricted access, encryption, masked display and audited reveal are required before launch.

We keep account, design, purchase, and required operational data for as long as needed to provide the service, maintain records, resolve disputes, and meet legal obligations.

Optional editor purchase journey IDs expire in browser session storage after seven days. New journey signals and purchase associations are retained on the server for at most 90 days; automatic cleanup starts at 89 days to leave scheduling headroom. These analytics contain no added email, QR configuration or IP fields.

Withdrawing consent stops new journey tracking, clears the current browser journey and requests deletion of its server signals and purchase links. If that request cannot reach the server, normal retention still applies. Earlier anonymous journeys also expire under retention. This does not delete payment records or change retention of pre-existing operational analytics.

Other browser-only items remain until cleared, replaced or removed by the app. Check-in automation anonymizes older network/device data after about 90 days; temporary check-in export files are cleaned up after about 72 hours. Aggregated or de-identified statistics may be retained for reporting.

Depending on where you live, you may have rights to access, correct, delete, export, restrict, or object to certain processing, and to withdraw consent for optional telemetry.

If you are in the EEA/UK/Switzerland, you may also complain to your local supervisory authority. If you are covered by applicable U.S. state privacy laws, you may request disclosure, correction, deletion, or portability subject to legal exceptions.

Where available inside the product, deleting your NiceQR.me account starts removal of related account data subject to backups, fraud-prevention, and legal retention needs.

We use HTTPS, access controls, hashed passwords, rate-limiting, monitoring, and other technical and organizational safeguards designed to protect personal data.

No system is completely risk free, so you should also protect your device, use strong passwords, and sign out of shared computers when appropriate.

We may update this notice when product flows, vendors, or legal requirements change. Material changes take effect when posted, and we may provide an additional in-product or email notice when appropriate.

If you have a privacy request or question, contact us at: