Privacy policy
Effective 20 October 2026
QRForever (https://qrforever.wouldairecommend.workers.dev) is run by SupaDesign, operated by Darren Buckley, a sole trader based in Cobh, Co. Cork, Ireland ("we", "us"). We are the data controller for account data. This policy explains what we collect, why, and your rights under the GDPR.
What we collect
- Static QR codes are generated in your browser. What you type for a static code is not sent to us.
- Dynamic QR codes: the destination URL, the name you give the code, and its settings.
- Scan counts: date, country (from Cloudflare), device type (mobile/desktop/tablet) and operating system family. No IP addresses, cookies or identities of the people who scan are stored.
- Account data if you sign up: email address, plan, and your codes.
We do not sell personal data, we do not run advertising trackers, and our page analytics are aggregate counters (page path, day, referring site) with no cookies, no IP storage and no fingerprinting.
Why we use it (legal bases)
- To provide the service you signed up for (contract, Art. 6(1)(b) GDPR).
- To keep it secure and prevent abuse, e.g. rate limits and spam filtering (legitimate interests, Art. 6(1)(f)).
- To bill paid plans and keep tax records (contract and legal obligation, Art. 6(1)(b) and (c)).
- Service emails such as sign-in links, alerts you configured and billing notices (contract). We do not send marketing email without your opt-in.
Who processes data for us
| Provider | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Hosting, database (D1, EU jurisdiction), content delivery, DDoS protection | Data stored in the EU; served from Cloudflare edge worldwide |
| Stripe Payments Europe, Ltd. | Card payments and invoices for paid plans (we never see card numbers) | Ireland / United States |
| Resend, Inc. (only once email is switched on) | Sending sign-in links and notification emails | United States |
Where a provider processes data outside the EEA, transfers rely on the EU-U.S. Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.
How long we keep it
- Dynamic codes: kept and redirecting until you delete them or your account (also after you cancel a paid plan).
- Scan counts: up to 24 months, shown according to your plan.
- Billing records: 6 years (Irish tax law).
Cookies
We set one strictly necessary cookie when you sign in (a session identifier, 30 days). No consent banner is needed because we use no analytics or advertising cookies.
Your rights
You can access, correct, export or delete your data, object to processing, or restrict it. Most of this is self-serve in the app (export and delete account); otherwise email hello@wouldairecommend.com and we will reply within 30 days. You can also complain to the Data Protection Commission (Ireland), dataprotection.ie, or your local authority.
Changes
We will post changes here and, for material changes, email account holders at least 30 days before they apply.
Contact
SupaDesign, operated by Darren Buckley, Cobh, Co. Cork, Ireland · hello@wouldairecommend.com