Privacy Policy

1. Who we are

EventQR (“we”, “us”, or “our”) is operated by Kurabyte (a Georgian company) and provides the EventQR platform — a professional QR code service built for event organizers. Our data controller is Kurabyte, Georgia. Our registered address is available on request at [email protected].

2. What data we collect

Account data

When you create an account we collect your email address. Optionally, you may provide your name and company. You sign in with a password, which we store only as a salted hash (bcrypt), or with Google, in which case we receive and keep only your verified email address and name. For account security and fraud prevention we also keep the IP address and approximate country (derived from that IP) of your sign-up and of your most recent sign-in.

QR code and scan data

We store the destination URLs you configure and, for each scan, the timestamp, approximate country (derived from IP), and device type (derived from user-agent). We do not store the raw IP address of the end scanner beyond the geo-lookup.

Enterprise lead data

If you submit the contact form we store your name, company, work email, role, and the message you send. We use this solely to respond to your enquiry.

Usage and technical data

We collect standard web-server logs (request path, status code, response time) for security monitoring and debugging. Logs are retained for 30 days.

3. How we use your data

• To provide and improve the EventQR service
• To send account and service emails, such as email verification, password reset, team invites, welcome emails, usage alerts and weekly scan summaries
• To display scan analytics to you on your dashboard
• To respond to sales and support enquiries
• To detect and prevent fraud or abuse
• To comply with legal obligations

We do not sell your personal data. We do not use your data for advertising.

4. Legal basis for processing (GDPR)

For users in the European Economic Area, we process your data under the following bases:

• Contract performance — to provide the service you signed up for
• Legitimate interests — security monitoring, fraud prevention, service improvement
• Legal obligation — where required by applicable law
• Consent — where you have expressly opted in (e.g., marketing communications)

5. Data sharing

We share data only with the following third parties, for the stated purpose:

• Resend — transactional email delivery (account and service emails)
• Paddle — payment processing and subscription management
• Hetzner — cloud infrastructure (servers located in Germany/Finland)
• Cloudflare — CDN, DDoS protection, and edge redirects

We require all sub-processors to maintain appropriate data protection standards. A full list of sub-processors is available on request.

6. Data retention

We retain account data for as long as your account is active. Scan analytics are retained per your subscription tier (6 months for Organizer, 2 years for Professional+). You may request deletion at any time. On account closure, data is deleted within 30 days unless a longer retention is required by law.

7. Your rights

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion (“right to be forgotten”)
• Object to or restrict processing
• Data portability (receive your data in a machine-readable format)
• Lodge a complaint with your local data protection authority

To exercise any of these rights, email [email protected]. We respond within 30 days.

8. Cookies

We use a single HTTP-only, SameSite=Lax session cookie for authentication. We do not use advertising cookies or third-party tracking cookies. No cookie banner is required.

9. Security

We use HTTPS everywhere, database encryption at rest, and access controls limiting who can view production data. Passwords are stored only as salted hashes; sign-in sessions can be revoked by signing out. We conduct periodic security reviews and will notify you within 72 hours of becoming aware of a breach that affects your data.

10. California residents (CCPA)

If you are a California resident, you have the right to know what personal information we collect, the right to delete it, and the right to opt out of its sale. We do not sell personal information. To make a request, email [email protected].

11. Changes to this policy

We may update this policy from time to time. Material changes will be notified by email or via an in-app banner. Continued use of the service after the effective date constitutes acceptance.

12. Contact

Questions or concerns? Email us at [email protected].