Privacy Policy

BizQR.app is a platform for creating and customizing QR codes. We respect and value the privacy of everyone who visits our website and uses our platform, and only collect and use information in ways that are consistent with your rights and obligations under applicable laws.

This Policy describes how Hypatia Analytics, LLC (“BizQR.app”, “our”, “we”, “us”) collects, uses, and discloses personal information about you when you use our website (https://bizqr.app) (“Site”) and the tools offered on the Site (collectively, “Services”). For personal information you provide to create and manage your account, BizQR.app is the data controller. For information collected when a member of the public scans a QR code created by one of our business customers, our role is described in the Scan Data section below. “You” and “your” means you, the person using the Services.

Please read this Privacy Policy carefully. By using any of our Services, you agree to this Privacy Policy and our collection, use and disclosure of your information as described here. If you disagree with this Privacy Policy, you must stop using our Services.

This Privacy Policy applies to our collection and processing of information about users of the Services, including individuals who access and use the Services on behalf of a business customer. It does not extend to any websites, apps, or destinations operated by third parties, including the destinations that QR codes created through our Services may direct people to. We are not responsible for the privacy or security practices of those third-party destinations.

We collect certain information about you from different sources, as described in this section.

Information you provide us

Some features of the Services require you to directly provide us with information. You may elect not to provide this information, but doing so may prevent you from using certain features.

• Account and contact information. When you create an account, we collect your name, email address, and account password. We may also collect your phone number, business/company name, and mailing address. Depending on your plan, we collect billing information and transaction history — payment card details are entered directly into our payment processor, Stripe, and we do not store your full card number on our own servers.
• QR code content. When you create a QR code, we collect the destination link, text, contact card details, Wi-Fi credentials, or other data you choose to encode, along with any name or label you give the code.
• Custom design uploads. If you upload a logo or image to customize the appearance of a QR code, we store that file to generate and display the customized code.
• Communications information. We collect your name, email address, and other information you provide when you contact us, for example through our support email or contact form.

Information collected automatically

We automatically collect certain information about your interaction with the Services (“Usage Data”), including through cookies and similar technologies (“Tracking Technologies”). This includes device information (device type, operating system, unique device identifiers, IP address), approximate location based on IP address, and other information about your interaction with the Services such as browser type, date and time stamps, and clickstream data.

Scan data

A core feature of BizQR.app is generating QR codes that can be scanned by members of the public. When someone scans a QR code created through our Services, we may collect: the date and time of the scan, the approximate location of the scan (based on IP address), and the device or browser type used to scan. We provide this information to the business or individual who created the QR code as scan analytics (for example, total scans over time and general geography).

With respect to this scan data, we generally act as a service provider processing data on behalf of the business that created the QR code, which controls how the code is used and distributed. We do not attempt to identify the individual scanning the code beyond the technical information above, and we do not sell scan data. If a QR code's destination page independently asks you for personal information, that collection is governed by the privacy policy of that destination, not by us.

Scan data and QR code content are retained for as long as the associated QR code remains active, and are deleted according to the creator's account settings or when the associated account is deleted, consistent with the Timeline section below.

Information from third parties

We may obtain limited information about you from outside sources, including payment processors (to confirm and process your subscription payments) and, if you choose to sign in using a third-party login service, the login provider.

We use your personal information to provide you with our products and services. This includes:

• Providing and managing your account, and your access to and use of our Services.
• Generating, hosting, and serving the QR codes you create, and providing you with scan analytics.
• Providing customer support and responding to communications from you.
• Improving and maintaining our Services, including troubleshooting, testing, and analyzing aggregate usage trends.
• Enhancing the safety and security of our Services, including fraud prevention and abuse detection.
• Complying with applicable legal obligations, enforcing our contractual arrangements and policies, and protecting the Services, our rights, and the rights of our users or others.
• Sending you marketing communications, with your permission or where otherwise permitted by law. You can unsubscribe at any time using the link in our emails or by contacting hypatiaanalytic@gmail.com.

We do not use artificial intelligence or machine learning to process your personal information, and we do not use your content to train any models.

We only disclose your personal information as described in this Privacy Policy. We do not sell your personal information for monetary consideration.

• Vendors and service providers. We contract with third parties who help us provide the Services, including Stripe for payment processing, Google Analytics for understanding how the Services are used, and other providers for cloud hosting and storage, customer support tools, and email delivery. These providers are bound by contractual obligations to protect your information, and only receive the information they need to perform their function (for example, Stripe receives billing and payment information to process your transactions, and Google Analytics receives Usage Data as described in the Cookies section below).
• QR code creators. If you scan a QR code created by a BizQR.app business customer, the scan data described above is shared with that business as scan analytics.
• With direction or consent. We may disclose information to third parties when you request, direct, or consent to us doing so.
• Affiliates. We may disclose information to our affiliates or others within our corporate group.
• Legal reasons. We may share information where required to comply with applicable law, a court order, or a governmental authority, or to protect the rights, property, or safety of BizQR.app, our users, or others.
• Business transfers. If we are involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction. We will notify you in advance of any such transfer that affects your personal information.

The Site uses first-party and third-party Tracking Technologies, including Google Analytics, to understand how the Services are used — for example, which pages are visited and how long you spend on them. Google processes this information under its own privacy policy and may combine it with data from other sites it services. You can opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on, or by adjusting your cookie preferences. Most browsers also accept cookies automatically, but you can control or disable cookies through your browser settings. Disabling cookies may cause some features to work incorrectly.

We keep your personal information only as long as needed to provide the Services described in this Policy, or as long as we have your permission to keep it. If you request deletion of your information, we aim to complete that deletion within 24 hours, unless we are required or permitted to retain it under applicable law.

We maintain physical, electronic, and administrative safeguards designed to protect personal information collected through our Site. No method of transmission over the internet is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential and should contact us immediately if you believe your account has been compromised.

If we become aware of a security incident that compromises your personal data, we will investigate promptly and notify affected users and, where required, relevant regulators without undue delay and in accordance with applicable law (for example, within 72 hours of becoming aware under the GDPR, or within the timeframe required under applicable U.S. state breach notification laws).

Depending on where you live, you may have rights under laws such as the EU/UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), the Maryland Online Data Privacy Act (MODPA), and other U.S. state privacy laws (including but not limited to Colorado, Connecticut, Virginia, Utah, and similar laws taking effect in additional states). Subject to applicable law, you have the right to:

• Access the personal data we hold about you, how we use it, and who we share it with.
• Delete personal data we hold about you.
• Correct inaccurate personal data we maintain about you.
• Opt out of targeted advertising and of the “sale” or “sharing” of personal data. We do not sell personal information for money.
• Port your personal data to another service.
• Restrict our processing of your personal data to storage only.
• Object to our processing of your personal data, including opting out of marketing at any time.
• Withdraw consent, where we rely on consent to process your information.
• Appeal a denied privacy request and designate an authorized agent to submit a request on your behalf.

If your request relates to scan data collected from a QR code created by another business, please also contact that business directly, since it generally controls how that code and its analytics are used; we will assist and forward your request where required by law.

We honor recognized universal opt-out signals, including the Global Privacy Control (GPC), for browsers that support it. We will not discriminate against you for exercising any of these rights. To submit a request, contact us using the details in the Contact section below. We will verify your identity before processing your request and respond within the time required by applicable law (generally 45 days, extendable as permitted by law).

Additional protections under Maryland law

Hypatia Analytics, LLC is based in Maryland, and MODPA applies a stricter baseline than many other state privacy laws. Consistent with MODPA, we:

• Collect only the personal data reasonably necessary and proportionate to provide the features you request (data minimization).
• Do not sell sensitive personal data (such as precise location or health information), regardless of any opt-out choice — this is a general prohibition, not an opt-out.
• Do not sell personal data or use it for targeted advertising for any user we know to be under 18 years old.

Our Services are not intended for minors under the age of 18, and we do not knowingly collect personal information from children under 13. If you are a parent or guardian of a child under 13 who has provided us with personal information, please contact us at hypatiaanalytic@gmail.com. If we become aware that we have unknowingly collected personal information from a child under 13, we take steps to remove that information from our servers.

QR codes generated using our Services may direct people to third-party websites, apps, or content chosen by the business or individual who created the code. We do not control, and are not responsible for, the content or privacy practices of those destinations. If you are the creator of a QR code, you are responsible for ensuring the destination content complies with applicable law and does not violate the rights of others.

This section provides additional information to residents of U.S. states with comprehensive consumer privacy laws. The following table sets out the categories of personal information we collect and disclose, if applicable:

• Identifiers (name, contact information, IP address, device identifiers) — disclosed to vendors and service providers, with your direction or consent, and to our affiliates.
• Internet or network activity information (interactions with the Services, QR code content and scan data) — disclosed to vendors and service providers, to QR code creators (scan data only), and to our affiliates.
• Geolocation information (approximate location based on IP address) — disclosed to vendors and service providers, and to our affiliates.
• Commercial information (subscription and transaction history) — disclosed to vendors and service providers.
• Professional-related information (business/company name) — disclosed to vendors and service providers.
• Account access credentials (username and password) — not disclosed except as required to provide the Services.

We do not “sell” or “share” (as those terms are defined under applicable state law) personal information, nor have we done so in the preceding 12 months. We do not have actual knowledge that we sell or share personal information of residents under 18 years of age.

By using our Services, you understand that your personal information may be processed and stored on servers, and transferred to third parties, outside your country of residence, including the United States. Where we transfer personal data out of the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards recognized under applicable law, such as Standard Contractual Clauses.

We may change this Privacy Policy from time to time, in which case we will update the effective date above and post the updated Policy on our Site. If we make material changes to how we use personal information, we will use commercially reasonable efforts to notify you and take additional steps as required by applicable law.

If you have any questions about our Services or this Privacy Policy, please contact us at hypatiaanalytic@gmail.com or at Hypatia Analytics, LLC, 3903 Leland St, Chevy Chase, MD 20815, USA. If you believe we have infringed applicable data privacy laws, you can also complain to your local data protection supervisory authority — though we hope you will contact us first so we can resolve any issue.