Privacy Policy

1. Who we are

Fitch Technologies LLC, Boulevard Plaza, Tower 1, Downtown Dubai, Dubai, United Arab Emirates, is the controller of the personal data described in this policy, except where we say we act as a processor for our customers. Contact us about privacy at customercare@fitchtechnologies.com.

We follow the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL) and, where it applies to you, the EU and UK General Data Protection Regulation (GDPR).

2. The free generator

The free generator makes QR codes in your browser. The content you encode, such as links, Wi-Fi passwords or contact details, is not sent to our servers or stored by us, and the public generator pages set no cookies.

3. What we collect

• Account details: your name, email address and sign-in method, handled through our authentication provider, Clerk.
• Billing details: your billing name, address and tax ID, and the fact and amount of payments. Card details go directly to Stripe; we never see or store them.
• Your content: code destinations, hosted pages, uploaded images and files, and settings. We remove location and camera metadata from images you upload.
• Scan analytics: when someone scans a dynamic code, we record the time, the country and city (from the network), the device type, and the referring website's domain. We do not store the scanner's IP address or full browser details: the redirect service turns them into one-way hashes that change every day, used only to count unique scans and filter out bots.
• Form submissions on hosted pages, which we process for the page owner (see below).
• Security and service logs, such as sign-in attempts, rate-limit counters and records of changes made in your account.

4. How we use it and why

• To provide the Service under our contract with you: running your account, codes, pages and analytics.
• To take payments and meet tax and accounting obligations (legal obligation).
• To keep the Service and its users safe: checking links against Google Web Risk, detecting abuse, rate limiting and handling reports (our legitimate interests, and legal obligations).
• To send you service messages, such as receipts, security notices and changes to our terms (contract and legitimate interests). We do not send marketing email without your consent.

We do not sell personal data, and we do not use your content or your visitors' data for advertising.

5. When we act for you

For data your hosted pages collect from visitors, and for the scan analytics of your codes, you decide the purposes and we process the data on your behalf. You are responsible for having a lawful basis and giving your visitors the notices they need. We use that data only to provide the Service to you.

Retargeting pixels you add are run by their providers, Meta, Google and TikTok, who act for you or on their own account under their terms, not for us. See our Cookie Notice.

6. Who we share it with

We use these service providers to run the Service. They process data only on our instructions:

• Vercel (application hosting)
• Cloudflare (the qrgopro.com redirect service, storage of hosted pages and files, and custom domains)
• Neon (database)
• Upstash (rate limiting and queues)
• Clerk (sign-in)
• Stripe (payments and tax)
• Google Web Risk (checking links for phishing and malware)

We may also disclose data where the law requires it, to protect people from harm, or as part of a sale or reorganisation of our business, subject to this policy.

7. International transfers

Our providers may process data outside the UAE, including in the European Union and the United States. Where the PDPL or the GDPR requires it, we rely on adequacy decisions or on contractual safeguards such as standard contractual clauses.

8. How long we keep it

• Individual scan records: 90 days. Daily scan totals: 12 months, plus an all-time scan count per code.
• Account and content data: while your account is open, then deleted or anonymised within 90 days of closure, except where we must keep it longer.
• Billing records: as long as tax law requires, currently up to 5 years in the UAE.
• Audit and security records: up to 2 years.

9. Your rights

Depending on where you live, you may ask to access, correct, delete or receive a copy of your personal data, to restrict or object to how we use it, and to withdraw consent. Email customercare@fitchtechnologies.com. We reply within 30 days and may need to confirm your identity.

If you scanned or visited something a customer of ours published, please contact that customer first; we will help them respond.

You may complain to the UAE Data Office or, if the GDPR applies to you, to your local data protection authority.

10. Security

We use encryption in transit, access controls, hashed passwords for protected codes, hashed API keys and regular reviews to protect data. No system is perfectly secure; we will notify you and the authorities of a personal data breach where the law requires.

11. Children

The Service is not for children, and accounts are for adults only. We do not knowingly collect children's data.

12. Changes

We will post updates here and tell account holders about significant changes by email or in the dashboard.