Privacy Notice

Who is responsible

The controller is Individual Entrepreneur Konstantin Uvarov (Georgia, identification number 302249118), trading as QRCode Alligator, Georgia, Tbilisi, Chugureti District, Mikheil Tsinamdashvili Street, N 52.

Privacy Officer: Konstantin Uvarov, privacy@qrcode-alligator.com. Use this address for every privacy question and request. Phone: +995 557239311.

We have not appointed a data protection officer. We have not yet appointed a representative in the EU or the UK; we will name them here when we do.

Website visitors

Data you enter to make a QR code in the generator, such as URLs, contact details or Wi-Fi credentials, is processed in your browser and doesn't reach our servers, unless you choose to create a tracked code.

We use Google Analytics to see how the sites are used. It sets cookies with an identifier, which is personal data, and records pages, device and approximate location. In the EU, the EEA, the UK, Canada and countries we can't identify, it runs only if you accept it in the cookie banner, and you can change your choice under "Cookie settings" in the footer. That basis is your consent.

Elsewhere it loads when the page opens, on our legitimate interest in improving the service. You can refuse it under "Cookie settings" in the footer, wherever you are. Both sites share one Google Analytics property, so a visit that moves between them counts as one visit. Details: the Cookie Policy.

Account holders

Signing in needs only an email address. We send a single-use sign-in link through Resend, our email provider, and store your email address and when it was confirmed. You can instead continue with Google: Google then tells us your account’s email address and a fixed account identifier, which we store to recognise you next time. We receive nothing else from your Google account — no name, photo or contacts.

After you sign in we set one cookie, qrt_session, which keeps you signed in for up to 30 days. It is strictly necessary and is used for nothing else. Continuing with Google also sets __Host-qrt_oauth for 10 minutes; it protects the trip to Google and back and is deleted when you return.

We store your links with their destination history, your API keys (as a hash only — a key is shown to you once) and daily scan totals. We also record your agreement to the terms, with its version and date. The basis is our contract with you. An email address is required for an account; without it we can't provide the dashboard.

When you create an account, we also record where you came from: the domain of the website that linked you to us (such as reddit.com) and the campaign tag in the address (utm_source), if there was one. When you go from the generator to the dashboard, the generator passes these along in the link; it keeps them only in the open page, not in a cookie or storage. We use them only in totals, to see which places bring us users. The basis is our legitimate interest. They are deleted with your account.

When you open a paid feature in the dashboard (such as your own domain or team access), we record which one and on which day. On accounts with a business email domain, we also look at how much the account is used (codes, scans, API keys) to decide which accounts to show an Alligator Business offer to inside the dashboard. We don't email you about it unless you have agreed to that. The basis is our legitimate interest in offering our paid plan. We keep these records for 180 days, and they are deleted with your account. You can object at privacy@qrcode-alligator.com.

The service is for people aged 16 or older. If we learn that an account belongs to someone under 16, we close it and delete its data.

People who scan a code

Each scan of a qrgo.page link records the short code, the time, the country, region and city (derived by Cloudflare from the network address), the device type, operating system and browser (derived from the browser’s user agent), and the host name of the referring page if the browser sends one. City is the finest location we record.

The IP address is never stored. To count unique visitors without a cookie, the IP address and user agent are turned into a one-way hash with a key that changes every day (UTC). qrgo.page sets no cookies and loads no scripts.

We and the code's owner are joint controllers of scan data. We handle requests about scan records and keep them secure; the owner is responsible for how it uses the statistics and for telling people that scans are counted. The basis is legitimate interest: ours in running and securing the service, and the owner's in measuring its code. You can object at any time at privacy@qrcode-alligator.com.

People named on a contact card

A contact code carries details its creator entered: names, organisation and job title, phone numbers, email, postal address, website and a note. We send them to anyone who scans the code. The creator must have your agreement or another right to share them, and must tell you. We use them for nothing else.

If your details are on a contact code without your agreement, report it at qrgo.page/report/ followed by the code, or email privacy@qrcode-alligator.com. We remove them within 48 hours of confirming the request, together with earlier versions, and tell the creator.

People who report abuse, and support mail

If you report a code, we store the report, your name and email if you give them, and what you explain. A copyright or personal-data report requires those details; a phishing report can be anonymous. If you send us a copyright notice, your name and what you claim may be sent to the person whose code it concerns, as the law requires.

Email to our support and abuse addresses is handled in our mailbox and on our automation server, which sorts it and alerts us. A person decides every report. The basis is our legitimate interest in answering and resolving it, or a legal duty where the law requires us to act.

Businesses we may contact

We keep a list of businesses from public sources: name, address, website, city and category, and in some cases the name of a person or a public address. We use it to offer our products to businesses. No marketing email is being sent at present. Our basis is legitimate interest. To be removed, write to privacy@qrcode-alligator.com.

Buyers of paid plans

Paid plans aren't on sale yet. When they are, Paddle.com Market Limited (UK) will be the seller and merchant of record. It will collect your payment details and handle payment, invoices, taxes and refunds as an independent controller, under its own privacy notice. We will receive your plan, country and Paddle identifiers, under our contract with you.

Keeping the service safe

Every destination address is checked against Google Safe Browsing when a link is created or changed, and periodically afterwards. This sends the destination address to Google. The same is done with the website on a contact card; its other details are not sent to Google. Creating a link without an account is protected by Cloudflare Turnstile.

To enforce limits and investigate abuse, we keep the daily-rotating hash with rate counters, each link created and each change to a link. The basis is our legitimate interest in keeping the service and the people who scan codes safe.

No decision with legal or similarly significant effects is made by automated means alone. A destination check can block a link automatically when Google reports it as unsafe. You can appeal to abuse@qrcode-alligator.com, and a person decides.

Who receives data, and where

Cloudflare, Inc. (USA): hosting, database, scan analytics, Turnstile. We ask for the database to be held in Eastern Europe, with no guarantee of the location.

Plus Five Five, Inc., trading as Resend (USA): sign-in and service email. Google LLC (USA): Analytics, Safe Browsing, sign-in with Google, and our mailbox. GitHub, Inc. (USA): encrypted database backups.

Contabo Inc. (USA): our automation server, which holds support and abuse email copies, the complaints log, the business list, and, for accounts with a business email domain, the account's email domain, usage and paid features opened.

OpenRouter, Inc. (USA): AI sorting and drafting from text. For incoming email we remove addresses, phone numbers and most names first, but a name can get through. ZeroBounce and Outscraper: checking and finding business contact details.

We do not sell data and do not use it for advertising.

Transfers abroad

We are in Georgia, which has no EU or UK adequacy decision; you send data to us directly, and we apply the GDPR and UK GDPR where they apply to you. Georgia lists EU states and the UK as giving adequate protection. It doesn't list the USA, and we don't yet hold a State Audit Office permit for transfers there.

For the EU and the UK, Cloudflare, Google and Resend receive data under the EU-US Data Privacy Framework and its UK Extension. OpenRouter isn't on that framework. OpenRouter receives data under its data processing agreement, which includes standard contractual clauses and the UK Addendum. We haven't confirmed a transfer safeguard for our automation server in the USA. Ask us about any of this at privacy@qrcode-alligator.com.

How long we keep data

Individual scan records: up to 3 months. Daily totals per link: for as long as the link exists.

Rate counters: 2 days. Unused sign-in links: 1 day. A daily sweep does the deleting, so a row can outlive those by up to a day.

A link created without an account expires after 7 days unless it is claimed; 30 days later its destination, IP hashes and statistics are deleted. A contact code’s contact details are deleted with them.

When you delete a link, its destination, statistics and IP hashes are deleted at once. A contact code’s contact details are deleted at once too, with earlier versions. The record of which destinations a deleted code pointed to is kept for 12 months without any connection to you, and after that we keep only the host, so the code is never reused.

A link or card we blocked for abuse is kept as evidence, with restricted access, for 24 months after blocking, or until any claim ends.

Abuse reports: a reporter's details are deleted 6 months after the report closes. Copyright files and statements of reasons: 3 years. Sent abuse email: 90 days. Requests and authority orders: 3 years.

Paid features you opened: 180 days. Google Analytics event data: 14 months. Backups: up to 30 days. Your account: until you delete it.

Your rights

You can ask us for information about your data and a copy; to correct it; to delete it; to block or restrict its use; to receive it in a reusable format; and not to be subject to decisions made only by automated means. You can object to anything we do on the basis of legitimate interest.

You can object at any time to our use of your data for direct marketing, and we will stop. Where we rely on your consent, you can withdraw it at any time, as easily as you gave it; that doesn't affect what we did before.

You can view, change and delete your links in the dashboard, and delete your account with “Delete account” on the My links page. This cannot be undone. For anything else, email privacy@qrcode-alligator.com. We answer within 10 working days, and can extend once by 10 working days with reasons. We may ask you to confirm your identity. It's free.

You can complain to us first. You can also complain to a supervisory authority: in Georgia, the State Audit Office; in the EU, the authority where you live or work, listed at edpb.europa.eu; in the UK, the ICO, at ico.org.uk/make-a-complaint. In Canada and other countries, your local privacy regulator.

Changes

When this notice changes, the date at the top changes with it. Before we use your data for a new purpose, we will tell you in the dashboard or by email.