QR Link Pro

Privacy notice

Version 2026-10-24.1, published on October 24, 2026.

1. Who is responsible for your data

ANTHONY MARIN LLAMAS or SIE or QR Link Pro ("we"), with registered address at Aguascalientes, México and tax ID (RFC) MALA9304235MA, is responsible for processing your personal data when you use QR Link Pro at qr-link.pro.

For anything about this notice, write to privacy@qr-link.pro.

This notice explains what data we process, why, who we share it with and how to exercise your rights, under Mexico's current Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP). This is a translation; if it differs from the Spanish version, the Spanish version prevails.

2. Data we process about account holders

  • Identification and contact data: name and email address.
  • Sign-in data: your password, always stored encrypted (we never see it), or your Google account if you choose to sign in with it. In that case Google gives us your name, email and profile picture.
  • Preferences: language, time zone and whether you want the weekly report.
  • Acceptance of terms: the date and version of the terms you accepted.
  • Payment data: your card is received and stored by Stripe; we do not see or store your card number. We only store the customer ID Stripe gives us, your subscription status, the plan and the amount charged.
  • Tax data (only if you request an invoice): RFC (Mexican tax ID), legal name, tax regime, postal code, CFDI use and the email to receive it. We use it to issue your Mexican tax invoice (CFDI).
  • Content of your QR codes: destinations, text, images, files and designs you upload. If you include other people's data (for example, in a vCard contact card), you are responsible for having their permission.
  • Security technical data: the IP address and browser you sign in with, to protect your account and prevent abuse.

Sensitive data: we do not ask for or process sensitive personal data. Do not upload sensitive data to your QR content.

3. Data about people who scan a QR code

When someone scans a QR code, we use their IP address only at that moment to estimate country, region and city, and to count unique visitors with an encrypted fingerprint that changes every day. We do not store your IP.

We also record the operating system, device type, browser, browser language and the date and time of the scan.

The customer who owns the QR code only sees this data in aggregate (for example, "120 scans from Monterrey on iOS"). It cannot be used to identify a person.

4. Primary purposes

We use your data for these purposes, which are necessary to provide the service:

  • Creating and maintaining your account and identifying you when you sign in.
  • Generating, storing and serving your QR codes and their pages.
  • Charging your subscription and issuing payment receipts.
  • Sending you service notices: failed payment, a paused QR code, notice before data is deleted and changes to these documents.
  • Security and fraud and abuse prevention, including checking QR destinations with Google to detect phishing and malware.
  • Answering your questions, reports and requests.
  • Complying with legal obligations.

5. Secondary purposes

These secondary purposes are not necessary for the service, but help us serve you better:

  • The weekly scan report for your QR codes.
  • Communications about news and improvements to the service.

You can opt out of secondary purposes at any time: with the "Unsubscribe" link in each email, with the email option in Account, or by writing to privacy@qr-link.pro. Opting out does not affect your service.

6. Who we share your data with

To provide the service we use providers that process data on our behalf and following our instructions (processors). They cannot use it for their own purposes:

  • Stripe: processes payments and stores your card.
  • Authorized certification provider (PAC): stamps your tax invoices (CFDI) with the SAT, if you request them; it receives your tax data and the amount charged.
  • Google Analytics (Google LLC): only if you accept analytics cookies, it measures how the site is used (see section 9).
  • Email provider: sends the service emails.
  • Server and storage provider: hosts the application, the database and your files.
  • Backup provider: stores encrypted copies of the database and files.
  • Google: Sign in with Google, if you choose it, and URL checking (Web Risk or Safe Browsing), to which we only send the QR code's destination address, never your data or the data of the person scanning.
  • MaxMind: we use its location database inside our own server; we do not send it any data.

Some of these providers are outside Mexico. In every case we require security measures equivalent to ours.

We do not sell your data or transfer it to third parties for their own purposes. We would only make a transfer in the cases the law allows without your consent, for example when a competent authority requires it.

7. Your ARCO rights

You have the right to Access your data, Rectify it if it is wrong, Cancel it when we no longer need it or you no longer want us to have it, and Object to its use for specific purposes (ARCO rights).

To exercise them, email privacy@qr-link.pro with:

  1. Your name and your account email.
  2. A copy of your official ID (or your representative's, with the document that proves the representation).
  3. Which right you want to exercise and over which data, clearly stated.
  4. Any document that helps us find your data.

We reply within the time limits set by law: currently, up to 20 business days to tell you whether your request is granted and, if it is, up to 15 more business days to carry it out. If information is missing we will ask for it, and the time limit starts when we receive it.

You can correct your name, language and time zone yourself in Account. If you ask for cancellation, we cancel your subscription, delete your QR codes, files and statistics, and then your account. The short links of your QR codes stay reserved so nobody else can use them.

8. Revoking your consent and limiting use

You can revoke your consent or ask us to limit the use or disclosure of your data the same way: an email to privacy@qr-link.pro with the details listed above.

Please note that if you revoke consent for the primary purposes we will not be able to keep providing the service, so we would have to close your account. Some data must be kept by law (for example, payment records).

9. Cookies and similar technologies

We only use necessary cookies for the service to work:

  • Session (those starting with "sie."): your signed-in session and its security.
  • Unlocked QR code: remembers for a while that you already entered the password of a protected QR code.
  • NEXT_LOCALE: the language you chose.
  • sie_admin_2fa: the two-step verification step of the administration team.
  • sie_consent: your choice about analytics cookies, for 12 months.
  • sie_ref: the code of the person who invited you, if you arrived through a referral link, for 30 days.

We also keep the draft of the QR code you are designing in your browser's storage (localStorage), so you do not lose it if you close the page. It does not leave your browser until you create the QR code.

Analytics cookies (only if you accept them): we use Google Analytics (Google LLC) to measure which pages you visit, whether you create a QR code, sign up or pay, your approximate city and your device type. We do not send it your name, your email or the content of your QR codes. Google may process this data outside Mexico. You can accept, decline or change your choice at any time from "Cookies" at the bottom of every page. People who scan a QR code do not get these cookies. We do not use advertising cookies. You can delete cookies and storage in your browser settings; if you do, you will be signed out and lose your draft.

10. How long we keep your data

  • While your account is active, we keep your data to provide the service.
  • If you stop paying, your QR codes are paused and their data (content, files and statistics) is deleted after the number of days the service states (60 days by default). We email you before that happens.
  • Your sign-in account is kept until you ask us to cancel it.
  • Backup copies are encrypted and deleted automatically within 12 months at most.
  • Payment records are kept for as long as tax laws require.

11. How we protect your data

  • Passwords stored with one-way encryption.
  • Encrypted connections (HTTPS/TLS) across the whole service.
  • Keys for external services stored encrypted.
  • Administration team access with two-step verification and a log of every action.
  • Encrypted backups with a different provider from the server's.

12. Changes to this notice

We publish any change on this same page, with its version number and publication date. If the purposes or the data we process change, we will email you before the change applies.

13. Where to go

If you believe we did not handle your request properly or that your rights were violated, first write to privacy@qr-link.pro so we can fix it. You can also go to the personal data protection authority designated by the current LFPDPPP (the Ministry of Anti-Corruption and Good Governance, Secretaría Anticorrupción y Buen Gobierno).