Privacy policy

Last updated: 27 October 2026 · Loxima Limited, trading as BulkQR.com ("we", "us")

What we collect

• Account data: your email address and a salted hash of your password (we never store the password itself), plus your organisation name and membership.
• Job data: for signed-in jobs, the content you submit for QR generation and the generated images. Both are stored for 90 days, then deleted automatically. Anonymous batches are generated entirely in your browser: their content never reaches our servers and nothing is stored.
• Dynamic codes: A dynamic code's destination, destination history, label and tags are kept while the code exists and deleted with your account; only the bare code ID is kept after that, so it's never reissued.
• IP address: used for rate limiting and abuse prevention (e.g. the anonymous monthly quota), retained only in that context.
• Payment data: payments are processed by Stripe; we never see or store card details. We keep a reference to the checkout session and the credit amounts in our ledger.

Scans of dynamic codes

When someone scans a dynamic code (a q9x.me address), our redirect service logs the scan for the code's owner. Each scan record holds:

• approximate location, derived by Cloudflare from the network the scan came from: country, region, city, postcode, coordinates, timezone and metro area;
• the network (its number and operator name), the Cloudflare data centre that handled the scan, and the HTTP and TLS versions;
• the device type, operating system and browser family, classified from the browser's user agent;
• the browser's preferred language, and the host name of the referring site, if there is one;
• whether the scan looks like a bot or a link preview;
• which code was scanned, which organisation owns it, which destination it had, and whether it redirected;
• a pseudonymous visitor hash, used to estimate unique scanners per day.

The visitor hash is a one-way hash of a random daily key, the scanner's IP address and user agent, and the code owner's organisation. A new key is created for each UTC day and deleted 48 hours after that day starts. After that, a hash can't be linked to an IP address, to a person, or to the same scanner on another day, and hashes can't be matched between organisations.

IP addresses are not stored, and neither are full user-agent strings or full referring URLs. The redirect service sets no cookies. The IP address is used only in memory, to build the hash and to rate-limit requests for codes that don't exist.

Requests for q9x.me addresses that don't match any code are logged the same way, with no owner, so we can spot guessing and abuse; for those records we are the controller.

Scan records are stored in Cloudflare Analytics Engine, separately from account data, and kept for 3 months. The code's owner sees counts and charts, and can export raw scan records without the visitor hash or coordinates.

Data processing for customers

For scans of your codes, you are the controller and BulkQR is your processor. We process scan data only to redirect scans and report them to you. Our sub-processor is Cloudflare, which runs the redirect service and stores the records. Scan records are kept for 3 months and can't be erased early, even if you delete your account, but they expire automatically. If you need a signed data processing agreement, email admin@bulkqr.com.

If you scanned a code

We keep nothing we could use to find your scans from anything you could give us (no IP address and no cookie), so we can't give you a copy of your scans or delete them. The page a code redirects to belongs to whoever displayed the code, and has its own privacy policy.

What we don't do

• No advertising, no third-party trackers, no sale or sharing of personal data. Scan counts for dynamic codes are described above and go only to the code's owner.
• The only cookie we set is a session cookie to keep you signed in.

Who processes data for us

• Cloudflare: hosting, storage, and bot protection (Turnstile) for the whole service, including the q9x.me redirect service for dynamic codes.
• Stripe: payment processing.
• Resend: transactional email (verification, password resets, job delivery).

Your rights

You can delete your account (and its data) yourself from the account page at any time. Under UK/EU data protection law you also have the right to access, correct, export, or erase your personal data. Email admin@bulkqr.com and we'll act within 30 days. Scan records of dynamic codes are the exception: they can't be erased early and expire after 3 months (see Scans of dynamic codes).

Changes

If this policy changes materially we'll note the new date above and, for account holders, email you.