Privacy Policy

Last updated: [19th November 2025]

1. Who we are

This Privacy Policy explains how QR Box ("QR Box", "we", "us" or "our") collects, uses and shares your personal data when you use our websites, apps and any related services (together, the "Service").

QR Box is operated by [Legal entity name], registered in [Country] with registered office at [Registered address]. We are the controller of your personal data for the purposes of this Privacy Policy.

You can contact us at .

2. Personal data we collect

The personal data we collect depends on how you use the Service. We collect data in three main ways: data you provide to us, data we collect automatically, and data we receive from other sources.

2.1 Data you provide to us

You may give us personal data when you:

Create or update an account;
Set up or edit your profile or Spaces;
Upload or manage Content (for example, images, music, video, documents and metadata);
Scan or share QR codes that link to the Service;
Communicate with us, for example by email or support requests;
Respond to surveys, promotions or feedback requests.

This data may include:

Account details such as your name, display name, email address and password;
Profile information such as biography, links, avatar or header images;
Content you upload or create on the Service, including any personal data contained in that Content;
Preferences and settings, such as language, notification and display preferences;
Any other information you choose to provide in forms or communications with us.

2.2 Data we collect automatically

When you use the Service, we automatically collect some information about your device and how you use QR Box. This helps us operate, secure and improve the Service.

This may include:

Log data such as IP address, browser type and version, device type, operating system, the pages you visit, the date and time of your visits, and how you interact with features;
Usage data such as which Content you view or play, play counts, completion rates, likes, favourites, downloads, and how you interact with playlists, Spaces and Boxes;
QR-related data such as when and where (at a general level) a QR code linked to the Service is scanned, the destination of the QR code and related statistics;
Approximate location information based on your IP address, where allowed by law;
Cookie and similar technology data (see section 4 below).

2.3 Data from other sources

We may receive personal data about you from:

Third-party services you choose to link to your account (for example, if we later offer social logins or integrations);
Service providers who help us with security, fraud prevention, analytics, advertising or technical services;
Publicly available sources, where it is lawful to do so.

3. How we use your personal data

We use your personal data for the following purposes:

To provide and operate the Service including creating and managing accounts, hosting and displaying Content, generating QR codes, playlists and statistics, and enabling features you choose to use.
To maintain security and prevent misuse including monitoring for abuse, detecting and preventing fraud, protecting against unauthorised access, enforcing our Terms of Service and protecting other users.
To improve and develop QR Box including analysing how users interact with the Service, fixing bugs, testing new features and understanding what works well.
To communicate with you including sending service messages (for example, account changes, security alerts, updates to terms or policies), and responding to your questions and support requests.
To personalise your experience including remembering your preferences and settings, and suggesting relevant Content or features.
To comply with legal obligations including responding to lawful requests from authorities and meeting our regulatory and tax obligations.
With your consent, where required by law including for certain types of cookies, analytics, or marketing communications. You can withdraw consent at any time (see section 8).

4. Cookies and similar technologies

We use cookies and similar technologies to help run the Service and to understand how it is used.

Cookies are small text files stored on your device when you visit a website. We may use:

Strictly necessary cookies needed to operate the Service, such as keeping you logged in and maintaining session security;
Preference cookies to remember your settings, such as language or display preferences;
Analytics cookies to understand how people use the Service and to improve performance;
Other technologies such as local storage or similar tools for similar purposes.

Where required by law, we will ask for your consent before using non-essential cookies or similar technologies. You can usually control cookies through your browser settings and, where provided, through our own cookie tools.

For more details, please see our [Cookie Policy] (if available) or relevant section in this Privacy Policy.

5. Legal bases for processing (EEA and UK users)

If you are in the European Economic Area (EEA) or the United Kingdom, we process your personal data under one or more of the following legal bases:

Contract: where processing is necessary to provide the Service under our Terms of Service;
Legitimate interests: for example, to secure and improve the Service, prevent abuse, and understand how users interact with QR Box, where these interests are not overridden by your rights;
Consent: where you have given clear consent, for example for certain cookies or marketing communications;
Legal obligation: where we need to comply with laws and regulations.

6. How we share your personal data

We do not sell your personal data. We may share your personal data with:

Service providers who help us operate QR Box, such as hosting providers, security and fraud-prevention services, analytics providers, email and communication tools, and customer-support tools;
Other users and the public when you choose to make Content public or share links or QR codes. In those cases, your Content and some profile information may be visible to others;
Professional advisers such as lawyers, auditors or insurers, where needed for our business;
Authorities and regulators where we are required to do so by law, or where we believe it is reasonably necessary to protect our rights, users or others;
Business transferees in connection with a merger, acquisition, restructuring or sale of all or part of our business, in which case we will take steps to ensure your rights continue to be protected.

7. International data transfers

We may store and process your personal data in countries other than the one you are in. These countries may have different data-protection laws.

Where we transfer personal data from the UK or EEA to a country that does not provide an equivalent level of data protection, we will put in place appropriate safeguards, such as standard contractual clauses approved by the European Commission or UK authorities, where required by law.

8. How long we keep your personal data

We keep your personal data for as long as reasonably necessary to provide the Service, meet our legal and accounting obligations, resolve disputes and enforce our agreements.

In general:

We keep account data for as long as your account is active;
We may keep logs and security-related data for a limited period after collection to detect and prevent abuse;
We may keep backup copies for a limited time as part of our normal backup processes;
We may keep some records for longer where the law requires, or where we need them for legal claims.

When personal data is no longer needed, we will delete it or anonymise it so that it can no longer identify you.

9. Your rights

Depending on where you live, you may have some or all of the following rights over your personal data:

Access – to ask for a copy of the personal data we hold about you;
Correction – to ask us to correct inaccurate or incomplete personal data;
Deletion – to ask us to delete your personal data in certain circumstances;
Restriction – to ask us to restrict how we use your personal data in certain circumstances;
Objection – to object to our use of your personal data based on our legitimate interests, in certain circumstances;
Data portability – to ask for certain personal data in a structured, commonly used and machine-readable format, and to ask us to transfer it to another controller, where technically feasible;
Withdraw consent – where we rely on consent, you can withdraw it at any time. This will not affect the lawfulness of processing before withdrawal;
Complain to a regulator – you have the right to complain to your local data-protection authority if you are unhappy with how we use your personal data.

To exercise your rights, please contact us at . We may need to verify your identity before responding to your request.

10. Security

We use reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, misuse or alteration.

However, no online service can be completely secure. You are responsible for keeping your account login details safe and for choosing a strong password. If you believe your account has been compromised, please contact us as soon as reasonably possible.

11. Children

The Service is not intended for children under [minimum age, e.g. 16] years old, and we do not knowingly collect personal data from children below this age.

If you believe a child has provided us with personal data without appropriate consent, please contact us and we will take reasonable steps to delete it.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example to reflect changes to the Service or to legal requirements.

If we make significant changes, we will take reasonable steps to let you know (for example, by posting a notice on the Service or emailing you). The updated Privacy Policy will apply from the date it is posted.

We encourage you to review this Privacy Policy regularly so that you understand how we use your personal data.

13. Contact us

If you have any questions about this Privacy Policy or how we handle your personal data, you can contact us at: .