Privacy Policy

LinQR Digital Link Solutions provides QR code management, review collection, and payment link services for UK businesses. We are the data controller for personal data collected through this website.

Contact us at: linqrsupport@gmail.com

We collect the following categories of personal data:

• Enquiry data: When you submit a free business enquiry, we collect your name, business name, email address, phone number (if provided), and details about your requirements.
• Review data: When customers use a LinQR review page, we collect only the review text they choose to submit. No account creation is required. When visitors rate LinQR directly at linqr.dev/reviews, we collect the review text, star rating, name (if provided), and service type selected.
• Usage data: We collect anonymised data about how our platform is used, including page views and QR code scan counts (linked only to a scan timestamp and, where relevant, the staff member whose code was scanned). On review pages we also record which steps a visit reached (page opened, draft shown, draft edited, platform tapped) so we can see where people stop and improve the page. We do not store IP addresses, device identifiers, or precise/derived location data. To count repeat visits by the same person on the same day only once, we keep a one-way hash of the IP address and browser type combined with a secret that changes every day, so it cannot be reversed or used to link a visitor across days. A guest scanning a code at one venue is never linked to the same guest at a different venue.
• Review reminders: If a guest asks us to email them their review link for later, and ticks the box to agree, we send exactly one email with that link. We do not store the email address in our systems. Our email provider, Resend, holds it only to deliver that single message. It is never used for marketing.
• Business configuration: Business clients store staff names and review platform URLs in our system. This data is used solely to provide the LinQR service.
• Payment data: Where clients purchase a design service, payments are processed securely by Stripe. LinQR does not store card details — only the outcome of the transaction (paid or unpaid) and a Stripe-issued reference.

We collect user data to deliver, operate, and improve our services, including:

• To respond to your business enquiry and provide our services
• To send service-related communications (e.g. your enquiry confirmation)
• To improve our platform and user experience
• To comply with legal obligations
• To support AI-assisted service features, where we use AI tools for internal productivity, content drafting, support workflows, and automation only where appropriate and under human review

We will not use your data for unsolicited marketing without your explicit consent.

AI use: Any use of AI in LinQR is subject to human oversight. We do not use AI to make decisions that materially affect your rights without review. If a user shares content related to self-harm, suicide risk, or other crisis situations, we do not provide harmful or unsafe AI responses and instead direct the user to emergency services, local crisis support, or a trusted human contact. We do not use AI to provide medical or mental-health diagnosis or treatment advice.

We process your personal data under the following lawful bases (UK GDPR Art. 6):

• Contract: To fulfil our obligations as a service provider to business clients.
• Legitimate interests: To respond to enquiries and improve our services.
• Consent: For any marketing communications (you may withdraw consent at any time).

We share personal data only with the following third-party data processors and service providers, solely to operate our services:

• Resend (resend.com): Our transactional email provider, used to send enquiry notifications and one-off review reminders that guests ask for. Resend processes email data on our behalf.
• Neon (neon.tech): Our database provider, used to store enquiry and business data securely. Neon is SOC 2 Type 2 certified.
• Stripe (stripe.com): Our payment processor, used when clients purchase a design or update service. Stripe processes payment card data directly and is PCI DSS Level 1 certified. LinQR does not receive or store card details.
• Vercel: Our hosting provider, and (only if you accept analytics) the provider of Vercel Web Analytics and Speed Insights. Data is processed in accordance with their privacy terms.
• AI service providers: If we use AI tooling for support or internal workflows, personal data is only processed under contract, with human review, and only where necessary to provide the service. No AI vendor is permitted to use your submitted data for model training without express consent.

We do not sell, rent, or trade personal data with third parties.

We retain personal data only for as long as necessary:

• Enquiry data: Retained for 2 years from submission, or until you request deletion.
• Business client data: Retained for the duration of the service agreement plus 1 year.
• Anonymised analytics: Scan and review-event records contain no personal data and are retained indefinitely in aggregate. Individual scan-timestamp records are periodically compacted into aggregated counts once older than 90 days, reducing granular data without affecting the anonymised totals shown to business clients.
• Review-page step records: Deleted automatically after 90 days.

Removal of all user details: You may request the removal of your personal data at any time by emailing linqrsupport@gmail.com. We will delete or anonymise identifiable information where we no longer need it for the lawful purpose for which it was collected, subject to any legal retention obligations. Where data has been shared with a third-party processor, we will ask them to delete relevant records as appropriate.

We use secure, access-controlled hosting and database environments. We do not operate a public storage bucket for customer data or uploaded files. Any uploaded images, logos, or related assets are stored in secure private infrastructure with limited access, and are not exposed publicly unless you explicitly publish them through another service or URL.

We take appropriate technical and organisational measures to protect your personal data, including:

• HTTPS encryption for all data in transit
• Encrypted database storage via Neon
• Access controls limiting who can view personal data

No method of transmission over the internet is 100% secure. We will notify you of any data breach that affects your rights and freedoms within 72 hours as required by law.

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data ("right to be forgotten")
• Restrict our processing of your data
• Data portability — receive your data in a machine-readable format
• Object to processing based on legitimate interests
• Withdraw consent at any time where processing is consent-based

To exercise any of these rights, email us at linqrsupport@gmail.com. We will respond within 30 days.

You also have the right to lodge a complaint with the ICO (Information Commissioner's Office) at ico.org.uk.

We use one strictly necessary cookie, linqr-portal, set only when a business client logs in to their LinQR management portal. It stores a signed session token so you stay logged in, expires after 7 days, and is not used for tracking or advertising. Because it is essential to providing the service you've requested, it does not require consent under PECR.

Optional analytics. On our marketing pages a banner asks whether you're happy for us to use Vercel Web Analytics and Vercel Speed Insights. These tell us which pages are visited and how quickly they load, using anonymous, aggregated data, and they don't set cookies. They only load if you choose "Accept analytics"; if you choose "Essential only" they stay off. You can change your mind at any time with the "Cookie settings" link in the footer.

Our own page counter. Separately, we count page views ourselves as described in section 2 (usage data). It stores nothing on your device and keeps no IP address, so it runs whatever you choose.

We also use browser-only session/local storage (never transmitted to our servers) for temporary UI state such as dismissed banners, your analytics choice and admin login state. We do not use tracking or advertising cookies.

Guests scanning a QR code and viewing a public review page are not issued any cookie, are not shown the banner, and the optional analytics never load there.

If we introduce marketing cookies in future, we will update this policy and request your consent before placing them.

Our database provider (Neon) may process data in the United States. We ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) where required under UK GDPR.

We may update this Privacy Policy from time to time. We will notify business clients of material changes by email. The "Last updated" date at the top of this page reflects the most recent revision.

If you have any questions about this Privacy Policy or how we handle your data: