GDPR & privacy settings

QR Hero provides per-organisation GDPR controls so you can align scan analytics with your privacy policy and data processing agreements.

#Data we process on scans

Typical scan events include timestamp, anonymised or pseudonymised visitor signals, country, device class, referrer, and requested slug. Exact fields depend on enabled features and toggles.

#Retention

Platform default retention is two years for scan rollups and audit logs unless your contract specifies otherwise. Exports before deletion are available via support-assisted bulk export or API raw export when entitled.

#Fingerprinting toggle

QR Hero uses ThumbmarkJS (MIT licensed) for unique visitor estimation when allowed. Disable fingerprinting in organisation GDPR settings to rely on less persistent signals — unique counts become noisier but privacy risk drops.

#Regional toggles

Enable or disable features subject to local law:

• Analytics storage for EU/UK/US/TH/UAE visitors
• Marketing pixels on prelanders
• AI-assisted translations processing customer content

Document your choices in your public privacy policy and customer DPAs.

#Data subject requests

Organisation owners can export organisation-held data in CSV/JSON formats through compliance tooling (contact support for full tenant export packages). Right-to-erasure requests may require deleting codes or anonymising historical scan rows — work with support to avoid breaking billing records.

#Sub-processors

QR Hero maintains a sub-processor list covering hosting, email, analytics, and AI providers. Enterprise customers receive DPA templates during onboarding.

#Your responsibilities

• Display appropriate consent banners when using tracking pixels
• Honour opt-out signals when integrating with your CMP
• Inform end users that scanning a QR code transmits technical data to your organisation

For legal interpretation consult your counsel — this guide describes product controls, not legal advice.