Privacy Policy

Effective Date: 1 February 2025

Last Updated: 12 July 2026

1. Introduction

QRCompose is a product of Cloudleet (“Cloudleet”, “QRCompose”, “we”, “our”, or “us”). We are committed to handling personal data lawfully, fairly, transparently, and securely.

This Privacy Policy explains how we collect, use, disclose, store, and protect personal data when you use the QRCompose website, management application, QR-powered pages and experiences, Designer, artificial intelligence features, events platform, Guest Portal, APIs, integrations, and related services (collectively, the “Services”).

This Policy applies to account holders, organisation members, customers, event organisers, attendees, guests, people who scan QR codes or visit published pages, and other individuals who interact with the Services.

This Policy should be read together with our Terms and Conditions and any feature-specific notice presented when personal data is collected. It does not replace privacy notices that our customers are responsible for providing to their own end users, customers, attendees, or employees.

2. Who We Are and Our Role

Cloudleet operates QRCompose and is responsible for the personal data described in this Policy.

Depending on the circumstances, we may act as:

(a) a data controller when we decide why and how personal data is processed, including account registration, authentication, billing, customer support, security, platform analytics, product communications, and service administration; or

(b) a data processor when a customer or organisation uses QRCompose to collect or manage personal data through forms, bookings, events, attendee records, guest profiles, customer transactions, or similar customer-controlled experiences.

Where we act as a processor, the customer or organisation is normally the controller and is responsible for providing an appropriate privacy notice, establishing a lawful basis, responding to data-subject requests, and determining retention and use of that data. A separate data processing agreement may apply.

3. Personal Data We Collect

3.1 Account and Profile Information

When you create or use an Account, join an Organisation, contact us, or authenticate through a supported identity provider, we may collect:

Name, email address, phone number, profile image, job title, company or business name, country, language, and contact preferences;

Login, authentication, verification, session, and security information;

Organisation membership, role, permissions, invitations, invitation status, and administrator relationships;

Information received from identity providers, such as Google, where you choose to use third-party sign-in;

Support requests, feedback, correspondence, survey responses, and records of communications with us.

3.2 Organisation and Team Data

QRCompose supports shared Organisations, managed billing, self-service billing, team roles, and organisation-level access controls. We may process:

Organisation names, branding, configuration, billing mode, plan, licences, and account settings;

Member names, email addresses, roles, permissions, invitations, and status;

Administrative activity relating to members, access, licences, publishing, or billing;

Organisation-owned Content and configuration data.

Organisation administrators may be able to access, manage, export, restrict, or delete Organisation-owned data and may control a member’s continued access to the Organisation.

3.3 Content and Configuration Data

We process Content that users create, upload, configure, store, or publish through QRCompose, including:

QR codes, destinations, page content, link pages, digital profiles, menus, forms, files, reviews, bookings, events, workflows, payment settings, branding, templates, and design configurations;

Draft and published versions of pages and experiences;

Uploaded images, documents, video, audio, logos, and other media;

Custom fields, labels, descriptions, pricing, schedules, availability, links, and business information.

Draft changes generally remain unpublished until a user completes the applicable publishing flow. Preview and Designer functionality may process draft Content to render a preview without making that draft publicly available.

3.4 Device, Log, and Usage Data

When you access or use the Services, we may automatically collect:

IP address or a truncated, hashed, or otherwise minimised form of it;

Device type, device identifiers where applicable, operating system, browser, language, screen information, and application version;

Authentication events, session identifiers, timestamps, requested URLs, referring pages, error information, diagnostic data, security events, and system logs;

Feature usage, clicks, navigation, publishing activity, plan entitlements, licence status, AI credit usage, and account activity;

Approximate geographic information derived from IP address, such as country, region, or city.

We use this information to operate, secure, troubleshoot, analyse, and improve the Services.

3.5 QR Code and Published-Experience Interactions

When a person scans a QR code or visits a QRCompose-powered experience, we may process:

Date and time of access;

QR code, page, campaign, event, or experience identifier;

Device, browser, operating system, referral source, and approximate location;

Views, clicks, conversions, form interactions, registrations, bookings, orders, or other actions;

Information intentionally submitted through the experience.

We may aggregate or de-identify interaction data for analytics and reporting. Analytics may still be considered personal data where an individual can reasonably be identified, and we process it accordingly.

3.6 Forms, Bookings, Orders, and Customer Transactions

Customers may use QRCompose to collect information through forms, bookings, orders, menus, payments, reviews, or other interactive experiences. This may include:

Names, email addresses, phone numbers, addresses, company information, and other contact details;

Booking date, time, service, staff member, availability, notes, status, and customer preferences;

Order, product, item, quantity, price, deposit, payment status, refund status, or transaction references;

Responses to standard or custom fields created by the customer;

Free-text responses and files submitted by an end user.

The customer that created the experience normally determines why this information is collected and how it is used. QRCompose processes it on that customer’s behalf, except where we independently need to process it for security, legal compliance, service administration, or fraud prevention.

3.7 Event, Attendee, and Check-In Data

Our event services may process:

Event details, organisers, venue, schedules, agenda items, speakers, exhibitors, sponsors, and event branding;

Attendee names, email addresses, phone numbers, company, role, profile image, custom registration fields, registration status, and ticket or licence information;

Attendee lists uploaded manually or through CSV import;

Invitation, registration, approval, attendance, check-in, and check-out records;

Badge content, QR badge identifiers, digital passes, badge-printing selections, and public profile links;

Event analytics, registration totals, capacity information, and attendance statistics.

The event organiser or organisation is normally the controller of attendee data. Organisers are responsible for ensuring that attendee information is lawfully collected, imported, used, displayed, printed, and shared.

3.8 Guest Portal and Networking Data

Where the Guest Portal is enabled, we may process:

Guest account information, email verification, authentication sessions, and linked event attendance;

Guest profile details, profile visibility settings, public profile tokens, digital passes, and event preferences;

Networking and connection activity, including the fact that a connection was initiated or saved;

Notes, images, or other information a user chooses to attach to a connection;

Selected external contact channel, such as WhatsApp, LinkedIn, Telegram, SMS, or another supported service.

When a user chooses an external communication channel, QRCompose may redirect them to that third-party service or generate a message using information they supplied. The third party processes information under its own privacy policy.

Users are responsible for deciding what they include in public profiles, networking notes, connection messages, and attachments. Event organisers may determine which Guest Portal features are available.

3.9 Artificial Intelligence Data

When you use AI-powered features, we may process:

Your prompts, instructions, uploaded information, and conversation history;

Relevant Account Content, page configuration, design settings, event information, or other context required to respond to your request;

Generated output, proposed changes, applied changes, tool calls, feedback, and error information;

AI usage metadata, model information, token or credit consumption, latency, and safety or abuse signals.

We seek to send only the information reasonably necessary to fulfil the requested AI task. AI requests may be processed by third-party model or infrastructure providers acting under contractual and data-protection safeguards.

Unless we clearly state otherwise, we do not use customer prompts or customer Content to train public, general-purpose AI models. We may use limited, minimised, aggregated, or de-identified AI usage data to operate, secure, evaluate, and improve our own Services.

You should not include special-category, highly confidential, regulated, or unnecessary personal data in AI prompts. AI output may be retained as part of conversation history or account activity where the feature supports history.

3.10 Billing, Subscription, Trial, and Event-Licence Data

When you purchase or use a paid plan, trial, managed plan, or Event Licence, we may process:

Billing name, billing email, business name, billing address, tax information, country, and VAT information;

Plan, price, currency, billing interval, trial dates, renewal dates, grace periods, subscription status, licence status, event capacity, entitlements, and discounts;

Invoices, receipts, payment status, failed-payment status, refund information, payment-provider customer identifiers, and transaction references.

Payment card information is processed by payment providers such as Stripe or PayPal. We do not ordinarily store complete payment card numbers or security codes.

3.11 Files and Uploads

The Services may allow users to upload images, PDFs, documents, video, audio, and other files. Files may be stored through cloud infrastructure and delivered through content-delivery networks, cached systems, or public or access-controlled URLs.

A non-indexed, long, or difficult-to-guess URL is not the same as a private storage system. Anyone with access to a public link may be able to access, copy, or share the file. Users should not upload sensitive or confidential information to a feature designed for public delivery.

Deleted or replaced files may remain temporarily in caches, logs, disaster-recovery systems, or backups before being removed through normal retention cycles.

3.12 Cookies and Similar Technologies

We may use cookies, local storage, session storage, and similar technologies to:

Authenticate users and maintain secure sessions;

Remember preferences and application settings;

Prevent fraud and protect the Services;

Measure performance, reliability, and feature usage;

Support analytics and, where permitted and enabled, marketing or campaign measurement.

Strictly necessary technologies are required for core operation. Where required by law, non-essential cookies or similar technologies will be used only after appropriate notice or consent. Browser controls can be used to manage cookies, although disabling necessary technologies may affect functionality.

4. How We Obtain Personal Data

We collect personal data:

Directly from you when you register, configure an experience, upload Content, make a purchase, contact support, or use AI Features;

From customers, Organisations, event organisers, or administrators who invite, import, provision, or manage users and attendees;

From end users who complete forms, bookings, registrations, orders, profiles, or other experiences;

Automatically from devices, browsers, QR interactions, logs, cookies, and platform usage;

From third-party identity, payment, analytics, communication, or integration providers where you choose to connect or use those services.

5. How and Why We Use Personal Data

We use personal data to:

Provide, operate, host, and maintain the Services;

Create and administer Accounts, Organisations, memberships, roles, permissions, plans, subscriptions, trials, and Event Licences;

Render drafts and previews, publish pages, resolve QR destinations, deliver files, and operate public experiences;

Provide forms, bookings, orders, payments, events, registrations, check-in, badge printing, digital passes, the Guest Portal, networking, and analytics;

Process and respond to AI requests, generate output, apply requested draft changes, administer AI credits, and maintain AI conversation history where enabled;

Authenticate users, prevent fraud, detect abuse, investigate incidents, enforce limits, and protect the security and integrity of the Services;

Process billing, renewals, failed payments, refunds, taxation, invoices, and accounting records;

Provide customer support, troubleshoot errors, monitor reliability, and improve product performance;

Send essential service, authentication, security, billing, trial, event, legal, and administrative communications;

Send marketing communications where permitted by law and subject to your preferences;

Comply with legal, regulatory, tax, accounting, law-enforcement, and dispute-resolution obligations;

Establish, exercise, or defend legal claims;

Create aggregated or de-identified information for statistics, product planning, service improvement, and reporting.

6. Legal Bases for Processing

Where the GDPR, UK GDPR, or similar law applies, we rely on one or more of the following legal bases:

Contract: where processing is necessary to provide the Services, administer your Account, fulfil a purchase, or perform our agreement with you;

Legitimate interests: where processing is necessary for security, fraud prevention, service improvement, business administration, support, analytics, or protecting our rights, provided those interests are not overridden by your rights;

Consent: where you have given consent, including for certain cookies, marketing communications, public-profile options, or optional features. You may withdraw consent at any time, without affecting prior lawful processing;

Legal obligation: where processing is necessary to comply with tax, accounting, regulatory, court, law-enforcement, or other legal requirements;

Vital interests or public interest: in limited circumstances where processing is necessary to protect a person or comply with a task recognised by law.

Where we act as a processor, the customer or organisation determines the legal basis for its collection and use of the relevant personal data.

7. How We Share Personal Data

We do not sell personal data.

We may share personal data with:

7.1 Customers and Organisations

Information submitted through a customer-controlled QR experience, form, booking, order, event, profile, or Guest Portal may be made available to the customer, event organiser, or Organisation responsible for that experience.

Organisation administrators may access and manage Organisation data, members, roles, billing, licences, Content, event records, and other information according to their permissions.

7.2 Service Providers

We use service providers that support hosting, cloud infrastructure, content delivery, databases, email delivery, identity and authentication, customer support, error monitoring, analytics, payment processing, AI functionality, mapping, and other technical operations.

These providers may process personal data only as required to provide contracted services, subject to appropriate confidentiality, security, and data-protection obligations.

Provider categories may include:

Payment providers, such as Stripe or PayPal;

Cloud and infrastructure providers, such as AWS, DigitalOcean, or equivalent providers;

AI model and infrastructure providers;

Email, authentication, monitoring, support, mapping, and analytics providers.

Our provider list may change as the Services evolve.

7.3 Third-Party Integrations and External Platforms

Where you connect or use a third-party integration, we may exchange information required to operate that integration. This may include identity providers, payment services, websites, social platforms, messaging services, calendars, maps, or other external systems.

Third parties process information under their own terms and privacy policies. We are not responsible for their independent use of personal data.

7.4 Professional Advisers and Authorities

We may share information with legal advisers, accountants, auditors, insurers, banks, regulators, courts, law-enforcement bodies, or public authorities where reasonably necessary and lawful.

7.5 Business Transfers

If Cloudleet or QRCompose is involved in a merger, financing, restructuring, acquisition, sale, insolvency, or transfer of assets or business, personal data may be disclosed or transferred as part of that transaction, subject to appropriate safeguards and applicable law.

8. International Data Transfers

QRCompose is operated from Cyprus, but service providers or users may be located in other countries. Personal data may therefore be processed outside Cyprus, the European Economic Area, or your country of residence.

Where required, we use appropriate safeguards for international transfers, which may include adequacy decisions, Standard Contractual Clauses, contractual protections, transfer assessments, supplementary technical or organisational measures, or another lawful transfer mechanism.

No transfer mechanism can eliminate every risk. We select providers and safeguards based on the nature of the processing and applicable legal requirements.

9. Data Security

We use reasonable technical and organisational measures designed to protect personal data, including as appropriate:

Encryption in transit;

Encryption or equivalent protections for stored data where supported and appropriate;

Role-based access controls and least-privilege access;

Tenant and Organisation access controls;

Authentication, session controls, monitoring, and logging;

Backups, resilience, incident response, and recovery procedures;

Secure software-development and change-management practices;

Security reviews, dependency management, and vulnerability remediation;

Data minimisation and aggregation or de-identification where appropriate.

No service can guarantee absolute security. You are responsible for maintaining secure credentials, managing roles and permissions, selecting appropriate privacy settings, and avoiding sensitive data in public or unsuitable features.

If we become aware of a personal-data breach, we will investigate and take action in accordance with applicable law, including notifying relevant controllers, authorities, or affected individuals where legally required.

10. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including providing the Services, meeting contractual obligations, complying with law, resolving disputes, enforcing agreements, and protecting security.

Retention depends on the data category and context:

Account and profile data is generally retained while the Account remains active and for a reasonable period after closure where required for support, security, disputes, or legal compliance;

Organisation and customer Content is generally retained while the relevant Account, Organisation, subscription, or service relationship remains active, subject to customer-controlled deletion, plan restrictions, and contractual retention settings;

Drafts and published Content may remain until deleted, unpublished, replaced, or removed under our retention processes;

Event, attendee, check-in, registration, badge, Guest Portal, and networking data is retained according to the event organiser’s instructions, account activity, applicable settings, and our legal or operational requirements;

AI conversations, prompts, output, and usage logs may be retained to provide conversation history, administer credits, investigate abuse, troubleshoot issues, or improve the Services, subject to feature settings and provider retention terms;

Billing, invoice, taxation, and transaction records may be retained for the period required by accounting, tax, anti-fraud, or legal obligations;

Security, audit, and diagnostic logs are retained for periods appropriate to security, reliability, investigation, and compliance needs;

Aggregated or irreversibly de-identified information may be retained for longer because it no longer identifies an individual;

Backup copies may persist for a limited period after deletion until rotated or overwritten through normal backup cycles.

Deleting an Account does not necessarily immediately remove information held by a customer or Organisation, information that must be retained by law, information in active disputes, or temporary backup copies.

11. Your Rights

Depending on applicable law, you may have the right to:

Request access to personal data we hold about you;

Request correction of inaccurate or incomplete data;

Request deletion of personal data;

Request restriction of processing;

Object to processing based on legitimate interests or to direct marketing;

Request portability of certain data in a structured, commonly used, machine-readable format;

Withdraw consent at any time where processing is based on consent;

Request information about international-transfer safeguards;

Lodge a complaint with a data-protection authority;

Not be subject to a solely automated decision producing legal or similarly significant effects, where applicable.

These rights are not absolute and may be limited by legal exceptions, identity verification, the rights of others, technical feasibility, or our role as controller or processor.

To exercise a right concerning Account or platform data controlled by Cloudleet, contact [email protected]. We may need to verify your identity and clarify your request.

Where your personal data was collected through a customer’s form, booking, event, attendee list, Guest Portal, order, or other customer-controlled experience, you should normally contact that customer or organisation first. We will assist our customer with valid requests where required by contract or law.

You may also complain to the Office of the Commissioner for Personal Data Protection in Cyprus or another competent supervisory authority in your country of residence or work.

12. Marketing and Service Communications

We may send essential communications necessary to operate the Services, including authentication codes, security alerts, billing and trial notices, subscription or Event Licence messages, service changes, event-related operational communications, and legal notices. These communications are not marketing and may be necessary while your Account is active.

We send marketing messages only where permitted by law. You can unsubscribe using the link or method provided, or contact us. Unsubscribing from marketing does not prevent essential service communications.

Customers that use QRCompose to communicate with their own users, customers, or attendees are responsible for complying with electronic-communications, privacy, marketing, and anti-spam laws.

13. Public Profiles, Pages, and Content

Information published through public QR pages, digital profiles, event pages, public attendee profiles, menus, files, or public links may be visible to anyone and may be copied, indexed, cached, or shared by third parties.

Users and customers control much of what is published and are responsible for reviewing Content, visibility settings, permissions, and legal notices before publication.

We cannot control how third parties use information after it has been made public or shared outside QRCompose.

14. Automated Processing and AI

AI Features may assist with content generation, design, configuration, analysis, recommendations, or automated application of requested changes. These features may analyse prompts and relevant Account Content to generate a response.

AI output may be inaccurate or unsuitable and should be reviewed before publication or use. QRCompose does not use AI Features to make solely automated decisions about individuals that produce legal or similarly significant effects on our own behalf.

Customers must not use QRCompose AI Features for high-risk or legally significant automated decision-making unless they independently establish a lawful basis, provide required notices, perform any necessary assessments, implement appropriate human review, and comply with applicable law.

15. Children’s Privacy

QRCompose Accounts are intended for adults and are not directed to children under 13. We do not knowingly invite children under 13 to create Accounts.

Customers and event organisers may use the Services in contexts involving minors. In those cases, the customer or organiser is responsible for determining whether the processing is lawful, providing age-appropriate notices, obtaining parental or guardian consent where required, and configuring the experience appropriately.

If you believe a child’s personal data has been processed unlawfully through QRCompose, contact us and identify the relevant customer, event, page, or Account where possible.

16. Third-Party Links

QRCompose experiences may contain links to third-party websites, applications, payment pages, messaging services, social networks, or other services. We do not control their privacy practices and this Policy does not apply to their independent processing.

You should review the privacy information provided by each third party before supplying personal data.

17. Changes to This Privacy Policy

We may update this Policy as the Services, providers, business, or legal requirements change. The effective or last-updated date will show when the latest version took effect.

Where required, we will provide notice of material changes through email, the dashboard, the website, an in-app message, or another appropriate method.

18. Contact Us

For privacy questions, requests, or complaints:

Email: [email protected]

Website: www.qrcompose.com

Phone: +357 26222323

Cloudleet / QRCompose

Cyprus

Please include enough information for us to identify the relevant Account, Organisation, event, QR experience, or customer-controlled service. Do not send identity documents or sensitive information unless we specifically request them through an appropriate secure process.