Privacy & Data Handling
- 1
Where your scan data lives
Scan events are stored in QRCode Suite's own database, scoped to your workspace. They are first-party data: never sold, never shared with an ad network and never enriched by a third-party tracker. Nothing is forwarded to GA4, Meta or any other platform unless you connect that integration yourself from Settings › Integrations. The WordPress plugin is a connector — codes, scans and WooCommerce conversions it syncs land in the same workspace under the same rules.
- 2
IP addresses are always hashed — this is not a setting
Before any scan event is written, the visitor's IP is put through an HMAC-SHA-256 hash keyed by a deployment secret, and only a truncated hash is persisted. The raw IP is never written to the database, not even temporarily, and the original address cannot be recovered from the stored value. The deployment key also makes precomputed rainbow-table lookups useless. There is no toggle for this: it is enforced on the redirect path for every scan on every plan, including Free.
- 3
Retention is automatic and plan-based
You do not set a retention window — the platform enforces one. A background worker purges scan and click events once your plan's window elapses: 30 days on Free, 12 months on Pro, 24 months on Business, 36 months on Agency. Old events do not accumulate, which is how GDPR Article 5(1)(e) storage limitation is met by default. To keep data longer, move to a plan with a longer window; to keep it shorter, delete the QR code, which removes its events with it.
- 4
Bot traffic is flagged and kept out of your counts
Every scan is matched against 26 known bot, crawler, scraper and link-preview user-agent patterns, plus a heuristic for requests that omit both Accept and Accept-Language headers the way HTTP libraries do. Matching scans are recorded with a bot flag rather than silently dropped, so the traffic is visible if you need it — but they are excluded from your reported scan counts and are never forwarded to integrations or webhooks.
- 5
Cookies and location data
QRCode Suite sets no advertising and no cross-site tracking cookies on scanners' devices. Scan analytics are recorded server-side from the redirect, using the hashed IP and a hashed session value derived from the IP and user agent — that hashed session is also what makes unique-visitor counts and sticky A/B assignment work without a cookie. Country, region and city are coarse values derived from the request at the edge and stored alongside the hashed IP; they are approximate and unreliable on mobile networks and VPNs.
- 6
Consent applies to hosted forms
The one place QRCode Suite asks for consent is hosted lead-capture and review forms. A submission that carries an email address must also carry an explicit consent checkbox — without it the submission is rejected and no email is stored. Scan analytics themselves are not consent-gated, because they never store a raw IP and set no tracking cookies; check with your legal counsel how that maps to your own obligations.
Frequently asked questions
How does QRCode Suite handle IP addresses?
QRCode Suite never stores raw IP addresses. Before any scan event is recorded, the IP is put through an HMAC-SHA-256 hash keyed by a deployment secret, and only that hash is written. The original IP cannot be recovered from it.
Does QRCode Suite filter bot traffic?
Yes. Scans are matched against 26 known bot, crawler, scraper and link-preview user-agent patterns. Matching scans are flagged as bot traffic, excluded from your reported counts, and never forwarded to integrations or webhooks.
Is QRCode Suite compliant with GDPR?
QRCode Suite is built with GDPR in mind: raw IP addresses are never stored, only a keyed hash; bot traffic is filtered out; scan events are purged automatically once your plan retention window elapses; and nothing is forwarded to a third-party platform unless you connect it. Consult your legal team for your specific compliance obligations.
How long is scan data kept?
Retention is enforced automatically per plan — 30 days on Free, 12 months on Pro, 24 months on Business, 36 months on Agency. A background job purges events past that window, so old scan data does not accumulate.