QR Code AI Privacy Policy

PRIVACY POLICY

Last updated 2 March 2026

This privacy notice for Supernovae ("we," "us," or "our"), describes how and why we might collect, store, use, and/or share ("process") your information when you use our services ("Services"), such as when you:

• Visit our website at https://qrcode-ai.com, or any website of ours that links to this privacy notice
• Use our QR code generation tools, including AI-powered artistic QR code creation
• Engage with us in other related ways, including any sales, marketing, or events

Questions or concerns? Reading this privacy notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at [email protected].

SUMMARY OF KEY POINTS

This summary provides key points from our privacy notice, but you can find out more details about any of these topics by reading the full notice below.

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use.

Do we process any sensitive personal information? We do not ask for sensitive personal information to create your account. Content you choose to upload or encode in a QR code may contain such information; see Section 1.

Do we receive any information from third parties? Yes. If you sign in with Google, we receive account and profile information for authentication and account management, as described in Section 7.

How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent.

Do we use AI to process your data? Yes. We use Anthropic and OpenAI to generate artistic QR codes from your prompts and images, and Replicate to remove image backgrounds. For background removal, we send only the image you select to Replicate. Section 5 explains these uses and the provider-specific rules on model training.

In what situations and with which parties do we share personal information? We may share information with providers and other third parties for the purposes described below. Microsoft receives personal data through Clarity and acts as an independent controller, including for advertising purposes, subject to applicable consent and opt-out requirements. See Sections 4, 6 and 12 and our Subprocessors page.

Where is your data stored? Your data is primarily stored on servers located in the European Union (France) and the European Economic Area (Netherlands). Some data may be processed by US-based service providers under appropriate safeguards.

How do we keep your information safe? We have organisational and technical processes and procedures in place to protect your personal information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure.

What are your rights? Depending on where you are located geographically, the applicable privacy law may mean you have certain rights regarding your personal information.

How do you exercise your rights? You can contact us at [email protected]. We consider and act upon requests in accordance with applicable data protection law; Section 12 explains the relevant procedures and response periods.

TABLE OF CONTENTS

1. What Information Do We Collect?
2. How Do We Process Your Information?
3. What Legal Bases Do We Rely On to Process Your Personal Information?
4. When and With Whom Do We Share Your Personal Information?
5. AI-Generated Content and Data Processing
6. Do We Use Cookies and Other Tracking Technologies?
7. How Do We Handle Google Sign-In?
8. How Long Do We Keep Your Information?
9. How Do We Keep Your Information Safe?
10. International Data Transfers
11. Do We Collect Information From Minors?
12. What Are Your Privacy Rights?
13. Do-Not-Track and Global Privacy Control
14. Do We Make Updates to This Notice?
15. How Can You Contact Us?
16. How Can You Review, Update, or Delete the Data We Collect From You?

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

Personal Information Provided by You. The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include the following:

• Names
• Email addresses

Sensitive Information. We do not ask you to provide sensitive personal information to create your account. However, images, text and other content you submit or encode in QR codes may contain sensitive personal information. Only submit information that you are entitled to provide and that is necessary for your intended use.

Payment Data. For payments processed through Stripe, Stripe collects payment card details directly. We do not store full payment card numbers or card security codes on our servers. We receive and retain information needed to manage billing and subscriptions, such as billing details, customer and transaction identifiers, and payment or subscription status. Stripe describes its processing at https://stripe.com/privacy.

Google Sign-In Data. You can register or sign in using your Google account. If you choose this option, we collect the information described in the section called "How Do We Handle Google Sign-In?" below. You can also sign in using a verification code sent to your email address.

AI-Generated Content Data. When you use our AI-powered QR code generation features, we collect:

• Text prompts you provide for AI image generation
• Images you upload for QR code customisation
• The generated QR code outputs

This data is stored on our servers to provide and improve the Services. See Section 5 for the processing purposes and the provider-specific rules on model training.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Information automatically collected

In Short: Some information, such as your Internet Protocol (IP) address and/or browser and device characteristics, is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This information may constitute personal data and, after you sign in, may be linked to your account as described in Section 6. It may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and other technical information. This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.

Like many businesses, we also collect information through cookies and similar technologies.

The information we collect includes:

• Log and Usage Data. Log and usage data is service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services and which we record in log files. Depending on how you interact with us, this log data may include your IP address, device information, browser type, and settings and information about your activity in the Services (such as the date/time stamps associated with your usage, pages and files viewed, searches, and other actions you take such as which features you use), device event information (such as system activity, error reports, and hardware settings).
• Device Data. We collect device data such as information about your computer, phone, tablet, or other device you use to access the Services. Depending on the device used, this device data may include information such as your IP address (or proxy server), device and application identification numbers, location, browser type, hardware model, Internet service provider and/or mobile carrier, operating system, and system configuration information.
• Location Data. We derive approximate location information, such as country, region or city, from your IP address. This is an estimate and does not establish your precise physical location. This processing does not use your device’s GPS location permission; disabling that permission does not prevent IP-based location estimates.

2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To facilitate account creation and authentication and otherwise manage user accounts. We may process your information so you can create and log in to your account, as well as keep your account in working order.
• To deliver and facilitate the delivery of services to the user. We may process your information to provide you with the requested service, including generating QR codes and AI-powered artistic designs.
• To request feedback. We may process your information when necessary to request feedback and to contact you about your use of our Services.
• To send you marketing and promotional communications. We may process the personal information you send to us for our marketing purposes, if this is in accordance with your marketing preferences. You can opt out of our marketing emails at any time. For more information, see "What Are Your Privacy Rights?" below.
• To identify usage trends. We may process information about how you use our Services to better understand how they are being used so we can improve them.
• Microsoft advertising and other independent purposes. Microsoft may use personal data received through Clarity for its own purposes, as described in Section 6, subject to applicable consent and opt-out requirements.
• To save or protect an individual's vital interest. We may process your information when necessary to save or protect an individual's vital interest, such as to prevent harm.

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR INFORMATION?

In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason (i.e., legal basis) to do so under applicable law, like with your consent, to comply with laws, to provide you with services to enter into or fulfil our contractual obligations, to protect your rights, or to fulfil our legitimate business interests.

If you are located in the EU or UK

The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on in order to process your personal information. As such, we may rely on the following legal bases to process your personal information:

• Consent. We may process your information if you have given us permission (i.e., consent) to use your personal information for a specific purpose. You can withdraw your consent at any time.
• Performance of a Contract. We may process your personal information when we believe it is necessary to fulfil our contractual obligations to you, including providing our Services or at your request prior to entering into a contract with you.
• Legitimate Interests. We may process your information when we believe it is reasonably necessary to achieve our legitimate business interests provided that your interests or fundamental rights and freedoms do not override those interests. For example, we may process your personal information for some of the purposes described in order to:
  • Send users information about special offers and discounts on our products and services
  • Analyse how our Services are used so we can improve them to engage and retain users
  • Understand how our users use our products and services so we can improve user experience
• Legal Obligations. We may process your information where we believe it is necessary for compliance with our legal obligations, such as to cooperate with a law enforcement body or regulatory agency, exercise or defend our legal rights, or disclose your information as evidence in litigation in which we are involved.
• Vital Interests. We may process your information where we believe it is necessary to protect your vital interests or the vital interests of a third party, such as situations involving potential threats to the safety of any person.

Legitimate interests do not replace consent where consent is required for non-essential cookies, similar technologies or advertising-related processing. See Section 6.

If you are located in Canada

We may process your information if you have given us specific permission (i.e., express consent) to use your personal information for a specific purpose, or in situations where your permission can be inferred (i.e., implied consent). You can withdraw your consent at any time.

In some exceptional cases, we may be legally permitted under applicable law to process your information without your consent, including, for example:

• If collection is clearly in the interests of an individual and consent cannot be obtained in a timely way
• For investigations and fraud detection and prevention
• For business transactions provided certain conditions are met
• If it is contained in a witness statement and the collection is necessary to assess, process, or settle an insurance claim
• For identifying injured, ill, or deceased persons and communicating with next of kin
• If we have reasonable grounds to believe an individual has been, is, or may be victim of financial abuse
• If it is reasonable to expect collection and use with consent would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province
• If disclosure is required to comply with a subpoena, warrant, court order, or rules of the court relating to the production of records
• If it was produced by an individual in the course of their employment, business, or profession and the collection is consistent with the purposes for which the information was produced
• If the collection is solely for journalistic, artistic, or literary purposes
• If the information is publicly available and is specified by the regulations

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We may share information in specific situations described in this section and/or with the following categories of third parties.

We may need to share your personal information in the following situations:

• Service Providers. We may share your information with third-party service providers who perform services on our behalf, including payment processing, data hosting, analytics, customer support, and AI content generation. See our Subprocessors page for a complete and up-to-date list.
• Independent Controllers. Some providers process information for their own purposes. Microsoft acts as an independent controller for Clarity, rather than as our processor. Stripe’s role depends on the processing concerned. Their applicable terms and privacy notices describe those roles.
• Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
• Legal Requirements. We may disclose your information where required by law, such as to comply with a subpoena or similar legal process, when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.

Key Third-Party Service Providers

For the most up-to-date list, please visit our Subprocessors page.

5. AI-GENERATED CONTENT AND DATA PROCESSING

In Short: We use third-party AI APIs to generate artistic QR codes and remove image backgrounds. Only the selected image is sent to Replicate for background removal. Each provider has its own rules on processing, retention, and model training.

Our Services include AI-powered features that allow you to generate artistic QR code designs and remove image backgrounds. When you use these features:

Data we collect:

• Text prompts you provide to describe the desired QR code design
• Images you upload as references, for embedding into QR codes, or for background removal
• The generated QR code outputs and images with their backgrounds removed

How we process this data:

• Your prompts and images are sent to Anthropic and OpenAI to generate artistic QR code designs
• For background removal, only the image you select is sent to Replicate to run the fottoai/remove-bg-2 model
• Generated QR code outputs are stored on our servers and associated with your account
• We retain this data to provide you access to your previously generated designs

How we handle your content:

• We use your prompts, uploaded images, and outputs to provide the requested generation or background-removal features; provider-specific training rules are described below
• We do not share your AI-generated content with other users unless you explicitly choose to make it public
• We do not sell your AI-generated content to third parties

Third-party AI provider policies:

• Anthropic: https://www.anthropic.com/privacy
• OpenAI: https://openai.com/policies/privacy-policy
• Replicate: https://replicate.com/privacy

We use OpenAI and Anthropic to generate artistic QR code designs from your prompts and images. For image background removal, we send only the image you select to Replicate to run the fottoai/remove-bg-2 model. OpenAI and Anthropic state that content submitted through their commercial APIs is not used to train their models by default; their policies describe exceptions for voluntary data sharing or feedback. Replicate processes the images submitted for background removal and the resulting outputs under our data processing agreement with Replicate, its service terms, and the terms applicable to the fottoai/remove-bg-2 model. These provider-specific conditions do not establish a blanket guarantee that every provider and model is subject to an identical prohibition on training. For details, see OpenAI API data controls, Anthropic commercial-data policy, and Replicate service terms.

6. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In Short: We may use cookies and other tracking technologies to collect and store your information.

We may use cookies and similar tracking technologies (like web beacons and pixels) to access or store information. We use the following types of cookies and tracking technologies:

Essential Cookies: These cookies are necessary for the website to function properly and cannot be switched off. They include session cookies, authentication tokens, and language preference cookies.

Microsoft Clarity: We use Clarity for behavioural analytics, heatmaps and session replays. It processes clicks, scrolling, mouse movements, device information, IP addresses, and user and session identifiers. This data is not necessarily anonymous. Under the Clarity terms, QR Code AI and Microsoft act as independent controllers. Microsoft collects or receives personal data for Microsoft Advertising and may use it to provide Clarity, improve Microsoft products, measure performance and build user profiles for advertising, subject to applicable consent and opt-out requirements. The Microsoft Privacy Statement explains Microsoft’s processing and your choices.

We also use PostHog software, self-hosted on Scaleway infrastructure in France, for product analytics and performance measurement. This includes page views, product interactions, device and location information, and website performance metrics. Cookies and local storage help associate activity across our website and application. After you sign in, this activity can be linked to your account identifier, name, email address, product usage, and subscription status. These analytics are therefore not limited to anonymous data.

Consent and choices: Non-essential analytics and advertising tracking require prior consent wherever applicable law requires it, including for Clarity cookies in the EEA, UK and Switzerland. You may refuse or withdraw consent without affecting the lawfulness of earlier consent-based processing. Clarity distinguishes consent for analytics from consent for advertising. Rejecting cookies alone does not necessarily stop all data collection: Microsoft documents limited collection without cookies. For consent requests, contact [email protected].

Browser controls: You can also use your browser settings to block or delete cookies. Blocking essential cookies can affect sign-in and other necessary functions. Browser settings do not replace the consent and opt-out requirements described in this notice. See Sections 12 and 13 for privacy rights and browser privacy signals.

7. HOW DO WE HANDLE GOOGLE SIGN-IN?

In Short: If you register or sign in with Google, we receive information needed to authenticate you and manage your account.

You can register and sign in using your Google account. When you do, we receive your email address and Google account identifier, together with your display name and profile picture when available. We use this information to authenticate you and create or maintain your QR Code AI account.

We will use the information we receive only for the purposes described in this privacy notice or otherwise made clear to you on the relevant Services. Google also processes information under its own privacy notice. We recommend reviewing that notice to understand how Google collects, uses, and shares your information and how you can set your privacy preferences.

8. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your information for as long as necessary to fulfil the purposes outlined in this privacy notice unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this privacy notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements).

Specific retention periods:

This 26-month period applies to our PostHog analytics. It does not set Microsoft’s retention period for its independent processing of Clarity data, which is governed by the Microsoft Privacy Statement.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymise such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

9. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We aim to protect your personal information through a system of organisational and technical security measures.

We have implemented appropriate and reasonable technical and organisational security measures designed to protect the security of any personal information we process. These measures include:

• Encryption of data in transit (TLS/HTTPS), with encryption at rest for sensitive stored information
• Access controls and authentication for internal systems
• Regular security assessments and monitoring
• Infrastructure hosted by Scaleway and DigitalOcean, with security and compliance measures that depend on the provider and hosting service
• DDoS protection and web application firewall via Cloudflare

However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorised third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

10. INTERNATIONAL DATA TRANSFERS

In Short: Your data is primarily stored in the European Union, but some data may be transferred to service providers in other countries under appropriate safeguards.

Our primary servers are located in:

• France (EU) via Scaleway
• Netherlands (EU) via DigitalOcean

However, some of our third-party service providers are located in the United States, including Cloudflare, AWS, Anthropic, OpenAI, Replicate, Google (Firebase), Microsoft (Clarity), and Rewardful. When we transfer data to these providers, we ensure appropriate safeguards are in place, including:

• EU-US Data Privacy Framework: Where applicable, we rely on the EU-US Data Privacy Framework for transfers to US-based providers that are certified under the framework.
• Standard Contractual Clauses (SCCs): We use European Commission-approved Standard Contractual Clauses as a legal mechanism for data transfers where the Data Privacy Framework does not apply.
• Contractual obligations: Our use of provider services is governed by their applicable business or API terms and data processing agreements. OpenAI and Anthropic incorporate a data processing addendum into their applicable commercial terms. Replicate's processing of images for background removal is governed by our data processing agreement with Replicate. Where a provider acts as our processor, we require its processing to be governed by the safeguards and contractual obligations required by applicable data protection law.

Microsoft acts as an independent controller for Clarity; its processing and international transfers are described in its own privacy statement and the applicable Clarity terms, rather than an assumption that Microsoft processes this data solely on our instructions.

For more information about the specific safeguards in place for each provider, please refer to our Subprocessors page.

11. DO WE COLLECT INFORMATION FROM MINORS?

In Short: We do not knowingly collect data from or market to children under 18 years of age.

We do not knowingly solicit data from or market to children under 18 years of age. You must be at least 18 years old to create an account or use our QR code creation and management services. Parental or guardian consent does not permit a person under 18 to create an account or use those services. If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at [email protected].

12. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: Depending on your location, you may have rights including access, correction, deletion, and portability of your personal information.

European Economic Area (EEA), United Kingdom (UK), and Switzerland

If you are located in the EEA, UK, or Switzerland, you have certain rights under applicable data protection laws. These include:

• Right of access: You can request a copy of the personal information we hold about you.
• Right to rectification: You can request that we correct inaccurate or incomplete personal information.
• Right to erasure: You can request that we delete your personal information, subject to certain exceptions.
• Right to restrict processing: You can request that we limit how we use your personal information.
• Right to data portability: You can request a copy of your data in a structured, commonly used, and machine-readable format.
• Right to object: You can object to our processing of your personal information based on legitimate interests.
• Right to withdraw consent: If we rely on your consent, you can withdraw it at any time.

To exercise these rights, please contact us at [email protected]. We will respond within 30 days.

If you believe we are unlawfully processing your personal information, you have the right to complain to your local data protection authority:

• EU: Your Member State data protection authority
• UK: The Information Commissioner's Office (ICO)
• Switzerland: The Federal Data Protection and Information Commissioner (FDPIC)
• France: Commission Nationale de l'Informatique et des Libertes (CNIL)

California (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you the following rights:

• Right to know: You can request information about what personal information we have collected, used, disclosed, and sold about you in the past 12 months.
• Right to delete: You can request that we delete the personal information we have collected from you, subject to certain exceptions.
• Right to correct: You can request that we correct inaccurate personal information we maintain about you.
• Right to opt out of sale/sharing: Disclosure of identifiers and interaction data to Microsoft through Clarity for advertising may qualify as a sale or sharing under the CCPA. Where the CCPA applies, you have the right to opt out of that sale or sharing, including through a recognised opt-out preference signal such as Global Privacy Control (GPC). Contact [email protected] to submit an opt-out request; no account or identity verification is required for that request.
• Right to limit use of sensitive information: We do not use or disclose sensitive personal information for purposes other than those permitted by the CCPA.
• Right to non-discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

To exercise your rights, please contact us at [email protected]. We verify identity where required for access, deletion or correction requests and respond within 45 days, subject to any extension permitted by law. Sale/sharing opt-out requests are handled as soon as feasible and no later than 15 business days; the 45-day period does not apply to those requests.

Canada

If you are located in Canada, you may have the right to request access to and correction of your personal information, or to withdraw your consent to our processing of your information. To exercise these rights, contact us at [email protected].

Opting out of marketing communications

You can unsubscribe from our marketing and promotional communications at any time by clicking on the unsubscribe link in the emails that we send, or by contacting us at [email protected]. You will then be removed from the marketing lists. However, we may still communicate with you, for example, to send you service-related messages that are necessary for the administration and use of your account, to respond to service requests, or for other non-marketing purposes.

Account Information

If you would at any time like to review or change the information in your account or terminate your account, you can contact us at [email protected]. Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases within 30 days. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms and/or comply with applicable legal requirements. Backup data is purged within 6 months.

Cookies and similar technologies

Section 6 explains the use of cookies, consent requirements and browser controls. You may contact [email protected] to refuse or withdraw consent to processing based on consent. Rights concerning sale or sharing and recognised opt-out preference signals remain applicable independently of browser cookie settings.

If you have questions or comments about your privacy rights, you may email us at [email protected].

13. DO-NOT-TRACK AND GLOBAL PRIVACY CONTROL

Do Not Track (DNT) and Global Privacy Control (GPC) are different browser signals. We do not currently respond to DNT signals. Microsoft states that Clarity supports GPC, which can communicate a request to opt out of sale or sharing where applicable law recognises it. Our treatment of DNT does not limit your right to use a legally recognised opt-out preference signal. See Section 12 for sale/sharing rights and contact details.

14. DO WE MAKE UPDATES TO THIS NOTICE?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this privacy notice from time to time. The updated version will be indicated by an updated "Last updated" date and the updated version will be effective as soon as it is accessible. If we make material changes to this privacy notice, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this privacy notice frequently to be informed of how we are protecting your information.

15. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?

If you have questions or comments about this notice, you may email us at [email protected] or contact us by post at:

Supernovae 27 Rue Wurtz Juvisy-sur-Orge, Ile-de-France 91260 France

16. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

You have the right to request access to the personal information we collect from you, change that information, or delete it. To request to review, update, or delete your personal information, please email us at [email protected]. We will respond to your request within 30 days.