Privacy Policy

1. Who This Policy Covers

This Privacy Policy explains how RepQR, LLC (“RepQR,” “we,” “us”) collects, uses, shares, and protects personal information. It covers two groups of people:

• Customers — the businesses and individuals who create RepQR accounts and use our platform.
• Visitors and end users — people who scan a QR code, visit a page hosted by our platform, submit a form, or register for an event run by one of our customers.

If you interacted with one of our customers (for example, you scanned a business’s QR code or filled out their contact form), that business decides how your information is used. We process it on their behalf as a service provider. For questions or requests about your information, contact the business you interacted with directly; we also honor requests sent to us as described in Section 11.

2. Information We Collect From Customers

• Account information: name, email address, phone number, business name and address, industry, and login credentials. If you sign in with a third-party account (such as Google, Microsoft, or Apple), we receive your name, email, and profile image from that provider.
• Billing information: your purchases and subscription status. Payments are handled by our payment processor; we do not store full card numbers.
• Content you provide: videos, photos, logos, audio, scripts, page content, print designs, and business details you add to the platform.
• Voice and likeness data you choose to provide for AI features — see Section 5.
• Contacts you manage: contact lists and lead records you store in the platform.
• Usage data: how you use the platform (features used, pages visited, device and browser information, IP address) and your correspondence with us.

3. Information Collected From Visitors & End Users

When you interact with a page, QR code, form, or event hosted by our platform, we collect the following on behalf of the business you interacted with:

• Information you submit: whatever you type into a form — typically name, email, phone, and your answers to the business’s questions; event registration details; contact information you choose to exchange.
• Interaction analytics: when a QR code is scanned or a page or video is viewed, we log the date and time, IP address, approximate location derived from IP (city/region level), device type, operating system, browser, referring page, and campaign parameters. A first-party session identifier (Section 8) links a scan to the resulting page visit.

This analytics data is used to give the business accurate statistics (for example, how many people scanned a card) and to detect abuse. It is not used to build advertising profiles, and it is never sold.

4. How We Use Information

• Provide, operate, and maintain the platform and fulfill orders (including producing and shipping print products);
• Generate the content our customers request, including AI-assisted videos, designs, and copy;
• Deliver communications our customers send through the platform, and send our own transactional messages (receipts, account notices, service updates);
• Provide analytics and reporting to the relevant customer;
• Protect the platform — detect fraud, abuse, and security incidents; enforce our terms;
• Improve the platform and develop new features;
• Comply with legal obligations.

We may send customers marketing about our own products; you can opt out at any time via the unsubscribe link or by emailing us. We do not use end-user information for our own marketing.

5. Voice & Likeness Data (Biometric Information)

Some features let customers create AI-generated videos featuring their own voice and appearance. If you choose to use them, we collect, with your express prior consent:

• Voice recordings you make, used to create a digital voice model that narrates your videos; and
• Photos of you you upload, used to create a digital likeness that appears in your videos.

Consent. We ask for your consent at the moment of capture, before any recording or photo is processed for these purposes. These features are optional — you can always use stock voices and presenters instead.

How it is used and shared. Your voice and likeness data is used solely to generate the content you request. It is processed by contracted AI service providers acting on our behalf, under agreements that restrict them from using it for other purposes. We never sell, lease, or trade voice or likeness data, and we do not use it to identify people.

Retention and destruction schedule. Voice recordings, photos used for likeness generation, and the resulting digital models are permanently destroyed upon the earliest of: (a) your verified deletion request; (b) deletion of your account (after the standard 30-day grace period); or (c) three years after your last interaction with the platform. To request deletion at any time, email hello@repqr.com.

6. When Information Is Shared

We do not sell personal information, and we do not share it with third parties for their own marketing. Information is shared only in these circumstances:

• Service providers working for us. We use contracted providers to run the platform, limited to what each needs to perform its function: payment processors; cloud hosting, storage, and content-delivery providers; AI service providers that generate requested content; email and text-message delivery providers; print production and shipping partners (who receive the design and delivery address needed to produce and deliver an order); and analytics and security infrastructure. These providers are bound by contracts that prohibit using your information for their own purposes.
• The customer you interacted with. End-user information collected through a customer’s pages, forms, and events is shared with that customer — it is collected for them.
• Public content. Content a customer chooses to publish (landing pages, event pages, videos embedded on them) is visible to anyone with the link.
• Legal requirements. We may disclose information to comply with law, enforce our terms, or protect the rights, safety, and property of RepQR, our customers, or others.
• Business transfers. If RepQR is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to this policy.

7. Text Messaging (SMS)

If you opt in to receive text messages (from us or from a business using our platform), we collect your phone number and your consent status, and we log message delivery.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be sold, rented, or shared with any third parties, excluding messaging-delivery subcontractors that help us send the messages you requested.

You can opt out of text messages at any time by replying STOP, or get help by replying HELP. See our Mobile Messaging Terms for full details.

8. Cookies

We use a small number of first-party cookies only. We do not use third-party advertising cookies, ad pixels, or cross-site tracking.

• Authentication cookies keep customers signed in to their accounts (essential).
• A session cookie (30 days) is set when you scan a QR code or visit a hosted page. It lets us count unique visits accurately and connect a scan to the page visit it led to. It does not follow you to other websites.

Because these cookies are first-party and functional, no consent banner is required; you can block or clear cookies in your browser settings, though signing in requires the authentication cookie.

9. Data Retention

• Customer accounts and content: retained while the account is active; deleted after a 30-day grace period following cancellation or termination (billing records are kept as required by tax and accounting law).
• Voice and likeness data: see the destruction schedule in Section 5.
• End-user form submissions and contacts: retained for the customer they belong to, per that customer’s settings, until the customer deletes them or the account closes.
• Scan and page analytics: retained to provide historical reporting to the customer while their account is active.
• Event guest analytics for one-time event packages are retained for the event’s stated analytics window.

10. Security

We protect information with industry-standard measures, including encryption in transit (TLS), encrypted storage, private media storage served through signed delivery, role-based access controls, verified webhooks, rate limiting, and audit logging of sensitive administrative actions. No method of transmission or storage is 100% secure, but we work to protect your information and will notify affected users of a breach as required by law.

11. Your Privacy Rights & Choices

You may request that we:

• Access the personal information we hold about you;
• Correct inaccurate information;
• Delete your information (including voice/likeness models — Section 5);
• Export a copy of your information in a portable format;
• Opt out of our marketing emails (unsubscribe link) and text messages (reply STOP).

Send requests to hello@repqr.com. We will verify your identity and respond within 45 days. If your information was collected by a business using our platform, we may refer your request to that business (they control it), and we will assist them in fulfilling it. We will not discriminate against you for exercising any privacy right.

12. US State Privacy Rights

Residents of California and other states with comprehensive privacy laws have specific rights, including the rights described in Section 11 and the right to know the categories of information collected and shared. For clarity:

• We do not sell personal information and have not done so in the preceding 12 months.
• We do not share personal information for cross-context behavioral advertising.
• We disclose personal information only to service providers and contractors as described in Section 6.
• Categories collected are described in Sections 2, 3, and 5; purposes in Section 4; retention in Section 9.

To exercise rights, use the contact in Section 11. Authorized agents may submit requests on your behalf with proof of authorization.

13. Children

The Service is intended for business use by adults. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us and we will delete it.

14. Where Data Is Stored

Our services are operated from the United States, and information is stored and processed in the United States. If you access the Service from outside the US, you understand that your information will be transferred to and processed in the US, where privacy laws may differ from those in your jurisdiction.

15. Changes to This Policy

We may update this policy from time to time. For material changes, we will notify customers by email or through the platform before the changes take effect. The “Last updated” date above reflects the current version.

16. Contact Us

RepQR, LLC
Email: hello@repqr.com
Web: repqr.com/contact