Privacy policy

We collect what is needed to make your codes and to show you how they are scanned, and nothing for advertising.

Last updated 5 November 2026

Who we are

PaintQR is PaintQR, a business name registered in Australia and held by a sole trader in the Australian Capital Territory, and its holder is responsible for the personal information described here. The holder's name and ABN are on every invoice and available on request. Contact: [email protected].

What we collect when you make a code

To generate a code we receive and store:

• the link, contact card or text you enter;
• the picture you upload, reduced to at most 1,000 pixels, and a small copy used for the style previews;
• the options you choose and the generated result.

What we collect when someone scans an editable link

For each scan of an editable link we record the time, the country, the device family (iPhone, Android, computer) and a one-way code derived from the visitor's address with a key that changes every day. That code lets us count unique visitors without storing the address itself. We do not store the visitor's IP address and do not set cookies on the forwarding page.

When you sign in

Sign-in is provided by Google Firebase Authentication. We receive your email address, your name if you sign in with Google, and an identifier for your account, and we keep them together with the list of designs you made or bought while signed in. We do not receive or store passwords. Google's handling of the sign-in itself is covered by Google's privacy policy.

When you buy

Payments are handled by Stripe, which collects your card details, billing address and email address under its own privacy policy; card details never reach us. From Stripe we keep the order: the design it covers, the amount, the currency, the email address used, and Stripe's identifiers for the payment, so we can prove the purchase, issue a refund and let you download again. If you buy without an account, your receipt email carries a link that unlocks the files in any browser; we do not send marketing email.

When you contact us

If you send a message or a report, we keep your email address and message so we can reply.

Where it is kept

Designs, pictures, accounts and orders are stored on our server in Sydney, Australia (hosted by Kamatera), with nightly backups kept on the same server for seven days. Editable links and scan records are kept by Cloudflare and served from its network. Card details are handled by Stripe and never reach us. Cloudflare sits in front of the site and sees the traffic to it, as for most websites.

How long

We keep designs so that you can download them again, and orders for as long as tax law requires (seven years in Australia). Scan records are kept for as long as the editable link exists. You can remove a design from your account yourself, and you can ask us to delete any design, picture, account or message, and we will do so within 30 days, except for the order records we must keep.

Your rights

You can ask what we hold about you, ask for a copy, ask us to correct or delete it, or complain about how we handled it, by writing to [email protected]. If you are not satisfied with our answer you can contact the Office of the Australian Information Commissioner, or your local data protection authority if you are in the European Union or the United Kingdom.