Privacy Policy

Last updated: 09/09/2026

This policy explains what personal data FINORIOUS LIMITED processes when you use QR Links, and the choices you have. It is designed to meet the requirements of the EU General Data Protection Regulation (GDPR).

Data we process

Account data — email address, username, display name, password hash, language and theme preferences, your two-factor authentication secret (stored encrypted) if you enable it, and (for paid accounts) the billing details you provide for invoicing.
Content you upload — a profile picture, and, on plans that allow it, the brand and QR-code logo images you choose to use.
QR content you create — depending on the type of QR code or page you create, this may include a WiFi network name and password, vCard contact details (name, phone, email, address), Business Page or Menu content (hours, contact info, item descriptions), a Link in Bio profile and its links, or Digital CV content (your professional summary, work history, education, skills, languages, certifications, projects, and any reference names or contact details you choose to include), and any photos or logos you upload for these. This data is provided by you and displayed to people who scan or visit the resulting page — a Digital CV can also be downloaded by visitors as a PDF, generated on demand from your current CV content and not stored separately by us.
Payment data — handled by our payment providers (e.g. Stripe, PayPal, Viva.com); we store transaction references and invoices, never card numbers.
Social sign-in (optional) — if you sign in with Google, Apple or Microsoft, we receive your account email and identifier from that provider to create or match your account.
Referral programme (if you take part) — the link between a referrer and the people they refer, and the resulting commissions.
Visitor analytics — when someone opens a short link we record technical data: IP address, a hashed IP for de-duplication, approximate location (country, and on some plans city level), browser, device type, and referring page. Link owners see only masked IPs.
Cookies — see the Cookie Policy.

Form submissions from your visitors

If you use the Form Builder, people who fill in your form ("respondents") submit the information you ask for — which may include their name, email, phone number, and free-text answers — together with their IP address for abuse-prevention purposes. This data is stored so you (the form owner) can view it, receive an optional email notification, and export it as a CSV file. In relation to this data, you act as the data controller and are responsible for telling your respondents how their data will be used and obtaining any consent required by law; FINORIOUS LIMITED acts as a data processor, storing and delivering the data on your instructions. Respondents who wish to exercise a data-subject right over data they submitted through a form should contact the form owner directly; where we are asked to assist, we will support the form owner in fulfilling that request.

Contact messages sent through your pages

If you enable the "send a message" contact box on a vCard, Business Page, Menu, Link in Bio, or Digital CV page, visitors who use it submit their name, email address, and message, which is stored so you can read and respond to it, with an optional email notification sent to you. The same data-controller/data-processor relationship described above for form submissions applies to these messages.

Orders placed from your Menu pages

If you switch on ordering for a Menu page, visitors who place an order ("customers") submit the details needed to fulfil it — their name and, depending on the fulfilment options you offer, a table number for dine-in, a phone number for take-out, or a phone number and delivery address for delivery — together with an optional note and their IP address for abuse-prevention purposes. No payment is taken or requested at any point: an order is a record for you and your staff, and no card or bank details are collected or stored. Each order is saved with a snapshot of the items and prices as they stood when it was placed, so that you (the menu owner) can view it, receive an optional email notification, filter and export orders as a CSV file, and mark them as completed. In relation to this data you act as the data controller and are responsible for telling your customers how their data will be used, for using it only to prepare and fulfil the order, and for deleting it once you no longer need it; FINORIOUS LIMITED acts as a data processor, storing and delivering the data on your instructions. Customers who wish to exercise a data-subject right over data they submitted with an order should contact the menu owner directly.

Bookings made on an Appointments page

If you create an Appointments page, visitors who book ("clients") submit the details needed to manage the appointment — their name, an email address for the confirmation, optionally a phone number and a note, answers to any intake questions you configured, and their IP address for abuse-prevention purposes. No payment is taken or requested at any point: any prices shown are informational only, and no card or bank details are collected or stored. Each booking is saved with a snapshot of the service, time and staff member as they stood when it was made, so that you (the page owner) can view and manage it, receive notifications, export bookings as a CSV file, and have reminder emails sent before the appointment; the confirmation email contains a private link the client can use to cancel or reschedule within the rules you set. In relation to this data you act as the data controller and are responsible for telling your clients how their data will be used, for using it only to manage the appointment, and for deleting it once you no longer need it; FINORIOUS LIMITED acts as a data processor, storing and delivering the data on your instructions. Clients who wish to exercise a data-subject right over data they submitted with a booking should contact the page owner directly.

References you add to a Digital CV

If you add a reference to a Digital CV, the name and contact details you enter are personal data about someone who is not our customer. You are responsible for having that person's permission to include their information and for telling them it will be displayed to anyone who scans or visits your CV, or downloads it as a PDF. FINORIOUS LIMITED does not independently verify this and acts only on your instructions as the person who added the reference.

Purposes & legal bases

We process data to provide the service (contract), to secure it and prevent abuse (legitimate interest), to comply with tax and accounting law (legal obligation), and — only with your consent — to send marketing email, which you can leave with one click in any such message.

Retention

Account data is kept while your account exists. Invoices are retained as required by tax law. Visit analytics are retained for the operation of the service and may be purged periodically. Form submissions and contact-box messages are retained until the owner deletes them or deletes the associated item, at which point they are permanently removed. WiFi, vCard, Business Page, Menu, Appointments (including their bookings), Link in Bio, and Digital CV content (including any references added to a CV) are retained for as long as the associated item exists in your account; a Digital CV PDF is generated on demand and is not stored by us.

Your rights

You may request access, correction, export, or deletion of your personal data, and you may object to or restrict processing. Contact contact@qrl.finorious.com. You may also lodge a complaint with your supervisory authority.

Controller

FINORIOUS LIMITED — contact: contact@qrl.finorious.com.

← QR Links