Privacy Policy

We collect as little personal data as we can and never sell it. This policy explains what we collect, why, and the choices you have. It follows Thailand’s Personal Data Protection Act (PDPA) and, where it applies, the EU General Data Protection Regulation (GDPR).

Last updated: October 11, 2026

1Who we are

qr-th.com is operated by QR-TH, the data controller for the personal data described here. You can reach us at support@qr-th.com.

2Data we collect from you

  • Account: name, e-mail address, password (stored only as a secure hash), language and notification settings.
  • Sign-in with Google or LINE: your name, e-mail address and account ID from that service. If you turn on LINE alerts, your LINE user ID is used to send them.
  • Your content: QR code content, links, names, folders, uploaded files (images, PDFs, videos) and hosted pages.
  • Payments: plan, amount, date and status, and any payment slip you upload. Card payments are handled by Stripe or Omise; we never receive your full card number.
  • Messages: what you send through our contact form or by e-mail.
  • Technical data: IP address and browser type, used for security and to stop abuse.

3Data about people who scan your codes

We do not identify people who scan QR codes. For each scan we count only the date, hour, device type (iOS, Android or other) and country, worked out from network information. We do not store scanners’ IP addresses and do not use tracking cookies for scan statistics. If a page is password-protected, a cookie remembers the correct password for 24 hours.

4How we use your data

  • to provide the Service: create codes, host pages, show statistics and run team workspaces;
  • to keep the Service safe: check links with Google Safe Browsing, prevent spam and fraud, and limit repeated sign-in attempts;
  • to send service e-mails, such as confirming your address, resetting your password, payment receipts and the scan alerts you choose;
  • to process payments and keep accounting records;
  • to answer your questions and improve the Service.

We do not show ads and we do not sell or rent personal data.

5Legal bases

We process data to perform our contract with you, for our legitimate interests in keeping the Service secure and working well, to meet legal obligations such as tax and accounting rules, and with your consent for optional features like scan alerts. You can withdraw consent at any time in your profile.

6Cookies and local storage

We only use cookies that the Service needs to work:

  • a session cookie that keeps you signed in;
  • a short-lived cookie that protects the Google or LINE sign-in process;
  • a cookie that remembers the password of a protected page.

Your browser also stores your language choice. We do not use advertising or cross-site tracking cookies. Fonts are loaded from Google Fonts and some scripts from the jsDelivr network, which receive your IP address as part of normal web requests.

7Who we share data with

We share data only with providers that help us run the Service, under agreements that protect it: our hosting provider, our e-mail delivery provider, Stripe and Omise for payments, Google for sign-in and link safety checks, and LINE for sign-in and messages. Team members you invite can see the content of your workspace. We may disclose data if the law requires it or to protect people from harm.

8International transfers

Our providers may process data outside your country. When that happens, we rely on safeguards required by law, such as standard contractual clauses or the provider’s certified data protection policies.

9How long we keep data

  • Account data and content: while your account is active. When you ask us to delete your account, we delete it within 30 days.
  • Scan statistics: as long as the QR code exists.
  • Payment records: as long as tax and accounting law requires.
  • Contact messages: up to 2 years.
  • Backups: overwritten within 14 days.

10Security

We use HTTPS, store passwords with the scrypt hashing algorithm, use secure HttpOnly cookies, limit access to personal data, and keep regular backups. No system is perfectly secure, so please use a strong, unique password. If a breach affects you, we will tell you and the authorities as the law requires.

11Your rights

You can ask to access, correct, delete or receive a copy of your data, object to or restrict how we use it, and withdraw consent. You can export your scan statistics as CSV from your dashboard at any time. To use your rights, write to support@qr-th.com; we reply within 30 days. You may also complain to Thailand’s Personal Data Protection Committee (PDPC) or to the data protection authority in your country.

12Children

The Service is not intended for children. If you are under the age at which you can consent to data processing in your country, please use QR-TH only with a parent’s or guardian’s permission. If you believe a child has given us personal data, contact us and we will delete it.

13Changes and contact

We will update this policy when our practices change. The date at the top shows the latest version, and we will tell you by e-mail about significant changes. Questions? Write to support@qr-th.com or visit our contact page.

Back to top