Fresh Streams Works Ltd. (“we”, “us”), operator of FreshExe QR, is the data controller for the personal data described in this notice. This notice explains what we collect, why, who we share it with, and what rights you have.
Data we collect and why
- Account data (email address, authentication identifiers, and name or profile picture if you sign in with Google) — to create and secure your account. Legal basis: performance of our contract with you.
- QR code content (the links, text, WiFi details, contact details or messages you encode, plus labels and colour settings) — to generate codes and show your saved history. Legal basis: contract performance.
- Anonymous inbox data (inbox title, prompt, expiry, and the messages people send you) — to operate the inbox feature. We do not collect names or accounts from anonymous senders. Legal basis: contract performance.
- Technical and security data (IP address, device and browser information, request logs) — to keep the Service secure, prevent abuse and diagnose faults. Legal basis: our legitimate interest in a secure, working service.
- Support correspondence — to answer your questions. Legal basis: legitimate interests / contract.
- Subscription records(subscription status, plan, billing period) — to give paying customers access to Pro features. Card details are never collected or stored by us. Legal basis: contract performance and legal obligation.
Who we share data with
- Paddle.com, our Merchant of Record, for the sale of subscriptions, payment processing, subscription management, invoicing and tax compliance.
- Infrastructure and service providers that host the application, database and authentication on our behalf, acting as processors under contract.
- Professional advisers (legal, accounting) and authorities where we are required to disclose by law.
We do not sell personal data or share it for third-party advertising.
International transfers
Our providers may process data outside your country, including outside the UK/EEA. Where that happens we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses.
Retention
Account data, saved QR codes and inbox messages are kept while your account is active and are deleted when you delete the item or your account. Anonymous inboxes and their messages are deleted when the inbox is deleted, and expired inboxes stop accepting messages at their expiry time. Billing and tax records are retained by Paddle for as long as the law requires. Security logs are kept for a short period and then deleted or anonymised.
Your rights
Subject to applicable law, you have the right to access your data, correct it, have it erased, restrict or object to processing, receive it in a portable format, and withdraw consent where processing relies on consent. If you are in the UK or EEA, you can also complain to your data protection supervisory authority. We respond to requests within one month.
Security
We apply appropriate technical and organisational measures, including encrypted transport, database-level access controls that restrict each account to its own records, and least-privilege access for administrative operations.
Cookies and local storage
We use strictly necessary cookies and browser storage to keep you signed in and to remember basic preferences. We do not use advertising cookies. Paddle may set cookies during checkout to process your payment and prevent fraud; you can manage cookies in your browser settings.
Contact
Fresh Streams Works Ltd. — privacy enquiries: privacy@freshexe.com.