Privacy Policy
Last updated: 7 October 2026
This page explains what QRVivid (“we”, “us”) knows about you when you use qrvivid.com, and what you can do about it.
We wrote it to meet Hong Kong’s Personal Data (Privacy) Ordinance (PDPO), the EU GDPR and the UK GDPR, and US state privacy laws.
The short version:
- Your QR codes are made in your own browser. What you type and the photos you pick never reach us. We cannot see them.
- We do not have accounts, so we do not ask for your name or email.
- To count visitors we use a tool that sets no cookies and builds no profile of you.
- The site is free because of ads. Ad companies may use cookies. In Europe, the UK and Switzerland, we ask you first.
- We never sell your data.
1. Who is responsible
QRVivid is in charge of your data. In legal words, we are the “data user” (PDPO) and the “controller” (GDPR). QRVivid is a small business in Hong Kong, run by one person.
To reach us about privacy, email [email protected]. If you need our full legal name and postal address (for example, to send a formal letter), email us and we will give them to you.
2. What we do not collect
When you make a code, these stay on your device:
- the link, text, Wi‑Fi name and password, contact details or anything else you type,
- the photo or picture you pick,
- the finished code.
They are never uploaded, stored or logged by us. The code is drawn and checked by your own browser. You can check this yourself: the site works with no internet connection once the page has loaded.
Your browser may remember small settings, like the size you picked. That data stays in your browser.
3. What is collected, and why
| What | Who collects it | Why | Legal basis (GDPR) |
|---|---|---|---|
| Your IP address, browser type and the page you asked for | Cloudflare, which runs the site for us | To send you the page and protect the site from attacks | Legitimate interests (running a safe website) |
| Page views, counted without cookies (page, country, browser type, where you came from) | Cloudflare Web Analytics | To see which pages help people | Legitimate interests |
| Cookies and similar tech for ads (see section 4) | Google and its ad partners | To show ads, measure them and stop ad fraud | Consent in the EEA, UK and Switzerland; legitimate interests elsewhere for non-personalised ads |
| What you write when you email us | Us | To answer you | Legitimate interests |
We do not use your data to make automated decisions about you.
4. Ads
QRVivid is free because we show ads. We use Google AdSense. Google and its partners may use cookies, device IDs and your IP address to show ads, to limit how often you see the same ad, to measure ads and to stop fraud.
- Personalised ads use what Google knows about your interests. In the European Economic Area, the UK and Switzerland, we only allow these after you say yes in the consent message. You can change your choice at any time with the “Privacy choices” link at the bottom of every page (it appears once ads are switched on).
- In some US states you can opt out of the “sale” or “sharing” of your data for ads with the same link.
- You can also turn off personalised ads from Google for every site at Google’s ad settings.
To learn how Google uses data from sites like ours, read How Google uses information from sites or apps that use our services.
Until ads are switched on, no ad cookies are set.
5. Who else sees data
We share data only with the companies that run parts of the site:
| Company | What it does for us | Where |
|---|---|---|
| Cloudflare, Inc. | Hosting, security, visitor counts, email forwarding | Worldwide (US company) |
| Google LLC / Google Ireland | Ads (AdSense) and search statistics (Search Console) | Worldwide (US company) |
| Google LLC (Gmail) | The inbox our email addresses forward to | Worldwide (US company) |
These companies may handle data outside Hong Kong and outside your country. Where the law asks for it, they protect it with standard contract clauses approved by the European Commission and the UK.
We may also share data if the law makes us, or to protect people from harm.
6. How long it is kept
- Cloudflare security logs: a short time, under Cloudflare’s own rules.
- Visitor counts: kept as totals, not linked to you.
- Ad data: under Google’s rules. You can delete Google ad cookies in your browser at any time.
- Emails to us: up to 2 years after our last reply, then deleted.
7. Your rights
You can ask us to:
- show you the data we hold about you,
- correct it,
- delete it,
- stop using it, or object to how we use it,
- give it to you in a common file format.
You can take back your consent for ads at any time with “Privacy choices”.
Email [email protected]. We reply within 30 days. We do not charge, unless a request is clearly unreasonable.
If you are not happy with our answer, you can complain to Hong Kong’s Privacy Commissioner for Personal Data, or to the data protection authority where you live (in the UK, the ICO).
8. Children
QRVivid is not made for children under 13 (under 16 in the EEA). We do not knowingly collect data from them. Ads on pages are not targeted at children.
9. Security
The site only works over an encrypted connection (HTTPS). Because your codes and photos never leave your device, there is nothing of yours on our side to leak.
10. Changes
If we change this policy, we will update the date at the top. If a change is big, we will say so on the home page for a while.