QueReview privacy policy
Last updated: 26 August 2026
Who we are
QueReview is operated by [COMPANY LEGAL NAME] Ltd, a company incorporated in Cyprus with registration number [HE NUMBER] and registered office at [REGISTERED ADDRESS], Cyprus ("QueReview", "we"). We are the data controller for the personal data described in this policy.
For anything about your data, write to hello@quereview.com.
What we collect
If you create an account as a business owner, we hold your email address, the business you link (its name and its Google review link), the QR codes you create with their settings and destinations, and the usage counters your plan is measured by. Payments are handled by Stripe; we never see or store card numbers.
If you scan a QR code as a customer, you do not need an account and we do not ask who you are. To build your draft we process the options you tap and any text you type, at that moment, for that draft. The review itself is posted by you on Google under your own Google account; it does not pass through our servers on the way.
For the business owner’s analytics we record technical events per QR code: a scan, a generated draft, a copy. Your IP address is stored only as a salted hash, used to count unique visits and prevent abuse; the hash cannot be turned back into your address. We keep no profile of the people who scan.
Cookies: a session cookie for signed-in owners and a cookie that remembers your language choice. No advertising cookies and no cross-site tracking.
Why we process it
Each use rests on one of three legal bases:
- Performing our contract with you: running your account, your QR codes and your billing.
- Our legitimate interest: keeping the service secure, preventing abuse, and giving each owner analytics about their own codes.
- Legal obligations: invoicing and tax records.
Who helps us process it
We use a small set of processors, each for one job, each bound by a data processing agreement:
- Cloudflare: hosting, storage and the AI that drafts review text (Workers AI).
- Stripe: payments, subscriptions and invoices.
- Resend: the sign-in emails.
- Google: the business search when an owner links their business, and safety screening of destination links.
Where it goes
Some of these providers process data in the United States or other countries outside the European Economic Area. Where they do, the transfer relies on a European Commission adequacy decision or on standard contractual clauses.
How long we keep it
Account data lives as long as the account does. Invoices and billing records are kept for as long as tax law requires. Per-code analytics events are kept while the linked account exists. The text processed to build a draft is not kept as part of any profile of you.
Your rights
You can ask for access to your data, correction, deletion, restriction, portability, and you can object to processing based on legitimate interest. Write to hello@quereview.com and we will answer within a month.
You can also complain to a supervisory authority: the Office of the Commissioner for Personal Data Protection in Cyprus, or the authority of the EU country where you live. In Spain that is the AEPD (aepd.es).
Changes
Any change to this policy is posted here with a new date above. A change that meaningfully affects account holders is also announced by email before it applies.