Privacy notice.

Who we are

Victor Ideson trading as QRFill is responsible for the personal information described in this notice. Our business address is 3 Rowan Drive, Ponteland, Northumberland, NE20 9QJ. Contact hello@qrfill.co.uk or 07903 027530 about your information or to exercise your rights.

This notice covers our public website and demonstration, customer portal, enquiries and business supply service.

Information we use and where it comes from

We receive names, work contact details, business and delivery details, supply requirements and correspondence from you or your employer. The customer portal holds account identifiers, business membership, agreed products and prices, orders, delivery information and account-management records. We use relevant invoice and payment records when supplying you. We do not collect payment-card details through the website; payment arrangements are made separately by bank transfer.

Our hosting and authentication providers process technical information, such as IP addresses, browser/device details, requests and security logs, to operate and protect the service. We also keep database exports for recovery.

The public demo uses a fictional shared customer. Other visitors can see demo activity. Please do not enter personal or confidential information in the demo. Its example orders do not create purchases. Contact links open your email or telephone application.

Why we use information

For enquiries and orders from individuals, including sole traders, we use information to take requested steps before a contract and to perform that contract. For contacts acting for a company, our lawful basis is our legitimate interest in communicating with that business, providing account access and fulfilling its orders.

We also rely on legitimate interests to keep proportionate security and management records, recover the service after a failure, prevent misuse and deal with disputes. We rely on legal obligations for records we must keep for tax and accounting. Essential contact, account and delivery details are needed to provide the requested service; without them we may be unable to set up access or supply an order.

Placing an order does not mean agreeing to unrelated marketing. Any marketing must have an appropriate lawful basis and an opt-out, with consent where required. We do not make solely automated decisions that have legal or similarly significant effects on you.

Who receives information

Supabase provides our customer database and authentication. Cloudflare hosts the customer portal. OpenAI Sites hosts the public website and shared demonstration. Porkbun hosts our email mailbox, which we access through Microsoft Outlook; Outlook can synchronise mailbox content through Microsoft cloud services. Apple iCloud Drive holds a separate recovery copy of our database, alongside local copies.

Suppliers and delivery providers receive the contact and delivery information needed to fulfil agreed orders. Banks, professional advisers and public authorities may receive relevant information where necessary for their work or a legal obligation. We do not sell customer information. Service providers may also process operational information for purposes described in their own privacy notices.

Where information is processed

Our Supabase project database is hosted in Frankfurt, Germany. This does not mean that all support, email, hosting or backup processing stays in Germany or the UK. Our providers operate internationally, including in the United States and other countries where they and their service providers operate.

The hosting and processing agreements for Supabase, Cloudflare, Porkbun and OpenAI Sites include international-transfer provisions, including contractual safeguards for UK data where applicable. OpenAI's Sites agreement incorporates Standard Contractual Clauses with the UK Addendum. Microsoft describes its participation in the UK Extension to the EU–US Data Privacy Framework, and Apple describes Standard Contractual Clauses for transfers involving UK data. The mechanism depends on the provider and transfer; these are not promises of UK-only storage. Contact us for information about the safeguards relevant to your data and how to obtain a copy.

How long we keep information

Our policy is to delete unsuccessful enquiries 12 months after the last meaningful contact unless an ongoing matter or legal reason requires them. Account information is kept while needed to provide the account; unnecessary account details are reviewed for deletion within 12 months of closure. Closing an account does not automatically remove order or invoice records that we must retain.

Relevant self-employment tax records are normally retained for at least five years after the 31 January submission deadline for the relevant tax year. Longer periods may be needed for late returns, tax enquiries, disputes or other legal obligations. Only information relevant to those purposes is retained.

Recovery exports are managed manually, not on an automatic expiry schedule. We review whether a copy is still needed when replacing it, taking account of whether a newer backup has been verified, recovery needs and any outstanding incident or legal hold. Deletion requests also need to be considered when reviewing backups; if a backup is restored, applicable deletions must be reapplied. Technical logs are kept according to the provider's service settings and the time needed to diagnose faults, investigate security incidents or meet legal obligations. Records retained for an unresolved incident are reviewed when that matter closes.

Cookies and similar storage

The customer portal uses browser storage through Supabase to maintain your signed-in session. This is needed for the account service you request. It can remain between visits until you sign out, clear site data or the session is otherwise ended. Sign out on shared devices. Clearing or blocking this storage may stop sign-in working; it does not delete your customer account or orders.

The demo's PIN state is held in memory while its page is open. Our photo walkthrough runs on the page rather than embedding a third-party video player. We have not added advertising or audience-analytics tools to the application. Hosting providers may use service and security technologies to deliver and protect pages. Your browser lets you inspect and clear site data. If we introduce optional tracking that requires consent, we will provide a choice before using it and update this notice.

Your rights and choices

Depending on the circumstances, you can ask to access, correct, erase, restrict or receive a portable copy of your personal information. Some rights have exceptions, including where records must be retained by law. We may need to verify your identity before responding.

You can object to processing based on legitimate interests. You have an unconditional right to object to direct marketing. Where we rely on consent, you can withdraw it for future processing. Contact hello@qrfill.co.uk to make a request or raise a concern.

You can also complain to the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/

Changes and provider information

We will update this notice when our practices change and draw material changes to affected users' attention where appropriate. You can request a copy by email.

Provider information: https://supabase.com/privacy, https://www.cloudflare.com/privacypolicy/, https://openai.com/policies/chatgpt-sites-data-processing-addendum/, https://porkbun.com/legal/agreement/privacy_policy, https://www.microsoft.com/en-gb/privacy/privacystatement and https://www.apple.com/uk/legal/privacy/en-ww/