Legal
Privacy Policy
Last updated: 28 May 2026
QR to Sheets ("we", "our", or "us") operates https://qrtosheets.com and the QR to Sheets web application. This policy explains what data we collect, how we use it, and your rights under applicable data protection law including the GDPR.
1. Data We Collect
Admin account (Google Sign-In). When you authenticate with Google, we receive your name, email address, and Google profile picture. This is used solely to identify your account and is stored on our servers.
Google account permissions (OAuth scopes). When you connect a Google Sheet, we request the following Google API scopes:
https://www.googleapis.com/auth/drive.file— to read and write only the specific Google Sheet you select via the file picker, and to create new spreadsheets on your behalf.https://www.googleapis.com/auth/userinfo.email— to verify your identity when saving tokens.https://www.googleapis.com/auth/userinfo.profile— to display your name in the application.
Scan records. Each QR code scanned through our app is stored with the scanned value, a timestamp, and an anonymous device identifier. Field workers use the scanner without an account — no name, email, or personal information is required or stored for them. Scan records are written to the Google Sheet you configure.
Guest invitations (Events add-on). When you use the Events add-on to send invitations, guest names and email addresses from your Google Sheet are imported and stored in our database to enable personalised QR codes and email delivery. This data is held only for the duration of the campaign.
Usage data. We may log standard server access logs (IP address, browser type, pages visited) for security and debugging purposes.
2. How We Use Your Information
- To authenticate you and maintain your session.
- To write QR scan records to the Google Sheet you have connected.
- To display your workspace members and scan history within the app.
- To send transactional emails (account invitations, event guest invitations, security notices).
- To process payments and manage your subscription.
- To provide customer support when you contact us.
We do not use Google user data to serve advertising, and we do not share or sell Google user data to third parties.
3. Google API Services — Limited Use Disclosure
QR to Sheets' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically, data obtained via Google APIs is used only to provide and improve the QR to Sheets service. It is not used for any purpose unrelated to the application, is not transferred to third parties except as necessary to provide the service, is not used for advertising, and humans at QR to Sheets do not read user data unless you explicitly grant access for support purposes.
4. Sub-processors
We use the following third-party providers to operate QR to Sheets. Each acts as a data processor on our behalf and is bound by appropriate data processing terms.
- Neon — PostgreSQL database hosting (United States). Stores all application data including scan records and guest invitations.
- Resend — Transactional email delivery (United States). Used to send account invitations and event guest emails.
- Paddle — Payment processing and Merchant of Record (United Kingdom). Paddle processes payment details directly; we never store card numbers. See Paddle's Privacy Policy.
- Google Cloud / Google APIs — Authentication and Google Sheets integration (United States).
- Upstash — Redis cache for rate limiting (United States). No personal data is persisted; only request counters are stored.
- Vercel — Web hosting and serverless functions (United States).
5. Data Retention
Scan records are retained until you reset your workspace or request account deletion. You can reset your workspace at any time from the Settings page, which permanently deletes all scan records, scanner links, Google Sheet connections, and registered devices.
Guest invitation data (name and email imported via the Events add-on) is deleted when the associated campaign is deleted. Deleting a campaign permanently removes all guest records for that campaign.
Account data is retained for as long as your workspace is active. You may request full deletion of your account and all associated data by contacting us at hello@qrtosheets.com. We process all deletion requests within 30 days.
Google OAuth tokens (access and refresh tokens) are stored encrypted on our servers. Revoking QR to Sheets' access in your Google Account permissions immediately invalidates these tokens.
6. Data Security
Google OAuth tokens are encrypted at rest using AES-256-GCM before being stored on our servers. All data is transmitted over HTTPS. We use Neon PostgreSQL (AWS us-east-2) as our database provider.
7. Cookies and Local Storage
Essential cookies only. We use HTTP-only session cookies solely to keep you logged in (session management). We do not use advertising cookies, tracking pixels, or any third-party analytics cookies.
We use browser localStorage to store device-local scan backups (for offline retry) and, in test mode, a temporary workspace profile. We also store a cookie-notice acknowledgement in localStorage to avoid re-showing the banner.
Because we use only essential cookies, no consent is required under ePrivacy rules. However, we display a notice for transparency. You may clear cookies and localStorage at any time through your browser settings; this will log you out.
8. Your Rights
Under the GDPR and applicable data protection law, you have the following rights regarding your personal data:
- Right of access. You may request a copy of the personal data we hold about you.
- Right to rectification. You may ask us to correct inaccurate personal data.
- Right to erasure.You may request deletion of your personal data. For workspace data, you can use the "Reset workspace" function in Settings. For full account deletion, contact us at hello@qrtosheets.com.
- Right to data portability. Scan records are written directly to your own Google Sheet in real time, giving you continuous, portable access to your data. You may also request an export of other data we hold about you.
- Right to object or restrict processing. You may object to or request restriction of processing of your personal data in certain circumstances.
To exercise any of these rights, email hello@qrtosheets.com. We will respond within 30 days.
9. Children
QR to Sheets is not directed at children under 13. We do not knowingly collect personal data from children under 13.
10. Changes to This Policy
We may update this policy from time to time. Material changes will be communicated by updating the "Last updated" date above. Continued use of the service after changes constitutes acceptance of the revised policy.
11. Contact
Questions about this policy? Email us at hello@qrtosheets.com.