Who we are
Leading Logic Ltd, registered in England and Wales (company no. [number]), [registered address], is the controller for the personal data described here. Contact: [privacy email address].
What we collect and why
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Your email address | Your account, sign-in codes, receipts and service notices | Contract | While your account exists, then [period] |
| Your orders (pack, amount, date, order reference) | Providing what you bought, refunds, accounting | Contract; legal obligation | [6] years for tax records |
| Codes, destinations, labels and change history | Running the Service | Contract | While your account exists; code IDs are kept for ever so they are never reused |
| Sign-in country | Alerting you to sign-ins from a new country | Legitimate interests (account security) | Last value only |
Google Ads click ID (gclid), if you arrived from an ad | Telling Google Ads a purchase happened (offline conversion upload) | [Legitimate interests / consent: to be confirmed] | [period] |
| Abuse reports and optional reporter email | Investigating unsafe codes | Legitimate interests (safety) | [period] |
People who scan codes
When someone scans a code, we count the scan by day, country and device type (for example “mobile”). We don’t store IP addresses in statistics, and we set no cookies on sfqr.link or customers’ domains. Edge logs used to build these counts are deleted after 30 days and contain no IP addresses.
When someone reports a code, we keep a one-way salted hash of their IP address and the day for 2 days, so we can count distinct reporters without knowing who they are.
Cookies and analytics
We use no analytics or advertising cookies. See our cookies page. Page views are counted from our own server logs, without cookies.
The click ID from a Google ad is kept in your browser’s session storage (cleared when you close the tab) and sent with your order, so we can report the purchase to Google Ads from our server.
Who we share data with
- Stripe and Onelink, LLC, to process payments (Onelink is the seller of record).
- Amazon Web Services, which hosts the Service. [Regions and transfer safeguards to be confirmed.]
- Google, to check destinations against the Web Risk list (we send the destination address, not your details), and, if you came from an ad, to report the conversion.
- Authorities, where the law requires.
We never sell personal data.
Your rights
You can ask to access, correct, delete or export your personal data, object to processing based on legitimate interests, or complain to the UK Information Commissioner’s Office (ico.org.uk) or your local data protection authority. Contact us at [privacy email address].
If you delete your account, your codes are retired (their IDs are never reused) and your personal data is deleted, except what we must keep by law.