Privacy Policy
This Privacy Policy explains how QKeep UK Ltd (trading as "QKeep Cards", "we", "us", "our") collects, uses, stores and protects personal data when you use the QKeep Cards website at qkeepcards.com, the QKeep Cards app (web app, iOS and Android), and our QR sticker linking service.
We are committed to complying with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), and, where it applies to you, the EU General Data Protection Regulation (EU GDPR).
1. Who we are
Data controller: QKeep UK Ltd, registered in England and Wales, company number [COMPANY NUMBER].
Registered address: [ADDRESS]
ICO registration (Data Protection Fee): [ICO NUMBER]
Contact for privacy matters: privacy@qkeepcards.com
Data Protection Officer (if appointed): [DPO]
EU representative (Article 27 EU GDPR, if required): [EU REP]
2. Key terms used in this policy
- Sender: a person who creates a QKeep Card (video, photos, message or template) in the app.
- Recipient: a person who receives a physical sticker attached to a gift and scans the QR code, then views the QKeep Card in the QKeep Cards app.
- Sticker: a pre-printed QR code sticker sold separately (for example on Amazon) that links a QKeep Card to a physical item.
- Content: any video, audio, photo, text or other material uploaded or recorded by a sender.
3. What personal data we collect
3.1 Information you give us
- Account information: name, email address and profile picture, when you sign in with Google (Firebase Authentication).
- Content you create: videos, audio, photos, text messages, and the names or titles you give to QKeep Cards. This may include images and voices of you and other people.
- Recipient information: where you choose to share a QKeep Card or invite contributors, the email address or other details you enter.
- Support and contact messages: anything you send us by email or through forms.
- Partner enquiries: business name, contact name, email, phone number and business type when you use our partner form.
3.2 Information collected automatically
- Sticker and QR data: sticker identifiers, the date a sticker was linked, first scan date, scan counts and the approximate location (country or region) of a scan, used for fraud and security checks.
- Viewing data: whether a QKeep Card was viewed, how much of a video was watched, and the number of views.
- Device and technical data: device type, operating system, browser type, IP address, app version and error logs (for example via Sentry).
- Usage analytics: pages visited, features used and conversion events, collected via [ANALYTICS TOOL] and Google Analytics 4, only where you have consented (see section 9).
3.3 Information from third parties
- Payments: if you subscribe, our payment processor Stripe handles your card details. We receive confirmation of your subscription status, the plan you chose, and the last four digits of your card. We never see or store full card numbers.
- Amazon purchases: if you buy stickers on Amazon, Amazon processes the order. We receive no payment details from Amazon. Amazon's own privacy notice applies to that purchase.
3.4 Data we do not collect
- We do not use facial recognition, voice biometrics or any other biometric identification technology on video content.
- We do not sell personal data.
- We do not use your video content to train artificial intelligence models.
- We do not knowingly collect personal data from children under 18 (see section 12).
4. How and why we use your data, and our lawful basis
| Purpose | Data used | Lawful basis (UK/EU GDPR Art. 6) |
|---|---|---|
| Creating your account and running the app | Account and content data | Performance of a contract |
| Storing, hosting and displaying QKeep Cards | Content, sticker links, viewing data | Performance of a contract |
| Linking stickers and verifying authentic QR codes | Sticker and QR data | Legitimate interests (preventing fraud and counterfeit stickers) and performance of a contract |
| Processing subscriptions and payments | Account and payment-status data | Performance of a contract and legal obligation (tax and accounting records) |
| Sending expiry reminders and service messages | Account data, sticker and viewing data | Performance of a contract |
| Sending marketing emails about new products | Email address | Consent (you can withdraw at any time), or soft opt-in for existing customers under PECR |
| Analytics and improving the product | Usage and device data | Consent (cookies and analytics) |
| Security, fraud prevention and abuse reports | Sticker, IP, device and content data | Legitimate interests and legal obligation |
| Handling complaints, legal claims and rights requests | Relevant data | Legitimate interests and legal obligation |
| Partner enquiries (B2B) | Business contact data | Legitimate interests (responding to enquiries) and steps prior to a contract |
Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms. You can object at any time (see section 10).
5. Videos and images of other people
QKeep Cards is built around videos of people. Please remember:
- If you record or upload content that shows or features another person, you must have their permission and must not share content that they would reasonably object to.
- We are the controller for the platform's processing of content. You are responsible for the content you choose to create. When a person appears in your content, they may ask us to remove it (see section 10).
- Content must not be used to harass, threaten, humiliate, or sexualise anyone. We remove such content on notice (see our Terms of Service).
- If you are a parent or guardian, please do not allow a child to appear in content shared outside your family without considering their wishes.
6. How long we keep your data
| Data | Retention |
|---|---|
| Unfinished drafts | Automatically deleted 7 days after the last edit |
| Completed QKeep Cards not yet linked to a sticker | Deleted 30 days after creation |
| QKeep Cards linked to a sticker (free tier) | Viewable by the recipient for 30 days from first scan. After 30 days, the content is removed from our servers unless the recipient has an active subscription. |
| Subscriber content | For as long as your subscription is active and for 30 days after cancellation, unless you delete it earlier |
| Account information | Until you delete your account, then deleted within 30 days, except records we must keep for legal or tax reasons |
| Payment and invoice records | Up to 6 years, as required by UK tax law |
| Sticker and fraud records | Up to 24 months, or longer where needed to investigate fraud or a legal claim |
| Support correspondence | 2 years after the last contact |
| Analytics data | 26 months or less, depending on the tool |
| Backup and error logs | Up to 90 days |
When data is deleted, it is removed from our active systems, and backups are overwritten on their normal cycle.
7. Who we share your data with
We do not sell your data. We share it only:
- With service providers (processors) who act on our instructions under a written contract, including:
- Google Firebase (authentication, database, storage and hosting), which may process data in the United States
- Stripe (payments)
- Our product analytics tool and Google Analytics 4 (analytics, subject to consent)
- Sentry (error monitoring)
- Our email service provider
- Our customer support tool
- With recipients you choose, when you share a QKeep Card or invite a contributor.
- With partners you choose, such as a florist or gift shop, only where you have asked them to link an order to your QKeep Card, and only the information needed for that purpose.
- With authorities or courts where we are legally required to do so, or to protect our rights, users or the public.
- In a business sale or restructure, where data would be transferred under the same protections.
International transfers
Some of our providers are based outside the UK and EEA, including in the United States. Where we transfer personal data outside the UK or EEA, we rely on the UK International Data Transfer Agreement or UK Addendum, EU Standard Contractual Clauses, and the UK-US data bridge where the provider is certified, together with additional safeguards where needed.
8. Security
We protect your data using:
- Encryption of data in transit (HTTPS/TLS) and encryption of stored data at rest
- Access controls and Firestore security rules that limit who can read and write each QKeep Card
- Sticker authentication using signed QR codes, so that fake codes can be detected
- Regular review of our providers' security practices
- Monitoring and alerts for suspicious activity, such as unusual scanning patterns
No online service is completely secure. If we become aware of a personal data breach that is likely to risk your rights and freedoms, we will notify the ICO within 72 hours where required, and tell affected people without undue delay.
Note on encryption: your content is encrypted in transit and encrypted at rest, on your device, in our storage and in backups. It is not end-to-end encrypted: we hold the keys and can access content where we need to, for example to act on a report, to honour a removal request, or to investigate fraud. We will update this policy before introducing any end-to-end encryption feature.
9. Cookies and similar technologies
We use:
- Strictly necessary cookies (for example, to keep you signed in and remember your session). These do not require consent.
- Analytics cookies (Google Analytics 4 and our product analytics tool). These are set only if you accept them.
- Preference cookies for settings such as language, where you choose them.
You can accept, reject or change your choices at any time using the cookie banner or the "Cookie settings" link in the footer. Rejecting analytics does not affect your ability to use QKeep Cards.
10. Your rights
Under UK GDPR and, where applicable, EU GDPR, you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate or incomplete data
- Erase your data ("right to be forgotten") in many circumstances
- Restrict processing in certain circumstances
- Object to processing based on legitimate interests, and to direct marketing at any time
- Data portability: receive your content and account data in a commonly used, machine-readable format (for example, downloadable video files and a JSON export)
- Withdraw consent at any time where we rely on consent, without affecting processing before withdrawal
- Not be subject to decisions based solely on automated processing that have a legal or similarly significant effect. We do not make such decisions.
To exercise any right, email privacy@qkeepcards.com or use the "Privacy requests" form in the app. We will respond within one month, which we may extend by two further months for complex requests, and we will tell you if we do.
If you are a person who appears in someone else's QKeep Card and want it removed, please contact us at the email above, or use the "Report content" option on the QKeep Card page. Please tell us which QKeep Card it is. We will review your request and, where appropriate, remove the content.
Complaints: If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. If you live in the EU, you may also complain to your local data protection authority.
11. Automated tools and fraud checks
We use automated checks to detect counterfeit stickers and misuse, for example where the same sticker is scanned from several countries within 24 hours or where a sticker is scanned an unusual number of times. These checks may lead to a sticker being blocked or a link being reviewed by a person. They do not produce legal or similarly significant decisions about you without human review, and you can ask us to review any action taken against your sticker or account.
12. Children
QKeep Cards is intended for adults. You must be at least 18 to create an account, purchase a subscription or link a sticker. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact privacy@qkeepcards.com and we will delete it.
People under 18 may appear in content created by adults. If you are concerned about content featuring a child, please use the report function or contact us.
13. Third-party links and services
Our website and app may link to Amazon, Apple App Store, Google Play, or partner websites. Those services have their own privacy notices, which we do not control.
14. Changes to this policy
We may update this policy from time to time. We will show the date at the top and, for significant changes, tell you by email or in the app before they take effect.
15. Contact us
Email: privacy@qkeepcards.com
Post: QKeep UK Ltd, [ADDRESS]