QRLoom

Privacy Policy

Last updated: 5 October 2026

1. About this policy

QRLoom (“QRLoom”, “we”, “us”) is a QR code and mini-page service for businesses in Thailand. This policy explains what personal data we handle, why, who helps us, how long we keep it and how you can use your rights under Thailand’s Personal Data Protection Act B.E. 2562 (2019) (“PDPA”).

We handle personal data in two different roles:

  • As a data controller for our own customers and visitors — people who sign up, pay, use our website or our free tools (Section 2).
  • As a data processor for businesses that use QRLoom to collect data from their customers — for example through a lead form, a loyalty stamp card or a coupon on a mini-page (Section 3). For that data the business is the controller; we only process it on its instructions.

2. Data we process as controller

  • Account. Email address, name and profile picture (if you sign in with Google), sign-in records, language, plan and account settings.
  • What you create. Your QR codes and their destinations, designs, folders and tags; your mini-pages (menus, link pages, review pages, forms, stamp cards, coupons) and the images you upload; registered PromptPay signs.
  • Billing. Payments are handled by Stripe. We never see or store your full card number. Stripe tells us your subscription status, the card brand and last four digits, and a card “fingerprint” that we use only to stop referral abuse (Section 2, referrals).
  • Referrals. Your referral code, who invited whom, and reward status. When you open a referral link we set a qrl_ref cookie for 30 days so the invite can be credited.
  • LINE Login and LINE alerts. If you connect LINE, we receive your LINE user ID, display name and profile picture link from LY Corporation, and we keep whether our LINE account can still message you. We use this only to sign you in and send the alerts you switched on (new leads, scan summaries). We do not read your LINE chats, contacts or friends. If you message our LINE account, we send an automatic help reply and do not store what you wrote.
  • Email preferences. Your choices for scan summaries and product/onboarding emails, your opt-out, and a record of which emails we sent (so we don’t send the same one twice).
  • Usage and site analytics. Pages viewed on qrloom.app, approximate country, device and browser type, referrer and a random session ID, to run and improve the service. On QRLoom’s own public pages we also use Google Analytics and Google AdSense (Section 6).
  • AI features. If you use AI menu import or translation, the photos and menu text you submit are sent to Anthropic for processing (Section 5). We keep only usage counts (number of requests and tokens), not the photos.
  • Safety tools and abuse prevention. Content you check with our QR safety checker; reports you send about a QR code, a PromptPay sign or a mini-page (reason, optional note, language). We never store your full IP address with a report — only a keyed hash of it, so repeat reports can be recognised. IP addresses are also used briefly for rate limiting.
  • Support. Messages you send us and our replies.

3. Data we process for businesses (as processor)

When you scan a business’s QR code or use its mini-page, the business decides what to collect and why, and it is the data controller. Its own privacy notice is shown before you submit anything. QRLoom stores and processes this data on the business’s behalf:

  • Lead form responses: the fields the business asks for (e.g. name, phone, email, LINE ID, message), your optional marketing consent, the exact privacy notice you saw, the time, and a keyed hash of your IP address.
  • Loyalty stamp cards: a keyed hash of your phone number plus its last four digits (we never store the full number in readable form), an optional nickname, your stamps and rewards, consent records, and a qrl_promo cookie (30 days) that remembers your card on your device.
  • Coupon claims: the coupon code, the same phone hash and last four digits, consent records, and when the coupon was claimed and redeemed.
  • Scan logs of a business’s dynamic QR codes: time, approximate location derived from the IP address (city / country, not GPS), device type, operating system, browser and referrer.

Business mini-pages do not show ads and do not load Google Analytics. To use your rights over this data (see Section 10), please contact the business first — its contact details are in the notice on its page. If you can’t reach it, contact us and we will pass your request on and help the business respond. Businesses accept our Data processing terms.

4. Why we use your data (purposes and legal bases)

  • To provide the service you signed up for — accounts, QR codes, mini-pages, analytics, billing, LINE alerts (performance of a contract, PDPA s.24(3)).
  • To keep QRLoom safe — fraud and phishing prevention, rate limiting, moderating reported pages, referral-abuse checks, security logs (legitimate interests, s.24(5)).
  • To improve QRLoom — aggregated usage statistics (legitimate interests).
  • To send product and onboarding emails — you can opt out at any time via the link in each email (legitimate interests; consent where the law requires it).
  • Advertising cookies on QRLoom’s own pages — Google AdSense (consent where required).
  • To meet legal obligations — tax and accounting records, lawful requests from authorities (legal obligation, s.24(6)).

We do not sell personal data.

5. AI menu import (Anthropic)

AI menu import and translation are optional Pro features. When you use them, the menu photos and menu text you submit are sent to Anthropic, PBC (USA) to read or translate the menu. We do not store the photos and we don’t log their content; the result is returned to you as a draft that you must review before publishing. Under Anthropic’s Commercial Terms of Service, which apply to our API use, “Anthropic may not train models on Customer Content from Services”. Anthropic says it deletes API inputs and outputs within 30 days, with limited exceptions (for example to enforce its usage policy or where the law requires). Please don’t upload photos that show people or other personal data.

6. Service providers (sub-processors)

We use these providers, each bound by its own data protection terms:

  • Supabase — database, authentication and file storage.
  • Vercel — website hosting and content delivery.
  • Upstash — rate limiting and short-lived caching.
  • Stripe — payments, subscriptions and invoices.
  • Resend — sending emails (alerts, receipts, product emails).
  • LINE (LY Corporation, Japan) — LINE Login and LINE alert messages.
  • Anthropic — AI menu import and translation (Section 5).
  • Google — Safe Browsing (links checked in our safety checker and on mini-pages are sent to Google for a threat lookup); Google Analytics and Google AdSense on QRLoom’s own public pages only, never on business mini-pages.

7. Transfers outside Thailand

Several providers above store or process data outside Thailand (for example in the United States, Japan, Singapore or the EU). When we transfer personal data abroad we rely on the safeguards the PDPA allows, such as the provider’s contractual data protection commitments, or the transfer being necessary to provide the service you asked for.

8. Cookies

  • Sign-in session (Supabase) — keeps you logged in. Essential.
  • NEXT_LOCALE — remembers Thai or English, 1 year. Essential.
  • qrl_ref — referral attribution, 30 days.
  • qrl_promo — on a business’s stamp-card or coupon page, remembers your card on this device, 30 days (signed; holds no readable phone number).
  • qrl_line_oauth — protects LINE Login, a few minutes.
  • Google Analytics / AdSense — on QRLoom’s own pages only.

You can block or delete cookies in your browser; some features may then stop working.

9. How long we keep data

  • Account data, QR codes and mini-pages: while your account exists. When we delete your account at your request, they are deleted with it.
  • Scan analytics, form responses, loyalty members and coupon claims: until the business deletes them, deletes the page or code, or deletes its account. Businesses can erase a single response or member at any time.
  • Billing records: as long as tax and accounting law requires (generally up to 10 years).
  • Abuse reports and moderation records: as long as needed to protect users and handle disputes.
  • Rate-limit entries: minutes to a day. AI photos: not stored by us.
  • Backups are overwritten on a rolling basis.

10. Your rights under the PDPA

Subject to the conditions in the law, you have the right to:

  • access your personal data and get a copy, and know how we obtained it;
  • receive your data in a commonly used machine-readable format, or have it sent to another controller;
  • have inaccurate or incomplete data corrected;
  • object to processing based on legitimate interests or for direct marketing;
  • have your data deleted, destroyed or anonymised;
  • restrict our use of your data;
  • withdraw consent at any time (this doesn’t affect processing that already happened);
  • complain to the Office of the Personal Data Protection Committee (PDPC) if you think we haven’t followed the law.

How to make a request: email shop.mellotopup@gmail.com from the address on your account (or tell us how to verify you), say which right you want to use and what data it concerns. We may ask for proof of identity. We will respond without undue delay and within 30 days. Many things you can do yourself in the dashboard: edit your profile, export your codes, delete codes, pages and responses, and change email and LINE preferences. To delete your whole account, email us. For data a business collected through its mini-page, see Section 3.

11. Security

Data is encrypted in transit (HTTPS/TLS). Our database uses row-level security so each account can only reach its own data; sensitive tables are writable only by our server. Phone numbers on loyalty cards and coupon claims, and IP addresses on reports and responses, are stored as keyed hashes. No system is perfectly secure; if a breach is likely to put you at risk we will notify you and the PDPC as the law requires.

12. Children

QRLoom is a service for businesses and is not directed to children. Business accounts must be opened by adults. We do not knowingly collect personal data from children under 13.

13. Changes

We will update the date at the top when this policy changes, and tell account holders about significant changes by email or in the dashboard.

14. Contact

QRLoom privacy requests and questions: shop.mellotopup@gmail.com. Please write “PDPA request” in the subject line for rights requests.