Effective October 11, 2026
Privacy Policy
This policy explains what personal data Utilica collects, why, who we share it with and what choices you have. It covers people with an account, visitors to utilica.app, and people who scan a QR code or open a short link made with our tools.
1. Who is responsible
Utilica operates Utilica and decides how the personal data described here is used (in data protection law, the “controller”). You can reach us about privacy at support@utilica.app.
2. What we collect
| Data | What it includes | Where it comes from |
|---|---|---|
| Account | Email address, name if you give one, whether your email is verified, and which sign-in methods you use. Your password is stored only as a salted hash; we cannot read it. | You, at sign-up |
| Google sign-in | If you choose “Continue with Google”: your Google account email, name and profile picture address. | Google, with your approval |
| Your content | The codes and links you create: names, destinations, encoded content, design settings, folders, and logos you upload. | You |
| Onboarding answers | Optional: your type of business, what you want to make, a brand color and logo. | You, if you answer |
| Agreement record | Which version of our terms you accepted and when. | Recorded when you agree |
| Scan and click data | For each visit to a dynamic code or short link: time, approximate location (country, region, city), device type, operating system, browser, language, and a short-lived identifier used to count unique visitors. See section 3. | The visitor’s request |
| Billing | If you buy a paid plan: your plan, payment status and a customer reference from our payment provider. Card details go to the payment provider, not to us. | You and the payment provider |
| Technical and security data | IP address, browser type and request logs when you use the site, kept briefly to run the service, block abuse and investigate problems. | Your browser |
| Messages | What you send us when you write to support or report abuse, including your email address. | You |
| Cookies | Cookies needed for sign-in and for remembering your cookie choices. See the Cookie Policy. | Your browser |
3. People who scan a code or open a link
When someone scans a dynamic QR code or opens a short link, their device contacts our redirect service, which sends them on to the destination. To give the owner of the code basic statistics, we record the items listed under “Scan and click data” above. We designed this to avoid identifying anyone:
- We do not store the visitor’s IP address with the scan record. It is used in the moment to work out an approximate location and is then discarded.
- To count unique visitors we create a hash from the IP address, the browser details and a secret value that changes every day. It cannot be reversed, and because the secret rotates daily it cannot be used to follow a person from one day to the next.
- We do not set cookies on the visitor’s device, and we do not build profiles of visitors.
- The owner of the code sees totals and breakdowns only. They never receive IP addresses or the identity of an individual visitor.
Static QR codes contain their content directly and never contact us, so we collect nothing when they are scanned.
4. How we use data, and our legal grounds
| Purpose | Data used | Legal ground |
|---|---|---|
| Provide the tools: create your account, sign you in, store and serve your codes and links | Account, content, cookies | Performing our contract with you |
| Show scan statistics to the owner of a code or link | Scan and click data | Our legitimate interest in offering analytics in a privacy-protective way |
| Keep the service safe: screen destinations, detect bots and abuse, enforce limits, investigate reports | Content, technical data, messages | Our legitimate interest in protecting users and the public; legal obligations |
| Take payment and manage subscriptions | Account, billing | Performing our contract; legal obligations (tax and accounting) |
| Send service messages: sign-in and verification codes, security alerts, notices about changes | Account | Performing our contract; legitimate interest |
| Tailor the product to you, such as starter templates for your type of business | Onboarding answers | Legitimate interest; you can skip these questions |
| Understand and improve the product | Aggregated usage data | Legitimate interest; consent where analytics cookies are involved |
| Keep a record that you agreed to our terms | Agreement record | Legitimate interest in being able to show the agreement |
We do not sell personal data. We do not use your content or your scan data for advertising. We do not make decisions about you by automated means that have legal or similarly significant effects. Automated safety checks can pause a code, and you can ask a person to review that decision.
5. Who we share data with
We use a small number of companies to run the service. They process data for us under contract and only for the purpose described:
| Provider | What they do for us | Data involved |
|---|---|---|
| InsForge | Database, authentication and file storage | Account, content, scan and click data |
| Cloudflare | Redirects for codes and links, network security and bot protection | Visitor requests, technical data |
| Vercel | Hosting for the website and app | Technical data |
| Sign-in with Google, if you choose it; checking destination addresses against lists of unsafe sites | Google account details you approve; destination addresses | |
| Stripe | Payments, once paid plans are available | Billing details and card data you give to Stripe |
We also share data:
- with the owner of a code or link, as aggregated scan statistics only;
- with authorities or others when the law requires it, or when it is necessary to investigate abuse such as phishing or to protect someone’s safety or rights;
- with a successor, if the service is transferred to another company, which would have to honor this policy.
The destinations you choose are, by their nature, shared with everyone who scans your code. Logos you upload are stored at a public address.
6. International transfers
Our providers operate in several countries, including the United States, so your data may be processed outside the country where you live. Where the law requires it, we rely on approved safeguards for those transfers, such as the European Commission’s standard contractual clauses or an adequacy decision. You can ask us for details.
7. How long we keep data
- Account and content: for as long as you have an account. When you delete your account, we delete your profile, codes, links, designs and uploaded logos, and the related redirects stop.
- Individual scan and click records: 30 days on the free plan and up to 2 years on a paid plan, then deleted.
- Daily totals: kept for as long as the code or link exists, so its history stays available. Totals contain counts, not individual visits.
- Technical and security logs: a short period, normally no longer than 90 days, unless needed for an ongoing investigation.
- Billing records: as long as tax and accounting law requires.
- Abuse reports and enforcement records: as long as needed to prevent repeat abuse.
- Backups: deleted data can remain in backups for a limited time before it is overwritten.
8. Security
We protect data with encryption in transit, access controls that limit each account to its own records, hashed passwords, and keys that are kept off the browser. No system is perfectly secure. If a breach affects your personal data and creates a risk for you, we will tell you and the relevant regulator as the law requires.
9. Your rights and choices
Depending on where you live, you have some or all of these rights over your personal data:
- Access and portability: get a copy of your data. You can export your codes, destinations and designs from the product.
- Correction: fix inaccurate data. You can change your name in Settings.
- Deletion: ask us to delete your account and data.
- Objection and restriction: object to processing based on our legitimate interests, or ask us to limit it.
- Withdraw consent: where we rely on consent, such as optional cookies, change your mind at any time through Cookie settings in the footer.
- Complain: contact your local data protection authority. We would appreciate the chance to help first.
To use any of these rights, write to support@utilica.app from the email address on your account. We reply within one month. We will not treat you differently for exercising a right. Because we do not identify the people who scan codes, we usually cannot find scan records relating to a particular person.
California residents: we do not sell personal information and do not share it for cross-context behavioral advertising. You have the rights to know, delete and correct described above, and the right not to be discriminated against for using them.
10. Children
The service is not directed at children, and you must be at least 16 to have an account. If you believe a child has given us personal data, tell us and we will delete it.
11. Changes to this policy
We will update this policy when what we do changes, for example when we add a tool or a new provider. The date at the top shows the latest version. If a change is significant, we will tell you by email or in the product before it takes effect.
12. Contact
Privacy questions and requests: support@utilica.app. General enquiries: hello@utilica.app.