Privacy Policy

1. What we collect from visitors

When you scan a QR or browse the catalog we log the scanned code, the page it points to, an approximate location (country and city derived from your network at the edge; we do not store your IP address in the scan log), your browser's user-agent string, and the time. We use this to show breweries where their beer is being drunk.

Ratings are anonymous. Your device remembers your vote locally so you are not asked twice.

2. What we collect when you subscribe to a brewery

If you sign up for a brewery's news you give us an email address or WhatsApp number, and we record the language and page where you signed up. We store that contact on the brewery's behalf: the brewery is the controller of its list and is responsible for how it messages you. See the Data-Use Addendum for more on how we process that list. To be removed from a list, contact the brewery, or write to hello@qrbeers.com and we will remove you.

3. What we collect from brewery accounts

Account authentication is handled by Clerk, our sign-in provider, which processes your email and sign-in credentials. We store your account's link to your brewery and the content you create (brewery, beers, batches, codes).

4. Processors we rely on

With fresh analytics consent, we also count successful product actions (brewery and beer creation, publishing, QR downloads, saved signups and confirmations). These server-side PostHog events carry no account or subscriber identity and no private page URL. Consented presentation sessions use a random identifier held in memory, reset after inactivity; a handoff URL may carry that identifier to link a phone arrival for up to 24 hours. The identifier is kept with first-party events for up to 24 months, not sent to PostHog. Shared links can be forwarded, so sessions and arrivals are not unique people. Coarse device categories are estimated from request headers; historical records may lack them.

We host on Vercel, which also provides the cookieless visit and page-speed statistics for our own marketing pages when you allow them (see the Cookie Policy); we store data with Supabase (database, hosted in the United States), take payment through Stripe, and authenticate with Clerk. Each processes data only to provide their service to us.

With your explicit analytics consent, PostHog processes public-page activity and the successful product actions described above using its EU service. We disable session replay, automatic click capture and person profiles, do not send names, emails, search text or share-link contents, and use temporary identifiers rather than persistent analytics cookies. Requests necessarily pass through the provider's network; IP-based enrichment is disabled. Brewery-facing presentation analytics are stored separately in Supabase for 24 months and deleted on account closure. Flight selections are temporary browser state, not orders or saved customer profiles.

5. What we do not do

We do not sell personal data, run third-party advertising or track you across other websites. Optional PostHog product measurement is described above; we do not create personal profiles.

6. Retention

Raw scan and page-activity records are kept for 24 months, then deleted automatically. Aggregate counts (scans per code per day, ratings per beer, announcement delivery statistics) contain no visitor identifiers and are kept as brewery history. Subscriber contacts are kept until the brewery deletes them, you opt out, or the brewery's account closes. Deleting your personal account removes your brewery memberships and sign-in identity. Security and administrative audit records may retain a provider identifier where required for fraud prevention, legal obligations, and an accurate history of privileged actions. Brewery catalogs and printed-code registry records belong to the brewery account and follow the separate brewery-closure process.

7. Your rights

You can ask us what we hold about you, ask for a copy, correct it, or have it deleted. Write to hello@qrbeers.com and we will respond as required by the laws that apply to you.

8. Children

The service concerns alcoholic beverages and is not directed at minors. We do not knowingly collect data from anyone under the legal drinking age.

9. Changes and contact

If this policy changes materially we will note it here with a new date. Questions: hello@qrbeers.com.