PRIVACY
PRIVACY
WovenQR is a trading name of UNVALE LTD, a company registered in England and Wales, company number 17496903. Registered office: 59 Cecil Road, London, United Kingdom, E17 5DH. UNVALE LTD is the controller of your personal data under UK GDPR and the Data Protection Act 2018.
The website address, name and logo you enter, to make your designs (to provide the service you ask for). If you buy, Stripe processes your payment and gives us your email address and order details (to perform our contract with you). We never see your card number. We use your email address only to send your order and its files, never for marketing.
After a purchase we may send one optional review request. You can stop review emails using its link. If you choose to publish a review, your display name, rating and comment may appear on WovenQR and FormeQR, both run by UNVALE LTD. Your email and order link stay private. Contact us to remove a review.
Free previews expire after seven days. Orders and design data are kept for 12 months so you can re-download your files, then deleted. Payment and Stripe records are kept for 6 years from the end of the tax year, as HMRC requires.
Stripe (payments) and Cloudflare (hosting, storage and security). Both act on our instructions and protect your data with appropriate safeguards, including for any transfer outside the UK.
Our server keeps daily totals of public pages served, grouped into general sources such as X or direct. These counters include repeat loads and are not unique visitor counts. We store no visitor identifier, cookie, IP address, user agent, full referral URL or click identifier in these counters, and do not connect them to orders. Known automated previews and browser privacy signals are excluded. Counters are kept for up to 180 days.
The separate, unticked checkout box lets you agree to order follow-ups, feedback requests and occasional product updates from WovenQR and FormeQR (UNVALE LTD). This is optional: your files and order receipts arrive either way. If you opt in and complete payment, we keep your email, a non-secret order reference, website domain, design count, amount/currency and the date and wording of your permission in a private Google Sheet. We do not put card details, uploaded logos, sealed designs or private download links there. Use the email-preferences link in your receipt to stop optional emails from both brands. This suppresses future optional emails and removes your email from the contact list when the change is synced; order records needed for delivery remain separate. You can also contact us using the support address below.
If you also allow X ad measurement in Analytics preferences, pixel rhymb measures public page visits. After a confirmed paid purchase, our server can send X the purchase time, a non-secret conversion reference and a SHA-256 hash of your email address, using event tw-rhymb-rhzyn. We trim and lowercase the email before hashing it. The hash is used for matching and is still personal data; this advertising measurement is separate from our own analytics and from optional marketing emails. We do not send X your QR artwork, entered website, card details or private order links. Private order-link pages do not run the base pixel. You can decline X measurement or withdraw through Analytics preferences; withdrawal reloads the page to stop the loaded pixel. Browser privacy signals also disable it. Unsent matching data is held for at most seven days, and delivery receipts are retained for up to a further 30 days. Previously sent data is handled under the X privacy policy.
If you allow analytics, we record the referring website's domain, general campaign labels from the link you used, the landing page and a random 30-minute session reference, plus cumulative seconds while your page is visible. Time pauses when the page is hidden; it is an estimate, not a measure of attention. This helps us measure which sources lead to visits, checkouts and confirmed purchases. We do not include your email, entered website, uploaded logo, full referring URL, payment details or IP address in this analytics database. We use Cloudflare to store these records for up to 180 days. It is separate from the order records we need to deliver your purchase.
You can decline or change your choice using Analytics preferences on the homepage. Your browser's Do Not Track or Global Privacy Control signal disables optional analytics. Declining does not affect generation, payment or downloads. Changing your choice stops future optional collection; it does not remove previously recorded figures. Contact us if you want us to remove information associated with your order.
We set no advertising cookies. Your analytics choice is remembered in local storage for up to 180 days, and an optional analytics session is kept in session storage for up to 30 minutes after consent. Your shortlist is kept in local storage on this device and is cleared once your order is paid or when you remove the designs. Stripe may use its own payment and security cookies.
Under UK GDPR you can ask for a copy of your data, ask us to correct or delete it, object to or restrict how we use it, and ask for it in a portable format. Email hello@wovenqr.com and we will reply within one month. If you are unhappy, you can complain to the Information Commissioner's Office at ico.org.uk.
Last updated: 25 October 2026. Questions: hello@wovenqr.com.