Privacy Policy

1. Introduction and the Zero-Knowledge Principle

Welcome to GETQR.PRO. MONOLITH LABS LTD (the “Company”, “we”, or “us”) is committed to protecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR) as incorporated into UK law by the European Union (Withdrawal) Act 2018, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR).

This Privacy Policy should be read alongside our Terms of Service, available at getqr.pro/terms, which governs your use of the Service.

Our Core Principle: GETQR.PRO operates on a strict zero-knowledge architecture in respect of the content you create. All QR code generation is performed exclusively within your local browser environment. We do not require you to create an account. We do not ask for your name, email address, or any other personal identifier. We have no technical access to the content of the QR codes you generate.

2. Data We Do Not Collect — Your Content

Because QR code generation occurs entirely within your web browser using client-side code, the following data never reaches our servers under any circumstances:

• The input data you enter into the Service, including URLs, text, Wi-Fi credentials, vCards, contact information, or any other content you choose to encode.
• The QR codes you generate.
• Any files you upload or interact with within the Service interface.

This data remains entirely on your device and is not transmitted to, stored by, or accessible to the Company at any point.

3. Technical Data We Necessarily Process

To operate a functional and secure website and to display advertisements in accordance with our ad-supported model described in Section 3 of the Terms of Service, the Company and its third-party partners necessarily process limited technical data when you visit GETQR.PRO.

3.1. Technical Data. Your Internet Protocol (IP) address, browser type and version, operating system, device type, time zone setting, and browser plug-in information. This data is processed by our infrastructure and security providers as a technical necessity of delivering the website to your device.

3.2. Usage Data. Anonymous, aggregated telemetry data regarding how you interact with the website — including pages visited, time spent on the site, and error logs — strictly for the purpose of improving Service performance and stability. This data is processed in a form that does not permit identification of individual users.

3.3. Advertising Data. As set out in Section 4 below, third-party advertising networks may collect your IP address and browsing data through cookies and similar technologies to serve advertisements. Where required by applicable law, this processing is subject to your consent.

4. Cookies, PECR, and Third-Party Advertising

GETQR.PRO is a free service supported entirely by third-party advertising. This section explains how cookies and similar technologies are used in connection with the advertising model.

4.1. Strictly Necessary Cookies. The Company deploys only strictly necessary technical storage mechanisms — including security tokens placed by Cloudflare (such as __cf_bm and cf_clearance) — which are exempt from consent requirements under Regulation 6(4) of PECR. These cannot be disabled without preventing the Service from functioning.

4.2. Advertising Cookies — Consent Required. Third-party advertising networks use cookies, web beacons, pixel tags, and similar tracking technologies to serve advertisements based on your prior browsing activity and interests. These are non-essential cookies and, where required by PECR and UK GDPR, are deployed only with your prior consent. When you first visit the Service, you will be presented with a cookie consent mechanism allowing you to accept or decline non-essential advertising cookies. You may withdraw or manage your consent at any time through your browser settings or our cookie management tool.

4.3. Third-Party Advertiser Data Collection. Third-party advertising networks operating within the Service may independently collect your IP address and browsing data in accordance with their own privacy policies and terms. The Company does not control, audit, or accept responsibility for the data practices of any third-party advertising network. You are encouraged to review the privacy policies of any advertising network whose cookies you accept.

4.4. Ad-Blocking. As set out in Section 3.1 of the Terms of Service, systematic use of ad-blocking software constitutes a breach of your licence to use the Service.

5. Legal Bases for Processing (UK GDPR)

The Company processes technical data only where a valid legal basis exists under UK GDPR:

Legitimate Interests (Article 6(1)(f)): Processing of IP addresses and technical data to securely deliver the website to your device, maintain Service stability, and prevent DDoS attacks and malicious bot activity. The Company has assessed that these legitimate interests are not overridden by your rights and freedoms, given the minimal and non-identifiable nature of the data processed.

Consent (Article 6(1)(a)): Processing of your data by third-party advertising networks through non-essential cookies, where required by PECR and UK GDPR. You may withdraw this consent at any time.

Legal Obligation (Article 6(1)(c)): Processing of Technical Data to comply with applicable UK law or valid requests from law enforcement or regulatory authorities.

6. Sharing Data With Third Parties

The Company does not sell your personal data. Technical data is shared only with the following categories of trusted third-party processors, each bound by appropriate data processing agreements:

Infrastructure and Security Providers: Including Cloudflare, Inc., which provides DNS routing, edge security, Web Application Firewall, and DDoS protection. Cloudflare may process your IP address at the network edge as a technical necessity of delivering the Service securely.

Advertising Networks: Third-party advertising providers who serve advertisements within the Service, as described in Section 4. A list of advertising networks currently used is available upon request at info@monolithlabs.uk.

Legal Authorities: The Company may disclose Technical Data (including IP address logs) if strictly required by a valid court order or under applicable UK law. The Company will not voluntarily disclose your data to any authority without legal compulsion.

7. International Data Transfers

Your technical data may be processed outside the United Kingdom — for example, by Cloudflare’s global edge infrastructure or by US-based advertising networks. Whenever data is transferred outside the UK, the Company ensures appropriate safeguards are in place, including the UK International Data Transfer Agreement (IDTA) or Standard Contractual Clauses, to ensure your data receives equivalent protection regardless of its physical location.

8. Data Retention

The Company retains technical data only for as long as is strictly necessary for the purposes described in this Policy.

• IP Addresses and Security Logs: Retained for a maximum of 30 to 90 days for security monitoring and fraud prevention, after which they are automatically deleted or permanently anonymised.
• Anonymous Usage Telemetry: Retained in aggregated, non-identifiable form for up to 12 months for performance analysis, after which it is permanently deleted.
• Advertising Cookie Data: Governed by the retention policies of the relevant third-party advertising networks. Please refer to those networks’ privacy policies for retention periods.

9. Your Legal Rights

Under UK GDPR, you have the following rights in respect of personal data processed by the Company:

• The right to access personal data held about you.
• The right to rectification of inaccurate personal data.
• The right to erasure of personal data in certain circumstances.
• The right to restriction of processing.
• The right to object to processing based on legitimate interests.
• The right to withdraw consent for advertising cookies at any time, without affecting the lawfulness of processing prior to withdrawal.

Important limitation: Because the Company does not link Technical Data to a real-world identity — no account, email address, or name is collected — it may not be possible to identify which specific server logs relate to you without additional information provided by you. The Company will make reasonable efforts to comply with any rights request it can verify.

To exercise any of the above rights, please contact: info@monolithlabs.uk

10. The Information Commissioner’s Office (ICO)

If you believe the Company has mishandled your personal data, you have the right to lodge a complaint at any time with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection:

Website: www.ico.org.uk

ICO Registration Number: ZC126753

The Company would welcome the opportunity to address your concerns directly before you approach the ICO. Please contact info@monolithlabs.uk in the first instance.

11. Children’s Privacy

The Service is intended for users aged 18 and over in accordance with Section 1 of the Terms of Service. The Company does not knowingly collect or process personal data from any person under the age of 18. If the Company becomes aware that it has inadvertently processed data from a minor, it will take immediate steps to delete such data.

12. Changes to This Privacy Policy

The Company reserves the right to update this Privacy Policy from time to time to reflect changes in applicable law, regulatory guidance, or the Company’s technical infrastructure or advertising arrangements. Changes will be indicated by updating the Effective Date at the top of this document. Your continued use of the Service following any update constitutes your acknowledgment of the revised Policy.