Privacy Policy.

LIVE DOT (livedot.app) is operated by TruLight Studio LLC, a limited liability company registered in Washington, USA ("TruLight Studio", "we", "us"). We are the controller of the personal data described here, which means we decide how and why it is used. You can reach us through our contact form.

• Account details: your name, email address and password (stored only as a salted hash, never in plain text).
• Your QR codes: the content you put in them (links, files, contact details, Wi-Fi details and so on), names, tags, folders and design choices.
• Uploads: logos, images and PDFs you upload for your codes.
• Plan and billing: your plan, subscription status and Stripe customer ID. Card details are handled by Stripe; we never see or store your full card number.
• Messages: anything you send us through the contact form.
• Security data: password-reset tokens (stored only as a hash and expiring after one hour).

When anyone scans a dynamic LIVE DOT code, we record the scan so the code's owner can see analytics. For each scan we store:

• the date and time,
• the IP address,
• approximate location (country and city, worked out from the IP address by our host),
• device type, browser and operating system,
• the referring page, if any.

Code owners see these as totals and charts (for example, scans by country or device). We don't show them individual IP addresses. Static codes don't pass through our servers, so scanning one tells us nothing.

Scan pages show only the content the owner chose to publish; they never reveal the owner's account details.

With your consent, we use Google Analytics on livedot.app to understand how the site is used (pages visited, rough location, device and browser). Google Analytics sets cookies for this. It is off until you click Accept in the cookie banner, and you can change your mind at any time with "Cookie settings" at the bottom of every page; choosing Reject removes its cookies. Google Analytics never runs on the pages people see when they scan a code.

Everything else we store in your browser is strictly necessary: your sign-in session and your cookie choice are kept in your browser's local storage, and the session is removed when you log out.

• To run LIVE DOT: create, store, serve and redirect your QR codes, and show you their analytics.
• To manage your account and subscription, and to send account emails (welcome, password reset, plan changes).
• To answer your messages and support requests.
• To keep the service secure and prevent fraud and abuse.
• To understand how the site is used and improve it.

We don't send marketing emails, we never sell your personal data, and we don't make automated decisions about you that have legal or similarly significant effects.

Under EU and UK data protection law (GDPR), our legal bases are:

• Contract: your account, QR codes, uploads, subscription and account emails, because we need them to provide LIVE DOT to you.
• Legitimate interests: recording scans so code owners get analytics, keeping the service secure, preventing abuse, and answering messages. We keep this to what's needed and you can object (see section 8).
• Consent: Google Analytics cookies. You can withdraw consent at any time with "Cookie settings".
• Legal obligation: keeping billing and tax records.

We share data only with providers that help us run LIVE DOT, and only what they need:

• Stripe: payments and subscriptions.
• Vercel: website hosting and approximate scan location.
• MongoDB Atlas: database hosting.
• Amazon Web Services (S3): storage for uploaded logos, images and PDFs.
• SendGrid (Twilio): sending account emails.
• Google Analytics: website usage statistics.

We may also disclose data if the law requires it, to protect our rights or users' safety, or as part of a merger or sale of the business (in which case this policy would continue to apply).

• Account data and QR codes are kept while your account is open.
• Deleted QR codes are kept so that anyone scanning a printed copy sees a "no longer available" page instead of an error, and so you can restore them. You can delete them permanently from the Deleted tab at any time.
• Scan records are kept for as long as the code exists, so your analytics stay complete.
• When we close an account at your request, we delete it along with its codes, scan records, uploaded files and contact-form messages, and cancel any subscription.
• Copies in our providers' backups are removed as those backups expire.
• Billing records are kept by Stripe for as long as tax and accounting law requires.

You can ask us to:

• access the personal data we hold about you and get a copy,
• correct it if it's wrong,
• delete it, including closing your account,
• export the data you gave us in a machine-readable format,
• restrict how we use it, or object to uses based on legitimate interests,
• withdraw consent to analytics cookies at any time, without affecting anything before.

Many things you can do yourself: edit your name and email in Settings, and rename or delete codes in the dashboard. For everything else, contact us. We'll reply within one month and won't charge you. We may ask you to confirm your identity first.

If you're in the EU, EEA or UK, you also have the right to complain to your local data protection authority (in the UK, the ICO). Residents of California and other US states have similar rights under their state laws, and we honour them the same way.

If you scanned someone else's code and want your scan data removed, contact us and we'll work with you to find and delete it.

Everything is sent over HTTPS. Passwords are hashed with scrypt and a unique salt, and sign-in tokens are signed so they can't be altered. Access to production data is limited to the people who run LIVE DOT. No system is perfectly secure, but if a breach affects your data we'll tell you promptly.

We are based in the United States, so if you're in the EU, EEA or UK your data is transferred to and stored in the US and possibly other countries. We protect these transfers with the European Commission's Standard Contractual Clauses (and the UK addendum to them) in our agreements with our providers, and, where a provider is certified, the EU-U.S. Data Privacy Framework. Contact us for more about these safeguards.

LIVE DOT isn't meant for children under 13, and we don't knowingly collect their data. If you think a child has given us personal data, contact us and we'll delete it.

If we change this policy we'll update the date above, and for significant changes we'll let account holders know by email or in the app.

Questions about privacy? Reach TruLight Studio through our contact form.