1. Scope and privacy roles
Rojocuadrado LLC, a single-member Wyoming limited liability company doing business as QR Cigars, operates QR Cigars from the Dominican Republic and is the controller or business for account, platform, billing, security, and service-analytics data described in this Policy. Its registered mailing address is 1309 Coffeen Avenue, Suite 1200, Sheridan, Wyoming 82801, United States.
A cigar brand usually acts as an independent controller or business for the contact details, subscriber records, and marketing choices submitted to that brand. QR Cigars hosts and processes that data to provide the feature, including transmitting announcement emails at the brand's direction and operating the unsubscribe mechanism for those emails. Requests about a brand's later emails, WhatsApp messages, or other use should be sent to that brand, although you may also contact us for assistance.
2. Information we collect
- Account and identity data: name, email, locale, authentication identifiers, organization role, and account settings.
- Brand and catalog data: brand contact details, country, logos, photographs, stories, cigar specifications, links, collections, and uploaded content.
- Billing data: plan, subscription status, trial dates, invoices, transaction references, and limited payment metadata. Clerk and Stripe process full payment-card details; QR Cigars does not store full card numbers.
- Subscriber and contact data: first and last name when provided, email or WhatsApp number, selected channel, consent time, source QR, rated cigar, and vote context for follow-up requests.
- Ratings and comments: thumbs-up or thumbs-down vote, optional comment, time, one-way device identifier hash, and one-way network-address hash.
- Taste questionnaire responses: selected answers, page context, time, one-way device identifier hash, one-way network-address hash, and, if the visitor then joins the brand's list, a link to that subscriber record.
- Optional Consumer Insights research: legal-age confirmation, consent record, notice version, broad optional age band, gender identity, cigar experience, purchase frequency and channel, discovery source, purchase intent, page context, language, time, coarse country when available, and a hash of a random one-time response token. The research response does not contain your name, contact details, subscriber record, raw IP address, stable device or visitor identifier, user agent, QR code, exact cigar, exact location, or free text.
- Usage and QR analytics: page path, QR code, page views, contact-link clicks, time, coarse country, region and city, device type, browser, operating system, language, referring domain, and a one-way visitor hash.
- Retail locator data: brand-supplied physical and online retailer names, addresses, coordinates, purchase links, shipping coverage, contact details, bilingual notes, and whether a visitor reported finding or not finding the brand's cigars at a physical location. We store a one-way visitor hash for duplicate prevention and abuse controls. If you choose nearby sorting, your precise browser location stays on your device and is not sent to QR Cigars.
- Event and RSVP data: event details, selected catalog items, touchpoint QR attribution, attendee name and contact details when submitted, RSVP consent, separate optional marketing consent, response status, and event-level analytics.
- Premium workspace data: uploaded media and rights or provenance records; monitoring topics and source candidates; AI instructions, approved catalog grounding, generated drafts, selected provider and model, review decisions, and usage or cost records. Provider keys supplied by a brand are encrypted and are not returned to the browser.
- Native app and notification data: Apple push token and environment, app and operating-system version, device model, per-brand notification preferences, delivery status, and the brand or account selected in QR Cigars Pulse. Lock-screen notification copy does not include subscriber identity.
- Support and administration data: messages, requests, internal support notes, plan changes, audit records, and security reports.
3. Sources of information
We receive information directly from you, from other authorized users in your organization, from visitors who scan or interact with cigar or event pages, from the cigar brand a visitor chooses to contact, from authentication, payment, media, AI, search, email, and notification providers, and automatically from browsers, native apps, devices, QR requests, and service logs.
4. Purposes and legal bases
- Contract and requested service: create accounts, authenticate users, host catalogs and media, route QR codes, provide subscriptions, process ratings, questionnaire responses, RSVPs and contact requests, generate private drafts when requested, deliver notifications, and provide support.
- Consent: send or enable marketing requested by a visitor, store optional browser analytics, and process optional Consumer Insights answers for adult-consumer research, service improvement, and deidentified and aggregated market intelligence. Consent can be withdrawn for future processing.
- Legitimate interests: secure the Service, prevent duplicate or abusive ratings, measure QR scans, maintain reliability, troubleshoot, improve features, protect rights, and understand aggregated use, balanced against individual rights.
- Legal obligations: tax and accounting, lawful requests, sanctions, consumer protection, security incident response, and enforcement.
- Protection of rights: investigate misuse, preserve evidence, resolve disputes, and enforce agreements.
5. Information visible to cigar brands
The brand whose page you use can receive its subscriber list, contact requests, comments, ratings, and aggregated or pseudonymous product analytics. This may include contact details you intentionally submit, the cigar and vote connected to a follow-up request, coarse geography, device and referral breakdowns, and QR activity. Brands do not receive raw IP addresses from QR Cigars.
A brand can also see aggregate found and not-found counts for each retailer it published. It does not receive the reporter's precise location, raw IP address, or identity from this feature.
A participating brand does not receive raw Consumer Insights responses. It may receive a frozen, suppression-protected report only after the applicable minimum cohort is met. QR Cigars may later license or sell deidentified and aggregated market or benchmark reports that pass its minimum-person, minimum-account, small-cell, complementary-suppression, and dominance controls; those reports do not disclose an individual response or another participating brand's identifiable result.
QR Cigars publicly commits to maintain De-identified Aggregate Data in deidentified form, not to attempt to reidentify a person, household, or participating client from it, and to contractually prohibit report recipients from attempting reidentification or using a report to single out a participant.
Brand owners must use this information under their own privacy notice and applicable law. QR Cigars does not control messages or processing that a brand performs after exporting data from the platform.
6. How we disclose information
QR Cigars does not sell personal information for money and does not share personal information for cross-context behavioral advertising. We do not use sensitive personal information to infer characteristics. We do not knowingly disclose personal information to data brokers.
- Service providers that support authentication, databases and storage, hosting, map tiles, analytics, payment processing, email delivery, media processing, AI or search requested by an authorized brand user, mobile notifications, security, and support. These include Clerk, Supabase, Vercel, OpenStreetMap or another configured map tile provider, PostHog, Stripe, Resend, Bunny, Anthropic, OpenAI, xAI, Apple, and Sentry where the relevant feature is enabled. A map tile provider receives ordinary network request data and the requested map area, but QR Cigars does not send it your precise browser geolocation value.
- The cigar brand or organization that you intentionally ask to contact you.
- Professional advisers, auditors, insurers, and transaction counterparties under appropriate confidentiality obligations.
- Authorities or other parties when required by law or reasonably necessary to protect users, the public, QR Cigars, or legal rights.
- A successor in a merger, financing, acquisition, reorganization, or sale, subject to applicable notice and privacy requirements.
8. Retention
- Account, contract, and billing records are kept while the account is active and afterward as needed for tax, accounting, fraud prevention, disputes, and legal obligations.
- Brand and catalog content remains until an authorized user deletes it or the account is closed, subject to backup cycles and legal holds.
- Private media, AI drafts, Newsroom candidates, event records, usage ledgers, and related audit history remain while needed for the workspace, rights history, metering, security, or contractual records, then are deleted or de-identified under the applicable feature controls and backup cycles.
- A mobile push device remains registered until it is revoked, becomes invalid, or is removed under retention and security procedures. Notification jobs and delivery outcomes are retained as operational and audit records for a limited period.
- Subscriber and contact records remain until the brand or QR Cigars deletes them, the person withdraws or objects, or they are no longer needed. When someone subscribes by email, QR Cigars sends a confirmation email and keeps the address out of platform announcement audiences until the person confirms. When a brand sends announcement emails through the platform, QR Cigars transmits them on the brand's behalf: every announcement includes an unsubscribe link and a one-click unsubscribe header, and an unsubscribed address is suppressed from that brand's future announcements while the record is kept as proof of the opt-out. Each brand remains responsible for any additional confirmation, consent, and messaging rules that apply to contact outside the platform.
- Ratings, comments, scan records, audit logs, and product analytics are kept while reasonably useful for the service, security, trend analysis, and brand reporting, then deleted, aggregated, or de-identified.
- Raw Consumer Insights responses expire no later than 400 days after submission and may be removed sooner with the signed withdrawal receipt held by the submitting browser. A response already incorporated into a sufficiently aggregated, non-identifying frozen report cannot be separated from or reversed out of that report, but the retained raw response is still subject to withdrawal and expiration.
- Cookie and browser-storage duration is described in the Cookie and Storage Notice. Backups are deleted on rolling schedules unless preservation is legally required.
9. International transfers
QR Cigars and its providers may process information in the United States and other countries that may not provide the same protections as your home country. Where required, we take steps designed to rely on lawful transfer mechanisms, provider data-processing terms, contractual safeguards, or other approved protections. Contact us to request available information about relevant safeguards.
10. Your privacy rights
Depending on your location, you may have rights to know or access personal information, obtain a portable copy, correct it, delete it, restrict or object to processing, withdraw consent, opt out of sale or targeted-advertising sharing, limit certain sensitive-data use, and appeal a denied request. You also may complain to your local data protection or consumer authority. We do not discriminate for exercising a privacy right.
Send a request to hello@qrcigars.com. Describe your relationship to QR Cigars and the brand or page involved. We may verify identity and authority before acting. Authorized agents may submit requests where law permits. Some information may be retained when an exception applies, such as security, legal claims, tax records, or another person's rights.
11. Regional disclosures
- EEA and UK: the legal bases are listed above. You may contact your supervisory authority. QR Cigars does not make decisions based solely on automated processing that produce legal or similarly significant effects.
- California and other US states: in the preceding 12 months, we collected and disclosed the categories listed in Sections 2 and 6 for the business purposes stated in Section 4. We did not sell or share personal information for cross-context behavioral advertising. We honor applicable browser opt-out signals for sale or sharing by maintaining that no-sale, no-share practice.
- Brazil: you may request confirmation, access, correction, anonymization, blocking, deletion, portability where regulated, sharing information, and withdrawal of consent, subject to the LGPD and its exceptions.
- Canada and other regions: you may request access and correction and challenge our compliance through the contact channel below, subject to local law.
12. Children and legal smoking age
QR Cigars is not directed to children or people below legal smoking age. Accounts are for adults. Optional Consumer Insights participation requires a separate confirmation of legal smoking age and research consent. We do not knowingly collect personal information from children through public cigar pages. If you believe a child provided data, contact us so we can investigate and delete it where required.
13. Security
We use administrative, technical, and organizational measures designed to protect information, including access controls, row-level database rules, server-side secrets, hashing of certain visitor and device identifiers, and audit records. No system is completely secure, and we cannot guarantee absolute security.
14. Changes and contact
We may update this Policy as products, providers, or laws change. We will post the revised date and provide additional notice when required. For privacy questions, requests, or complaints, email hello@qrcigars.com or write to Rojocuadrado LLC, doing business as QR Cigars, 1309 Coffeen Avenue, Suite 1200, Sheridan, Wyoming 82801, United States.