1. Scope and privacy roles
Rojocuadrado LLC, a single-member Wyoming limited liability company doing business as QR Cigars, operates QR Cigars from the Dominican Republic and is the controller or business for account, platform, billing, security, and service-analytics data described in this Policy. Its registered mailing address is 1309 Coffeen Avenue, Suite 1200, Sheridan, Wyoming 82801, United States.
A cigar brand usually acts as an independent controller or business for the contact details, subscriber records, and marketing choices submitted to that brand. QR Cigars hosts and processes that data to provide the feature, including transmitting announcement emails at the brand's direction and operating the unsubscribe mechanism for those emails. Requests about a brand's later emails, WhatsApp messages, or other use should be sent to that brand, although you may also contact us for assistance.
QR Cigars is also the controller for Lounge accounts, the free personal accounts smokers can open at qrcigars.com/lounge: the account, the optional profile, favorites, follows, smoke journal, picks, trivia answers, and QR Cigars' own emails to account holders. When a Lounge member follows a house with email updates on, the subscriber record that follow creates or links belongs to that brand, which acts as its controller as described above.
2. Information we collect
- Account and identity data: name, email, locale, authentication identifiers, organization role, and account settings.
- Brand and catalog data: brand contact details, country, logos, photographs, stories, cigar specifications, links, collections, and uploaded content.
- Billing data: plan, subscription status, trial dates, invoices, transaction references, and limited payment metadata. Clerk and Stripe process full payment-card details; QR Cigars does not store full card numbers.
- Subscriber and contact data: first and last name when provided, email or WhatsApp number, selected channel, consent time, source QR, rated cigar, and vote context for follow-up requests.
- Ratings and comments: thumbs-up or thumbs-down vote, optional comment, time, one-way device identifier hash, and one-way network-address hash.
- Taste questionnaire responses: selected answers, page context, time, one-way device identifier hash, one-way network-address hash, and, if the visitor then joins the brand's list, a link to that subscriber record.
- Optional Consumer Insights research: legal-age confirmation, consent record, notice version, broad optional age band, gender identity, cigar experience, purchase frequency and channel, discovery source, purchase intent, page context, language, time, coarse country when available, and a hash of a random one-time response token. The research response does not contain your name, contact details, subscriber record, raw IP address, stable device or visitor identifier, user agent, QR code, exact cigar, exact location, or free text. It is never linked to a Lounge account or profile, even when the same person has one.
- Lounge account data: name, email address verified at sign-up, language, when you accepted the Terms and the Consumer Profile Notice, whether and when the age check passed, a broad age band, your email choices, and when you last used the Lounge. The date of birth you enter at sign-up is used only for the age check and is not stored.
- Lounge profile, optional and answered by tapping choices: the country and optional region you choose, usual strength, favorite vitola shapes, how often you buy cigars, where you usually buy, a broad price range per cigar, cigar experience, gender identity or prefer not to say, and how you found each house you follow. The profile never includes how many cigars you smoke, an exact birth date, income, ethnicity, health information, precise location, or free text about you, and its answers are kept out of PostHog and session replay. The Consumer Profile Notice describes this purpose.
- Lounge activity: the houses, lines, and vitolas you save; the houses you follow and whether email updates are on for each; smoke journal entries with the cigar, date, rating, pairing, and a private note; your weekly picks and what you did with them; trivia answers; and a record of each Lounge email sent to you.
- Usage and QR analytics: page path, QR code, page views, contact-link clicks, time, coarse country, region and city, device type, browser, operating system, language, referring domain, and a one-way visitor hash. Catalog visits and contact-link clicks are counted for every visitor without cookies or device storage; their hash is computed on our server from the network address, browser user agent, and brand with a key that changes daily, so it does not link visits across days or brands. The same cookieless measurement records catalog engagement (active time on a page, how far it was scrolled, and interactions such as reading the brand story, viewing photos, sharing, opening Where to Buy or a retailer, switching language, starting a rating, and viewing a deal or event) and campaign tags (utm_source, utm_medium, and utm_campaign) read from the page address.
- Site and product analytics: pages visited, time on page, page-load performance, named product events such as a vote, a sign-up, or a published catalog, referring page, device type, browser, operating system, language, and coarse location, recorded by Vercel Web Analytics and PostHog for every visitor without cookies or device storage. PostHog also records clicks and form interactions on page elements (never what is typed; forms that collect personal details are excluded), repeated or unresponsive clicks, and click and pointer positions used for heatmaps; on public pages it keeps the visible text of a clicked element, and in the signed-in dashboard that text is masked. With Allow analytics, PostHog also keeps a random identifier in the browser, links a signed-in session to its QR Cigars account identifier, and records session replays with inputs and page text masked.
- Retail locator data: brand-supplied physical and online retailer names, addresses, coordinates, purchase links, shipping coverage, contact details, bilingual notes, and whether a visitor reported finding or not finding the brand's cigars at a physical location. We store a one-way visitor hash for duplicate prevention and abuse controls. If you choose nearby sorting, your precise browser location stays on your device and is not sent to QR Cigars.
- Event and RSVP data: event details, selected catalog items, touchpoint QR attribution, attendee name and contact details when submitted, RSVP consent, separate optional marketing consent, response status, and event-level analytics.
- Premium workspace data: uploaded media and rights or provenance records; monitoring topics and source candidates; AI instructions, approved catalog grounding, generated drafts, selected provider and model, review decisions, and usage or cost records. Provider keys supplied by a brand are encrypted and are not returned to the browser.
- Native app and notification data: Apple push token and environment, app and operating-system version, device model, per-brand notification preferences, delivery status, and the brand or account selected in QR Cigars Pulse. Lock-screen notification copy does not include subscriber identity.
- Support and administration data: messages, requests, internal support notes, plan changes, audit records, and security reports.
3. Sources of information
We receive information directly from you, from other authorized users in your organization, from visitors who scan or interact with cigar or event pages, from the cigar brand a visitor chooses to contact, from authentication, payment, media, AI, search, email, and notification providers, and automatically from browsers, native apps, devices, QR requests, and service logs.
4. Purposes and legal bases
- Contract and requested service: create accounts, authenticate users, operate Lounge accounts, saves, follows, the smoke journal, picks, and trivia, create or link a brand's subscriber record when a Lounge member follows it with email updates on, host catalogs and media, route QR codes, provide subscriptions, process ratings, questionnaire responses, RSVPs and contact requests, generate private drafts when requested, deliver notifications, and provide support.
- Account events: when an account holder signs up, creates a brand, publishes or unlists a catalog, adds cigars, connects QR codes, sends an announcement, or starts, changes, or cancels a trial or subscription, our servers send the event to PostHog with the QR Cigars account identifier and non-personal details such as the plan or a count. These events contain no name, email address, phone number, network address, or location, and create no person profile. The same applies when a Lounge member signs up, follows a house, or saves a cigar, and those events never include a profile answer.
- Search statistics: aggregated figures that Google Search Console provides for public qrcigars.com pages, namely daily impressions, clicks, click-through rate, average position, and the search terms Google chooses to report. Google aggregates and filters these before we receive them, and they contain no information about individual visitors.
- Consent: send or enable marketing requested by a visitor, let PostHog keep an identifier in cookies and local storage and record masked session replays when a visitor selects Allow analytics, and process optional Consumer Insights answers for adult-consumer research, service improvement, and deidentified and aggregated market intelligence. Consent can be withdrawn for future processing.
- Lounge profile and emails: with your consent under the Consumer Profile Notice, QR Cigars uses the optional profile to personalize your picks, digest, and house suggestions and to create the aggregate statistics described in Section 5. With the consent you give when you create a Lounge account, QR Cigars sends you Lounge emails such as the house digest and the Cigar of the Week until you turn them off. The profile is not used for advertising outside QR Cigars, eligibility, pricing, or decisions with legal or similarly significant effects.
- Legitimate interests: secure the Service, prevent duplicate or abusive ratings, measure QR scans, count catalog visits, contact-link clicks, catalog engagement, and campaign tags without cookies, measure use of the site and dashboard, including clicks and heatmaps, with Vercel Web Analytics and PostHog without cookies or device storage, record account and billing events for product analytics, give each brand counts of its Lounge followers and saves without identity, report aggregated search statistics to brands, maintain reliability, troubleshoot, improve features, protect rights, and understand aggregated use, balanced against individual rights.
- Legal obligations: tax and accounting, lawful requests, sanctions, consumer protection, security incident response, and enforcement.
- Protection of rights: investigate misuse, preserve evidence, resolve disputes, and enforce agreements.
5. Information visible to cigar brands
The brand whose page you use can receive its subscriber list, contact requests, comments, ratings, and aggregated or pseudonymous product analytics. This may include contact details you intentionally submit, the cigar and vote connected to a follow-up request, coarse geography, device and referral breakdowns, and QR activity. Brands do not receive raw IP addresses from QR Cigars.
A brand can also see aggregate found and not-found counts for each retailer it published. It does not receive the reporter's precise location, raw IP address, or identity from this feature.
When a Lounge member follows a house with email updates on, that brand receives an ordinary subscriber record with the member's name, verified email address, and language, marked as a Lounge follow. When the member unfollows, turns email updates off, or deletes the Lounge account, the record is unsubscribed and the brand keeps it as proof of the opt-out. A follow with email updates off is only counted, and the brand receives no identity for it.
Brands never receive a Lounge member's profile answers, smoke journal, favorites, picks, trivia answers, or the other houses the member follows. A brand sees its follower and save counts and, on plans that include it, statistics about its followers' profiles only when at least 25 people are counted and every group shown has at least 10, with smaller groups hidden.
A participating brand does not receive raw Consumer Insights responses. It may receive a frozen, suppression-protected report only after the applicable minimum cohort is met. QR Cigars may later license or sell deidentified and aggregated market or benchmark reports that pass its minimum-person, minimum-account, small-cell, complementary-suppression, and dominance controls; those reports do not disclose an individual response or another participating brand's identifiable result.
Catalog activity from brands that have not turned data sharing off (QR scans, catalog visits, contact taps, engagement, and Lounge follower and save counts, without any visitor or member identifier) may be combined across brands into the same kind of de-identified aggregate market reports, under the same controls. Lounge profile answers may be included in those reports only under the same controls, never as an individual profile.
QR Cigars publicly commits to maintain De-identified Aggregate Data in deidentified form, not to attempt to reidentify a person, household, or participating client from it, and to contractually prohibit report recipients from attempting reidentification or using a report to single out a participant.
Brand owners must use this information under their own privacy notice and applicable law. QR Cigars does not control messages or processing that a brand performs after exporting data from the platform.
6. How we disclose information
QR Cigars does not sell personal information for money and does not share personal information for cross-context behavioral advertising. We do not use sensitive personal information to infer characteristics. We do not knowingly disclose personal information to data brokers.
- Service providers that support authentication, databases and storage, hosting, map tiles, analytics, payment processing, email delivery, media processing, AI or search requested by an authorized brand user, mobile notifications, security, and support. These include Clerk, Supabase, Vercel, OpenStreetMap or another configured map tile provider, PostHog, Stripe, Resend, Bunny, Anthropic, OpenAI, xAI, Apple, and Sentry where the relevant feature is enabled. A map tile provider receives ordinary network request data and the requested map area, but QR Cigars does not send it your precise browser geolocation value.
- The cigar brand or organization that you intentionally ask to contact you, including a house you follow from a Lounge account with email updates on.
- Professional advisers, auditors, insurers, and transaction counterparties under appropriate confidentiality obligations.
- Authorities or other parties when required by law or reasonably necessary to protect users, the public, QR Cigars, or legal rights.
- A successor in a merger, financing, acquisition, reorganization, or sale, subject to applicable notice and privacy requirements.
8. Retention
- Account, contract, and billing records are kept while the account is active and afterward as needed for tax, accounting, fraud prevention, disputes, and legal obligations.
- Brand and catalog content remains until an authorized user deletes it or the account is closed, subject to backup cycles and legal holds.
- Private media, AI drafts, Newsroom candidates, event records, usage ledgers, and related audit history remain while needed for the workspace, rights history, metering, security, or contractual records, then are deleted or de-identified under the applicable feature controls and backup cycles.
- A mobile push device remains registered until it is revoked, becomes invalid, or is removed under retention and security procedures. Notification jobs and delivery outcomes are retained as operational and audit records for a limited period.
- Subscriber and contact records remain until the brand or QR Cigars deletes them, the person withdraws or objects, or they are no longer needed. When someone subscribes by email, QR Cigars sends a confirmation email and keeps the address out of platform announcement audiences until the person confirms. A follow from a Lounge account is confirmed by the account's verified email address instead. When a brand sends announcement emails through the platform, QR Cigars transmits them on the brand's behalf: every announcement includes an unsubscribe link and a one-click unsubscribe header, and an unsubscribed address is suppressed from that brand's future announcements while the record is kept as proof of the opt-out. Each brand remains responsible for any additional confirmation, consent, and messaging rules that apply to contact outside the platform.
- A Lounge account and everything attached to it (profile, favorites, follows, smoke journal, picks, trivia answers, and email records) are kept for the life of the account. When the member deletes the account, they are deleted at once and every linked brand subscriber record is unsubscribed, except for backup copies that expire on their normal cycle. An account without a sign-in for 24 months receives a warning and is then deleted the same way unless the member signs in.
- QR scan records lose their visitor hash, city, and region after 400 days. Scan, catalog-visit, and contact-click records are deleted after 800 days, which keeps a full year of reporting comparable with the year before. Daily aggregate counts that contain no visitor identifier are kept for trend history.
- Ratings, comments, audit logs, and other product analytics are kept while reasonably useful for the service, security, trend analysis, and brand reporting, then deleted, aggregated, or de-identified.
- Raw Consumer Insights responses expire no later than 400 days after submission and may be removed sooner with the signed withdrawal receipt held by the submitting browser. A response already incorporated into a sufficiently aggregated, non-identifying frozen report cannot be separated from or reversed out of that report, but the retained raw response is still subject to withdrawal and expiration.
- Cookie and browser-storage duration is described in the Cookie and Storage Notice. Backups are deleted on rolling schedules unless preservation is legally required.
9. International transfers
QR Cigars and its providers may process information in the United States and other countries that may not provide the same protections as your home country. Where required, we take steps designed to rely on lawful transfer mechanisms, provider data-processing terms, contractual safeguards, or other approved protections. Contact us to request available information about relevant safeguards.
10. Your privacy rights
Depending on your location, you may have rights to know or access personal information, obtain a portable copy, correct it, delete it, restrict or object to processing, withdraw consent, opt out of sale or targeted-advertising sharing, limit certain sensitive-data use, and appeal a denied request. You also may complain to your local data protection or consumer authority. We do not discriminate for exercising a privacy right.
A Lounge member can review and change profile answers and email choices, and delete the account, in Lounge settings at any time without contacting us. Deleting the account removes the profile and everything attached to it and unsubscribes every linked brand subscriber record; each brand keeps its own record of that opt-out, as with any unsubscribe. For how a brand used your subscriber record outside QR Cigars, contact that brand.
Send a request to hello@qrcigars.com. Describe your relationship to QR Cigars and the brand or page involved. We may verify identity and authority before acting. Authorized agents may submit requests where law permits. Some information may be retained when an exception applies, such as security, legal claims, tax records, or another person's rights.
11. Regional disclosures
- EEA and UK: the legal bases are listed above. You may contact your supervisory authority. QR Cigars does not make decisions based solely on automated processing that produce legal or similarly significant effects.
- California and other US states: in the preceding 12 months, we collected and disclosed the categories listed in Sections 2 and 6 for the business purposes stated in Section 4. We did not sell or share personal information for cross-context behavioral advertising. We honor applicable browser opt-out signals for sale or sharing by maintaining that no-sale, no-share practice.
- Brazil: you may request confirmation, access, correction, anonymization, blocking, deletion, portability where regulated, sharing information, and withdrawal of consent, subject to the LGPD and its exceptions.
- Canada and other regions: you may request access and correction and challenge our compliance through the contact channel below, subject to local law.
12. Children and legal smoking age
QR Cigars is not directed to children or people below legal smoking age. Business accounts are for adults. A Lounge account requires a date-of-birth check at sign-up showing that the person is 21 or older, in every country; the date is discarded after the check, and only the result and a broad age band are kept. Optional Consumer Insights participation requires a separate confirmation of legal smoking age and research consent. We do not knowingly collect personal information from children through public cigar pages or the Lounge. If we learn that a Lounge account belongs to someone under 21, we delete it. If you believe a child provided data, contact us so we can investigate and delete it where required.
13. Security
We use administrative, technical, and organizational measures designed to protect information, including access controls, row-level database rules, server-side secrets, hashing of certain visitor and device identifiers, and audit records. No system is completely secure, and we cannot guarantee absolute security.
14. Changes and contact
We may update this Policy as products, providers, or laws change. We will post the revised date and provide additional notice when required. For privacy questions, requests, or complaints, email hello@qrcigars.com or write to Rojocuadrado LLC, doing business as QR Cigars, 1309 Coffeen Avenue, Suite 1200, Sheridan, Wyoming 82801, United States.