Privacy policy

This policy explains what Kizmo collects on kizmo.io, app.kizmo.io and api.kizmo.io, and why.

Things we never collect

• Static QR code content. The generator runs in your browser; what you type and any logo you upload stay on your device.
• Photos in the safety checker. Images are decoded in your browser. Only the link inside the code is sent to us for the redirect check.
• IP addresses of people who scan codes. We don't store them.

People who scan a Kizmo code

When someone scans a dynamic Kizmo code we record: the time, approximate country and city (from the network, not GPS), device type (iOS, Android, desktop, other) and a salted hash that changes every day, used only to count unique visitors. We set no cookies on redirects. This data is shown only to the code's owner and used to detect tampering.

Payments

Paid plans are sold by Creem, our merchant of record. Creem collects and processes your card and billing details under its own privacy policy; we never see or store your card number. We keep your plan, subscription status, renewal dates and the Creem customer and subscription identifiers so we can apply your plan.

Account holders

We store your name, email, hashed password, business profile, the codes you create and their destination history. Sessions record the browser and IP address for security, such as spotting unfamiliar sign-ins.

Reports

If you report a code, we store the report and, only if you provide it, your email address. The code's owner sees the reason and location you give, never your email.

Processors

We use Vercel (hosting), Neon (managed Postgres database), Creem (payments, tax and invoicing, as merchant of record) and an SMTP email provider to send alerts, account emails and billing reminders. Website analytics use Vercel Web Analytics, which does not use cookies, and Google Analytics, which is off until you choose "Allow" in the banner. If you allow it, Google sets analytics cookies and receives anonymised page views; we turn off advertising features and IP storage. You can change your mind by clearing this site's data in your browser.

Cookies

Signed-in accounts use a session cookie. The website also sets one first-party cookie, kz_src, for 90 days. It holds only the site that referred you (or the campaign name in the link) and the first page you visited, so we can see which channels bring new customers. It is shared between kizmo.io and app.kizmo.io, is never sent to third parties, and is not used to follow you on other websites.

Retention and your rights

Account data is kept while your account is open and deleted within 30 days of account deletion, except where we must keep records for legal reasons. Scan records are kept for up to 25 months. You can request access, correction, export or deletion at any time by emailing privacy@kizmo.io.