Privacy

Last updated 20 October 2026

This notice says what MrURL stores, and what it leaves on your device.

Who we are

MrURL is operated by Flava Digital Ltd, company number 10694772, registered at Belgrade Centre, Denington Road, Wellingborough, Northamptonshire, England, NN8 2QH.

Email [email protected]. Report a suspicious link to [email protected].

Why we use data

• Contract: to run your account, take payment, and operate your links.
• Legitimate interests: scan statistics for the link owner, security, abuse handling, and Google Web Risk checks.
• Legal obligation: billing records we have to keep.

Free QR codes

The free maker runs in your browser. The link, the colours and any logo are not sent to MrURL. A static code points straight at the address you typed.

Accounts

An account stores your email, a hash of your password, your plan, and your links. A link stores its code, name, destination, rules and any saved QR style.

Scans

When someone opens a dynamic link we log the time, the link, which rule matched, the country (from Cloudflare), a device type taken from the browser's user agent, and whether the visit looks like a bot. We do not log a name.

We don't store IP addresses with scan records. Our servers and Cloudflare keep security logs that include IP addresses for up to 30 days, to protect the service from abuse.

Pro keeps scan history for 1 year. Business keeps it for as long as the account exists.

If you scanned a MrURL code

A scan of a dynamic link logs the time, the link, which rule matched, the country, a device type, and whether it looked like a bot. The business that made the code sees counts by country and device. They do not see who you are.

Questions about a scan: email [email protected].

Who else handles data

• Cloudflare: proxy, security, and Turnstile on forms.
• Stripe: payments. Card details never touch MrURL.
• Google Web Risk: every destination URL is checked against it.
• Resend sends account emails, such as sign-up confirmations and password resets. Microsoft 365 handles email you send to us.
• Our servers are hosted by Microsoft Azure in the United States.
• Analytics: none. We don't use Google Analytics or any other tracking.

Transfers outside the UK

Microsoft Azure (our hosting), Cloudflare, Stripe, Google and Resend may process data in the United States. Where they do, it's under UK adequacy regulations (the UK–US data bridge) or the UK International Data Transfer Addendum.

Cookies

We only set cookies the site needs: sign-in and security cookies, your currency choice, and Cloudflare's security cookie. We don't use tracking cookies.

Cloudflare may set an essential security cookie, such as __cf_bm. Forms that need a check use Cloudflare Turnstile.

How long we keep it

• Account data is deleted within 30 days of you deleting the account.
• Billing records are kept for 6 years for tax.
• Scan history follows the plan: 1 year on Pro, and for as long as the account exists on Business.
• Server and security logs hold IP addresses for up to 30 days.

Your rights

You can ask for a copy of your data, have it corrected, or delete the account. Deletion is under Account, then Your data. Paid plans can export every link, destination and rule as CSV.

You can complain to the ICO.