KOS QR Studio Privacy Policy

Version 0.2 | September 29, 2026

This Privacy Policy explains how BrandCraft Solutions LLC, a Nevada limited liability company, doing business as The King of Steam (“KOS,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information in connection with KOS QR Studio and its related websites, dashboards, hosted QR redirects, email messages, checkout flows, support channels, and APIs (collectively, the “Service”).

1. Scope

This Policy applies to KOS QR Studio customers, authorized workspace users, visitors to KOS QR Studio websites, people who scan a KOS-hosted QR code, and people who contact us about the Service.

A customer may use a QR destination page to collect information for its own purposes. In that situation, the customer controls that collection and must provide its own privacy notice. This Policy covers KOS’s processing, not the independent practices of a customer’s destination website or another third party.

2. Information we collect

2.1 Account and profile information

We collect information such as name, email address, account status, workspace role, email-verification status, and authentication records. Passwords are stored only as one-way hashes. Session records may include a session-token hash, coarse country value, browser user-agent string, creation time, expiration time, and last-use time.

2.2 Subscription, order, and support information

We receive commerce and subscription information needed to provision and support an account, such as customer email, product or price references, order and subscription status, renewal or cancellation status, service period dates, and transaction references. Payment card details are collected and processed by the checkout/payment provider and are not stored in KOS QR Studio’s scan-event database.

If you contact us, we collect the information in your message and any details reasonably needed to answer or resolve the request.

2.3 QR-code and workspace content

We collect the information you choose to add to the Service, including code names, destination URLs, editable slugs, folders, design settings, uploaded logos or files, templates, language routes, team invitations, API-key names and one-way key hashes, and related operational records.

2.4 Scan and interaction information

For an active paid account, a scan-event row may include:

• the QR campaign identifier;
• date and time;
• event type;
• browser-preferred languages and the language selected for routing;
• general device class, such as mobile, tablet, desktop, bot, or unknown;
• approximate country, region, city, continent and timezone when supplied by the network provider (IP estimates, not GPS);
• estimated browser, operating system and device family;
• network organization and ASN when supplied, which do not establish a mobile carrier;
• suspected automated traffic, destination hostname, and explicit campaign attribution tags;
• referring origin, when a browser supplies one, excluding URL paths and query strings; and
• a limited operational note.

Browser Do Not Track and Global Privacy Control signals suppress city, region, timezone, network and campaign-tag enrichment. The redirect does not fingerprint visitors, set analytics cookies, collect GPS, or identify unique people. A recorded request can also be a link click, preview or automated request. Older events may contain only the fields collected at that time.

KOS QR Studio scan-event rows do not store a raw IP address. We use a request IP transiently in memory for basic anti-abuse rate limiting on certain public write endpoints, but the current application does not write that IP to the KOS QR Studio database. Cloudflare and other network providers may independently process IP addresses and traffic metadata in transit or in infrastructure logs to deliver, secure, and troubleshoot the Service.

Under the approved Frozen-state design, scans continue to be counted for the account’s UTC-month allowance and lifetime total, but new per-scan analytics detail is not collected or made available after the paid term ends.

2.5 Automatically collected website information

Like most online services, the Service and its infrastructure providers may process IP address, browser type, device and operating-system information, referring page, requested URL, date and time, security signals, cookies, and similar technical information needed to route traffic, maintain sessions, prevent abuse, measure reliability, and diagnose problems.

3. How we use information

We use information to:

• provide accounts, hosted redirects, QR creation, downloads, dashboards, analytics, APIs, email, and support;
• authenticate users and protect accounts;
• process and reconcile subscriptions, orders, renewals, cancellations, and entitlements;
• enforce code, scan, seat, bulk, API, and branding limits;
• maintain the Code Continuity Guarantee and Frozen-state routing;
• count usage and provide customer-requested analytics;
• send password resets, receipts, service notices, security notices, and other transactional communications;
• detect, investigate, and prevent abuse, fraud, malware, phishing, and security incidents;
• debug, maintain, and improve the reliability and accessibility of the Service;
• comply with law, enforce agreements, and resolve disputes; and
• carry out another purpose you request or consent to.

Where applicable law requires a legal basis, we process information as needed to perform a contract, comply with legal obligations, protect legitimate interests in operating and securing the Service, protect vital interests, or act with consent. You may withdraw consent for future processing where consent is the basis, without affecting earlier lawful processing.

4. When we disclose information

We disclose information only as described in this Policy, including:

• to service providers and processors that help operate the Service;
• to authorized workspace owners or administrators as needed to manage their workspace;
• to professional advisers, auditors, insurers, and financing or transaction participants subject to appropriate duties;
• when required by law, legal process, or a valid government request;
• when reasonably necessary to prevent harm, fraud, abuse, or a security incident; and
• in connection with a merger, financing, reorganization, acquisition, or sale, subject to continued protection of the information.

KOS QR Studio does not sell personal information for money. We do not use scan-event data for cross-context behavioral advertising.

5. Service providers and processors

The Service currently relies on or is designed to rely on the following providers. Each provider processes only the information reasonably needed for its role and is also governed by its own contractual and privacy obligations.

We do not intentionally submit customer QR destinations or scan-event rows to OpenAI for model training. If KOS later introduces an AI-assisted customer feature, we will identify the feature and the information it needs before activation and update this Policy when appropriate.

6. Cookies and similar technologies

KOS QR Studio uses cookies or comparable browser storage where needed to keep users signed in, remember security state, maintain checkout or account flows, and prevent abuse. We may also use limited measurement technologies if they are disclosed and configured consistently with applicable consent requirements. Disabling essential cookies may prevent account sign-in or checkout from working.

7. Retention

We keep information only as long as reasonably needed for the purposes described in this Policy, including to provide the Service, honor code continuity, maintain security and financial records, resolve disputes, and comply with law.

• Account and subscription records: retained while the account is active or Frozen and for a reasonable period afterward where needed for continuity, legal, security, tax, or dispute purposes.
• Code and destination records: retained while necessary to operate the code and honor the Code Continuity Guarantee, unless the account owner completes the confirmed account-deletion process or a safety or legal exception requires action.
• Paid analytics: retained with the account so historical paid analytics remain available when service is reactivated, unless deletion is requested and legally permitted.
• Frozen usage: retained only to the extent needed for UTC-month allowance and lifetime-count operation; the approved design does not create new customer-visible per-scan detail after the paid term.
• Password-reset records: expire after their stated validity period and are retained only as needed for security and audit purposes.
• Commerce and legal records: may be retained for the period required by tax, accounting, payment, dispute, and other legal obligations.

When information is no longer needed, we delete, de-identify, or securely isolate it. Backup and provider deletion cycles may take additional time.

8. Account deletion and the continuity warning

You may request account deletion by contacting us or using an available account control. Because deleting an account may permanently retire hosted QR codes, we require confirmation through the account email and provide a 14-day warning period before final deletion. Eligible redirects continue during the warning period unless a legal or safety exception applies. You may withdraw the request before the warning period ends.

After confirmed deletion is completed, KOS may retire the account’s hosted codes and delete or de-identify associated personal information, subject to records we must retain by law or for security, fraud prevention, and dispute resolution. Deletion ends the Code Continuity Guarantee for that account.

9. Security

We use administrative, technical, and organizational safeguards designed to protect information, including encrypted transport, provider-managed encryption at rest for the application database, hashed passwords and tokens, access controls, signed webhook verification, request limits, and account-level data isolation. No method of transmission or storage is completely secure, so we cannot promise absolute security.

You are responsible for using a strong, unique password, protecting access to your email account, and notifying us promptly about suspected unauthorized activity.

10. International processing

KOS and its providers may process information in the United States and other countries where they operate. Those countries may have data-protection laws different from the laws where you live. Where required, we and our providers use recognized transfer mechanisms and contractual safeguards.

11. Your choices and privacy rights

Depending on where you live, you may have rights to request access, correction, deletion, restriction, objection, portability, or a copy of personal information, and to appeal a denied request. You may also have the right to withdraw consent or complain to a data-protection authority.

To make a request, email billing@brandcraftsolutionsllc.com from the address associated with the account. We may need to verify your identity and authority. Some information may be exempt from a request or retained where required by law, needed for security or fraud prevention, or necessary to complete a confirmed continuity or deletion instruction.

Transactional messages necessary to provide or secure the Service are not marketing emails. Where we send marketing email, you may unsubscribe using the link in the message.

12. Children

The Service is intended for businesses and adults and is not directed to children under 13. We do not knowingly collect personal information from a child under 13. If you believe a child has provided information, contact us so we can investigate and take appropriate action.

13. Changes to this Policy

We may update this Policy to reflect changes in the Service, law, or our practices. We will post the revised date and provide additional notice when required. Material changes do not authorize KOS to use previously collected personal information for a materially incompatible purpose without the notice or consent required by law.

14. Contact

Privacy questions and requests may be sent to:

BrandCraft Solutions LLC, doing business as The King of Steam Email: billing@brandcraftsolutionsllc.com Support target: reply within one business day.