Privacy notice
QRveo operates a video hosting platform: you upload a video, it is published behind a QR code, and your customers watch it on a watch page. To run that service we process two kinds of personal data, data about your account and data about the people who scan your QR codes.
We use this data only to operate the service, keep accounts secure, show you your own analytics, prevent abuse, comply with legal obligations and answer support requests. We do not sell personal data and we do not use your videos or your viewers' data to train third-party models.
- Account data: name, work email, company, role and billing contact of the people who create videos.
- Content data: video files, covers, images, documents and published text, plus scan and playback events (time, approximate location by IP, device, completion rate) shown to you as analytics.
- Technical logs: IP address, authentication events, administrator actions and error traces, kept for security and troubleshooting.
- Support communications: the messages you send us and the history of each request.
Mexico, Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP): you may exercise your ARCO rights (access, rectification, cancellation and objection) by writing to privacidad@qrveo.com. We answer within 20 business days. European Economic Area, UK and Switzerland: where the GDPR applies you may also request restriction, portability or object to processing based on legitimate interest. When you publish your own videos, you are the controller of your viewers' data and QRveo acts as your processor; the terms of that relationship are in the Data Processing Agreement below. Retention: account data while the account is active and up to 12 months after closure; content until you delete it or the contract ends; technical logs for 90 days; billing records for five years where tax law requires it. Where your installation is self-hosted, videos and metadata stay on infrastructure you control. For managed installations we rely on a short list of sub-processors (cloud hosting, transactional email, error monitoring) that we share on request.
Terms of service
By creating an account or uploading a video you accept these Terms. They apply to the admin console, the watch pages, the anonymous upload flow and any embed the platform generates.
- Eligibility: you must be at least 18 years old and, when signing up for a company, have authority to bind it.
- Your account: keep credentials confidential; you are responsible for activity under your account and for the people you invite.
- Your content: you keep every right you had in your videos, images and documents. You grant QRveo a limited licence to host, transcode, store and deliver that content and to display covers and thumbnails, only to operate the service.
- Your responsibilities: you confirm you own or are licensed to publish the content, that you hold the consents the law requires from people appearing in it, and that it complies with the Acceptable Use Policy.
- Plans and quotas: storage, video count and retention follow the contracted plan; exceeding a quota may pause uploads but never deletes content without notice.
- Suspension and termination: we may suspend an account for a material breach, non-payment or a legal requirement. After termination you have 30 days to export your content; afterwards it is removed from active systems and backups rotate out.
The platform itself, its software, interface, brand and documentation, belongs to QRveo and its licensors; nothing in these Terms transfers it to you. The service is provided as-is within the limits of the SLA. To the extent permitted by law, QRveo's total liability is capped at the fees paid in the twelve months before the claim and neither party is liable for indirect or consequential damages. You indemnify QRveo against third-party claims arising from content you publish. These Terms are governed by the laws of Mexico, with courts in Mexico City; if a clause is unenforceable, the rest remains in force.
Cookie policy
The platform uses a small number of cookies and browser storage entries. We do not run advertising cookies and we do not sell data to data brokers.
- Strictly necessary: session and authentication cookies, CSRF protection and load-balancing affinity. Blocking them prevents sign-in.
- Preferences: language (ES/EN) and interface theme, stored locally in your browser.
- Security: short-lived tokens that rate-limit failed sign-ins and anonymous uploads.
- Product analytics: aggregated first-party counters of page and player events used to fix what breaks; they contain no cross-site identifiers and can be disabled per installation.
You can clear or block cookies in your browser settings. Because there is no third-party tracking, the platform works without a consent banner; where local law requires a notice, for example when analytics are enabled, the operator of that installation displays it.
Data processing agreement (DPA)
This agreement applies when QRveo processes personal data of your viewers, leads or team members on your behalf, and forms part of the Terms of service.
- Roles: you are the controller (responsable) of the data and QRveo is the processor (encargado), acting only on your documented instructions, which are the configuration and use of the product.
- Confidentiality: access is limited to personnel who need it and who are bound by confidentiality obligations.
- Security: encryption in transit, least-privilege access control, isolated storage per installation and the measures described in the Security section.
- Sub-processors: we inform you of any change that affects your data and give you the chance to object; they are bound by equivalent obligations.
- Data subject requests: the console provides export and deletion tools; we assist you within five business days when a request needs our help.
- Breach notification: we notify you without undue delay and, where possible, within 72 hours of confirming a breach affecting your data, with the information you need for your own notification duties.
- Audits: on request we answer security questionnaires and provide a yearly summary of our controls.
- End of service: your data is returned in a standard format and deleted, including backups within their rotation window.
To execute a signed copy write to legal@qrveo.com. Where data leaves Mexico or the European Economic Area, transfers rely on the Standard Contractual Clauses or an equivalent legal mechanism.
Acceptable use policy
The platform exists to explain products; it must not be used to distribute content that harms people. The following is prohibited in videos, images, documents, titles, covers or links:
- Content that is illegal in Mexico or in the country where the QR is distributed, including material that sexualises minors, which we remove immediately and report to the competent authorities.
- Inciting violence, harassment, hate speech or discrimination.
- Recording or publishing people without the consent the law requires, or publishing private information such as addresses, identity documents or health data.
- Malware, phishing pages, deceptive redirects or links that imitate another brand.
- Content you do not own or license, including music, footage or trademarks used without permission.
- Circumventing access controls, QR protections, watermarks or DRM, or reselling platform access without written authorisation.
- Automated scraping, load testing or penetration testing without prior written authorisation, and any attempt to reach another tenant's data.
We act on reports: content is reviewed and, depending on severity, removed, the account suspended or the contract terminated; serious cases are reported to authorities. To report abuse write to abuso@qrveo.com with the QR link or the video ID.
DMCA and intellectual property
We respect intellectual property and answer notices under the U.S. Digital Millennium Copyright Act, the Mexican Ley Federal del Derecho de Autor and the notice-and-action rules of the EU Digital Services Act.
- Send notices to legal@qrveo.com identifying the protected work, the exact URL, QR link or video ID of the material, your contact details, a statement that you believe in good faith the use is unauthorised, a statement under penalty of perjury that the information is accurate and that you are the owner or are authorised to act for them, and your signature.
- We remove or disable access to the material and notify the account holder, who may send a counter-notice with the same elements plus consent to jurisdiction.
- Accounts that repeatedly receive valid notices are terminated.
- A knowing misrepresentation in a notice may make the sender liable for damages.
Security
Security is designed into the product: content lives in buckets that are not publicly listable, links can be revoked, and every installation keeps its own keys.
- Access: role-based permissions in the console, individual accounts instead of shared logins, and administrator actions recorded in an audit trail.
- Transport and storage: HTTPS with modern ciphers for every watch page and API call, and encryption at rest on the storage layer where the installation supports it.
- Isolation: each private installation runs its own database, storage and credentials; videos are not shared between tenants.
- Control over each video: QR links can require rules such as expiry, view limits, domain or IP restrictions, and can be revoked at any time without reprinting the code.
- Backups and recovery: metadata is backed up daily; content retention depends on the plan.
- Vulnerability reports: write to seguridad@qrveo.com; we acknowledge within two business days. Please do not test against production accounts you do not own.
No system is perfectly secure. If we confirm an incident that affects your data, we notify you under the terms of the Data processing agreement.
Service level and availability (SLA)
For managed installations QRveo targets 99.5% monthly availability of watch pages, the admin console and the public API, measured as the percentage of successful requests.
- Maintenance: planned windows are announced at least 48 hours in advance and, whenever possible, scheduled outside Mexico City business hours.
- Support: Monday to Friday, 09:00 to 18:00 (America/Mexico_City). Priority 1, service down: response within 4 business hours. Priority 2, degraded: 1 business day. Priority 3, questions: 3 business days.
- Credits: below 99.5% a 5% credit of the monthly fee; below 99% a 10% credit; below 95% a 25% credit. Request credits within 30 days of the affected month.
- Exclusions: force majeure, failures of the customer's own network, DNS or CDN, customer misconfiguration and third-party infrastructure outside our control.
For self-hosted installations availability depends on the infrastructure the customer operates; the figure above is a reference, not a commitment.
