Privacy Policy
Last updated 20 October 2026
This policy explains what personal data qodesign collects, why, who we share it with, how long we keep it, and what rights you have. It applies to the site https://qodesign.dev, our emails, our Instagram account and our customer support.
1. Who is responsible
The controller of your data is Wisdom Sphere LLC, a Delaware limited liability company, 16192 Coastal Hwy, Lewes, DE 19958, USA, which runs qodesign. For anything about your data, email [email protected].
We are based in the United States and sell worldwide. Because we offer our products to people in the EU, the EEA and the UK, we apply the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the UK GDPR to the data of people there (GDPR article 3(2)). We apply the same rights and choices to every customer, wherever you live.
Representatives in the EU and the UK. If we appoint a representative in the EU or the UK (GDPR and UK GDPR article 27), we will name them here, and you will be able to contact them instead of us. Until then, write to [email protected].
We have not appointed a data protection officer because the law doesn't require one for a business of our size and activity.
2. What we collect and why
| What | When | Why | Legal basis (GDPR art. 6) |
|---|---|---|---|
| Email address, sign-in records (date, IP address, device/browser) | You create an account or sign in with a magic link | To run your account and keep it secure | Contract (6(1)(b)); security: legitimate interest (6(1)(f)) |
| Order details: products, price, tax, currency, country, billing name and address, company name and VAT number if you give them, Stripe customer and payment IDs, card brand and last 4 digits | You buy something | To deliver your order, issue receipts and invoices, keep tax and accounting records | Contract (6(1)(b)); legal obligation (6(1)(c)) |
| Download log: which file, when, from which IP address | You download a file | To deliver files, stop link sharing, and show proof of delivery if a payment is disputed | Contract (6(1)(b)); legitimate interest (6(1)(f)) |
| Updates plan status and billing history | You subscribe to Updates | To give access to new releases and bill renewals | Contract (6(1)(b)) |
| Email address (and name if you give it) on the free code page | You ask for free code | To send you the code you asked for | Contract/your request (6(1)(b)) |
| Newsletter subscription | You press "Send it, plus new free ones" on the free code page | To send product news and offers | Consent (6(1)(a)), which you can withdraw at any time |
| Instagram username, the keyword you commented, and the messages we exchange | You comment a keyword under our posts or message us on Instagram | To send you the link you asked for and answer you | Your request (6(1)(b)); legitimate interest in answering messages (6(1)(f)) |
| Name, email, company, project details, budget, files you send | You use the "hire us" form or email us about a project | To answer, prepare a quote and do the work | Steps before a contract and the contract (6(1)(b)) |
| Support emails | You write to us | To help you | Contract (6(1)(b)) or legitimate interest (6(1)(f)) |
| Technical data: IP address, browser, pages requested, error logs | You visit the site | To deliver the site, protect it from abuse and fix errors | Legitimate interest (6(1)(f)) |
We don't collect special categories of data (health, religion and so on), and we don't make decisions about you based only on automated processing that have legal or similarly significant effects.
We get most data directly from you. Stripe and Link send us the payment details listed above. Instagram (Meta) sends us your username and messages when you interact with our account.
If existing customers have not opted out, we may email them about products similar to what they bought, where the law allows it (for example the "soft opt-in" under the EU ePrivacy rules and the UK PECR, and the US CAN-SPAM Act). Every email has an unsubscribe link and our postal address.
3. Who we share data with
We don't sell your data. We share it only with service providers who help us run the shop, under contracts that require them to protect it (data processing agreements, GDPR art. 28):
| Provider | What they do | Where |
|---|---|---|
| Stripe, Inc. (and its affiliates) | Payments, Checkout, subscriptions, refunds, invoices, tax calculation, fraud checks. For fraud prevention and legal duties Stripe also acts as an independent controller under its own privacy policy. | US and other countries |
| Sold through Link, LLC (Link, a Stripe company) | Merchant of record: charges your payment method, calculates and collects sales tax and VAT, sends receipts and invoices, handles refunds and disputes, and lets you manage subscriptions at link.com. Acts as an independent controller under its own privacy policy. If you ask Link to delete your data, Link also cancels your Updates plan and deletes the payment records it holds in our Stripe account. | US and other countries |
| Our server hosting provider | Hosts our server. The site, its database, user accounts and file storage run there, on software we operate ourselves (Coolify, and Supabase self-hosted) | The country where the server is located; ask us and we will tell you |
| Cloudflare, Inc. | DNS, content delivery and protection against attacks; sees IP addresses and technical request data | Global network, US company |
| Resend (Plus Five Five, Inc.) | Sends sign-in links, receipts, download emails and the newsletter | United States |
| Our business email provider | Our business email inbox for support | Depends on the provider; ask us and we will tell you |
| Meta Platforms Ireland Ltd. (Instagram) | Instagram comments and direct messages | EU, with transfers to the US |
| An Instagram reply tool, if we use one | Sends the automatic Instagram reply when you comment a keyword | Usually the United States |
| Our accountant | Bookkeeping and tax filings | United States |
Supabase is open-source software that we run on our own server; Supabase, Inc. does not receive your data.
We may also disclose data to public authorities when the law requires it (for example tax authorities), or to protect our rights in a dispute.
4. International transfers
We are a US company, so your data is processed in the United States, and our providers may process it in the other countries listed above. If you are in the EU, the EEA or the UK, we collect your data directly from you as a business based outside those areas. Where we pass EU, EEA or UK data on to a provider outside those areas, we rely on the EU-US Data Privacy Framework (and its UK extension) for certified companies, or on the European Commission's Standard Contractual Clauses and the UK addendum (GDPR articles 45 and 46). You can ask us for a copy of the safeguards.
5. How long we keep it
| Data | How long |
|---|---|
| Account | Until you delete it, plus 30 days for backups |
| Orders, invoices, accounting records | As long as US tax law and, where we are registered for VAT, those countries' rules require (up to 10 years) |
| Download logs | 3 years from the purchase (to handle disputes and claims) |
| Free code requests and newsletter | Until you unsubscribe, or 2 years after your last interaction with our emails |
| Instagram messages and DM automation data | 12 months after the last message |
| Project inquiries that don't become a project | 2 years |
| Custom project files and emails | For the duration of the project plus 4 years (the period in which claims can be brought) ; invoices as above |
| Support emails | 3 years |
| Server and security logs | Up to 30 days, unless needed to investigate an incident |
6. Your rights
You have the right to:
- access the data we hold about you and get a copy;
- correct data that is wrong;
- delete your data, when we no longer need it or you withdraw consent (we keep what the law makes us keep, such as invoices);
- restrict how we use it in some cases;
- object to processing based on legitimate interest, and to direct marketing at any time;
- portability: get the data you gave us in a common machine-readable format;
- withdraw consent at any time (for example, for the newsletter), without affecting what we did before.
To use any of these rights, email [email protected]. We answer within one month. We may ask you to confirm your identity first, usually by writing from your account email.
If you are in the EU or the EEA, you can complain to the data protection authority in the country where you live or work (list: edpb.europa.eu). In the UK, you can complain to the Information Commissioner's Office (ico.org.uk). We'd appreciate the chance to fix things first.
6a. If you live in the United States
We don't sell your personal information, and we don't share it for cross-context behavioral advertising. We don't use or disclose sensitive personal information. If you live in a US state with a consumer privacy law (for example California, Colorado, Virginia or Connecticut), you can ask us to access, correct or delete your data, and we will answer the same way as above. We treat a Global Privacy Control signal from your browser as a request to opt out of any selling or sharing. We don't respond to "Do Not Track" signals, because there is no common standard for them.
7. Security
Data travels over HTTPS. Your files are stored in a private storage bucket and downloaded through short-lived signed links. Access to the server and database is limited to us and protected with strong passwords and keys. We never see or store full card numbers; Stripe handles card data under the PCI DSS standard. No system is perfectly secure, and if a breach puts your rights at risk we will tell you and the authority as the GDPR requires.
8. Children
The shop is not meant for children. You need to be at least 18 to buy, and at least 16 to sign up for free code or the newsletter. We don't knowingly collect data from children under 16 (or under 13 in the US, as the Children's Online Privacy Protection Act requires). If you think a child has given us data, email us and we will delete it.
9. Cookies
We use only the cookies needed to run the site. We don't use analytics or advertising cookies. Details are in the Cookie Policy.
10. Changes
We will update this policy when our tools or practices change, and change the date at the top. If a change matters for how we use your data, we will tell account holders by email.