Controller and processor roles
Customers control the QR destinations, landing page content, pixels, and campaigns. BrandCode processes platform data needed to operate the service.
DPA
Data processing materials for business reviews.
BrandCode maintains a DPA-ready operating model for customers that need privacy review, subprocessors, data export, deletion, and retention discussions.
Data subject rights
Workspace owners can request export, deletion, account review, and retention changes through support or account workflows.
Security controls
The platform includes secure headers, RLS, workspace access controls, audit foundations, API key hashing, and abuse-reporting paths.