Privacy policy

Who is responsible

The data controller is the operator of this website. Contact the administrator using the email address provided on this site.

If you have an account

• Account data: name, email address, password (stored only as a secure hash), language and time zone.
• Security data: active sessions with IP address and browser, to show your signed-in devices; two-factor authentication settings.
• Content you create: QR codes, their destinations, designs, uploaded logos and custom domains.

We use this data to provide the service you signed up for (legal basis: contract, Art. 6(1)(b) GDPR) and to keep it secure (legitimate interest, Art. 6(1)(f)).

If you scan a QR code

• Date and time of the scan.
• Device type, operating system, browser and preferred language, derived from your browser's request.
• Approximate location (country, region, city) when provided by our network provider; never GPS.
• The domain of the referring page, if any.
• A pseudonymous visitor identifier: the random ID in the qr_vid cookie (see Cookies) or, if your browser doesn't keep it, a keyed one-way hash of your network and browser. Your IP address itself is not stored.

These statistics are shown to the owner of the QR code and the team members they invite, so they can measure their campaigns (legitimate interest, Art. 6(1)(f) GDPR). Owners can also receive them by email or send them to their own systems through our API and webhooks; they are responsible for that use. Known bots are not recorded.

When a code belongs to a business, that business decides how scan data and answers to its forms are used and is their data controller; we process them on its behalf under our data processing agreement. To exercise your rights over that data, contact the business.

If you report a code

We use what you send us (the address, your description and, if you give them, your name and email) only to handle the report, tell you the outcome and, if needed, defend against legal claims (legal obligation and legitimate interest, Art. 6(1)(c) and (f) GDPR). We keep it for up to two years after the report is closed. The code's owner is told why the code was disabled, not who reported it.

Cookies

We only use technical cookies that are necessary for the service: the sign-in session, the language you choose, a short-lived cookie during two-factor sign-in, and a cookie that remembers when you unlocked a password-protected link. When you scan a QR code we also set qr_vid, a first-party audience-measurement cookie: it holds a random ID, lasts at most 13 months (it isn't renewed on later scans) and is used only to count unique visitors in aggregate statistics. It isn't shared with third parties, combined with other data or used to profile you, so under the Italian Data Protection Authority's cookie guidelines it is treated like a technical cookie.

We don't use advertising or third-party tracking cookies, so no consent banner is needed.

You can delete or block cookies in your browser at any time; the redirect still works.

How long we keep data

Account data is kept until you delete your account; deleting it removes your QR codes and all their scan statistics immediately. Sessions expire after 30 days of inactivity. QR code owners can reset a code's statistics at any time.

Who processes data for us

Our hosting provider (servers and database) and, if configured, our email delivery provider. Data is not sold or shared for marketing.

Your rights

You can access, correct, export or delete your data, restrict or object to processing, and lodge a complaint with your data protection authority (in Italy, the Garante per la protezione dei dati personali). You can update your account, download all your data (Account → Export your data) or delete your account at any time from the Account page; for anything else contact us.

Changes

We'll update this page when our practices change and show the date of the latest revision above.