Privacy Policy

This policy explains what personal data we process when you use QRTint, and when someone scans a code made with it. We collect as little as we need to run the service. We don't sell data, and we don't use advertising or tracking tools.

Who is responsible

The controller is [Company name], [Registered address], IČO [IČO]. For anything about your data, email [Support email].

What we process and why

Your account

• Email address and password. The password is stored only as a one-way hash (argon2id), never in readable form. If you sign in with Google, we receive your email address and Google's account ID, but no password.
• Login session. A random session ID in a cookie, so you stay signed in. See cookies below.
• Password reset links. When you ask for one, we email you a single-use link. We store only a hash of it, and it expires after 1 hour.

Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

Your codes and files

The names, destination links, designs and logos you add, and any files you upload. We need them to show, render and redirect your codes (Art. 6(1)(b) GDPR). If you use the AI designer, the description you type is sent to OpenAI to generate design suggestions. Don't put personal data in it.

Payments

Payments are handled by Stripe. We receive and keep your plan, subscription status, billing period and Stripe's customer and subscription IDs. We never see your full card number. Legal basis: contract (Art. 6(1)(b)), and our legal duty to keep accounting records (Art. 6(1)(c) GDPR).

People who scan a code

When someone scans a code, we record:

• the time of the scan;
• the device type (iOS, Android or desktop), read from the browser's user agent;
• the country and an approximate location (latitude and longitude rounded to about 10 km), as reported by our hosting network. We never record a precise location;
• a visitor identifier, which is a one-way hash of the IP address and user agent. We use it to tell unique visitors from repeat scans. We don't store the IP address itself.

The code's owner sees these as statistics (counts by day, device and country, and a heat map of approximate locations). They never see individual visitors. We process this data on the owner's behalf to provide those statistics, and in our own legitimate interest (Art. 6(1)(f) GDPR) to operate the redirect and to detect abuse. Codes don't place cookies on the scanner's device.

Security and abuse prevention

To protect people from phishing and malware, we send destination links to Google's Web Risk service when a code is saved and when it's scanned. We also briefly keep technical request logs, and we rate-limit sign-in attempts by IP address. Legal basis: legitimate interest in keeping the service and its users safe (Art. 6(1)(f) GDPR).

Emails

We only send emails you need, such as password reset links and important notices about your account or these terms. We don't send marketing emails without your consent.

Who processes data for us

We use these providers to run the service. Each one only gets the data it needs, under a data processing agreement.

Where data goes to the US, it is protected by the EU–US Data Privacy Framework where the provider is certified, and by the European Commission's Standard Contractual Clauses otherwise.

How long we keep data

• Account, codes and files: while your account exists. They are deleted when you delete your account.
• Scan statistics: until the code (or your account) is deleted.
• Login sessions: 30 days after your last visit, or until you log out or reset your password.
• Password reset links: 1 hour, or until used.
• Unsaved designs from the homepage editor: 7 days.
• Invoices and payment records: 10 years, as required by the Slovak Accounting Act (No. 431/2002 Coll.).

Cookies and local storage

We use a session cookie, qr_sid. It keeps you signed in, and the service can't work without it. It is HttpOnly, so scripts can't read it, and it expires 30 days after your last visit. A second cookie, qr_locale, remembers the language you picked. We also keep a few small items in your browser's local storage: a note that you've already seen the onboarding screen, the design you're working on in the homepage editor, and the ID of a design you started before signing up. These are strictly necessary for features you ask for, so they don't need consent. We use no analytics, advertising or third-party tracking cookies.

Your rights

Under the GDPR you have the right to:

• get a copy of your data, and have it corrected;
• have it deleted, or its processing restricted;
• receive your data in a portable format;
• object to processing based on our legitimate interests;
• withdraw any consent you gave, with effect for the future.

Email [Support email] and we'll reply within one month. If you scanned a code and have a question about that scan, you can contact us or the code's owner.

You can also complain to a data protection authority. Ours is the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR), Hraničná 12, 820 07 Bratislava, dataprotection.gov.sk. You can also complain in the EU country where you live.

Changes

If we change this policy in a way that matters, we'll update the date above and email account holders before the change takes effect.