Privacy Policy
Last updated:
This policy explains what personal data the Smart QR Code service collects, why, and what rights you have. It applies to smart-qr-code.com and to the QR codes created through it.
1. Who is responsible for your data
- STROE GEORGE-ADRIAN PERSOANĂ FIZICĂ AUTORIZATĂ (a sole trader registered in Romania)
- Registered office: Municipiul București, Sector 2, Str. Baicului nr. 82, et. 2, corp C31 – Administrativ, camera 38, Romania
- Tax identification number (CUI): 40410638
- Trade Register registration number: F40/56/2019
- Email: [email protected]
2. Two different roles — please read this first
We handle personal data in two distinct capacities, and your rights differ depending on which applies:
2.1 As controller — for our own users and visitors
When you visit the website, create an account or subscribe, we decide why and how your data is processed. Sections 3 to 9 describe this.
2.2 As processor — for scan analytics
When you scan someone else's Dynamic QR code, we record data on behalf of the person or business that created that code. They decide why that data is collected; we only store and display it to them.
If you scanned a QR code and want to know why your data was collected, or want it deleted, the right party to ask is the owner of that code — usually the business whose page you landed on. If you cannot identify them, write to us at [email protected] and we will help you reach them or forward your request.
3. What we collect
3.1 Account data
- Email address, and name if you provide one.
- Password — stored only as a salted hash (bcrypt). We cannot read it.
- Email verification and password reset tokens, which expire.
- Plan, trial end date, account creation date.
3.2 Billing data
Payments are processed by Paddle, which acts as Merchant of Record. We never receive or store your card number. From Paddle we store only a customer identifier, a subscription identifier, the plan purchased, the subscription status and the current billing period. Paddle processes your payment and billing details as its own controller, under Paddle's privacy notice.
3.3 Content you create
QR code definitions, destination URLs, names and labels, folders, and any logo images you upload. Uploaded files are stored on our own server.
3.4 Scan and click data (includes IP addresses)
When a Dynamic QR code is scanned, or a link on a multi-link page is clicked, we record:
- IP address of the device that made the request;
- country and, where the offline database can determine it, city;
- device type, operating system and browser, derived from the user agent;
- the raw user agent string;
- date and time, and which QR code or link was involved.
An IP address is personal data under the GDPR, and we treat it as such. It is recorded because it is how the country and city are determined and because it is needed to detect abuse of the redirect service.
Geolocation happens entirely on our own server, using an offline database installed alongside the application. Your IP address is not sent to any geolocation provider or other third party for this purpose.
Static QR codes — including everything produced by the free generator on the home page — do not pass through our servers when scanned. We record nothing at all about those scans.
3.5 Contact form
If you write to us through the enterprise contact form, we receive the name, email address, company and message you submit, so that we can reply.
3.6 Technical logs
Our server keeps short-lived operational logs, which may include IP addresses and requested URLs. They are used for security, abuse prevention and debugging.
3.7 API keys
If you create an API key, we store only a SHA-256 hash of it plus the first few characters for display. The full key is shown once, at creation, and cannot be recovered afterwards.
4. Why we process it, and on what legal basis
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Creating and running your account, delivering the Service | Account data, content | Performance of a contract |
| Taking payment and managing subscriptions | Billing identifiers | Performance of a contract |
| Providing scan analytics to the owner of a QR code | Scan and click data | On behalf of that owner, who determines the basis (see section 2.2) |
| Security, abuse prevention, rate limiting | IP addresses, logs | Legitimate interests — keeping the Service safe and available |
| Service emails: verification, password reset, billing, important changes | Email address | Performance of a contract |
| Replying to enquiries | Contact form data | Legitimate interests — responding to you |
| Meeting accounting and tax obligations | Transaction records | Legal obligation |
We do not use your data for advertising profiling, and we do not sell personal data.
5. Who we share it with
- Paddle — payment processing and invoicing, as Merchant of Record and as its own controller.
- Our email server — we send transactional email from our own mail infrastructure; we do not use a third-party bulk email provider.
- Hosting — the application and database run on our own server infrastructure located in Romania (European Union).
- Authorities — where we are legally required to disclose information.
We do not currently use any advertising network, third-party analytics platform, or external font or script provider on this website. If that changes, we will update this policy and, where consent is required, ask for it before any such technology is loaded.
6. International transfers
Our servers are in the European Union. Paddle operates internationally and may process billing data outside the EU under the safeguards described in its own privacy notice, such as the European Commission's standard contractual clauses.
7. How long we keep it
- Account data — for as long as your account exists.
- QR codes and uploaded files — until you delete them, or until your account is deleted.
- Scan and click data — for as long as the QR code it belongs to exists, and in any case no longer than 24 months from the date of the scan. A daily job enforces this automatically; you do not have to ask. Deleting a QR code deletes its scan history immediately. After the 24 months we keep only a count of how many times a code was scanned — a number, with nothing about who scanned it, when, or from where — so your statistics do not reset to zero.
- Account deletion — you can delete your account yourself at any time from your profile page, and your data is removed immediately. If you ask us by email instead, we remove it within 30 days.
- Accounting records — retained for the period required by Romanian tax law, currently 10 years for accounting documents. These are held by Paddle and by us for invoices we receive.
8. Your rights
Under the GDPR you have the right to: access your data; correct it; have it deleted; restrict or object to processing; receive it in a portable format; and withdraw consent where processing is based on consent.
Two of these you can exercise yourself, without asking us. From your profile page you can download everything we hold about your account as a file, and you can delete your account permanently. Deletion is immediate and cannot be undone — any dynamic QR codes you printed will stop working. If you have an active subscription, cancel it first, otherwise you would keep being billed after the account is gone.
For anything else — correcting your data, restricting or objecting to processing, withdrawing consent, or exercising any right if you can no longer sign in — email [email protected] from the address registered to your account. We will respond within one month. We do not charge for this.
You also have the right to complain to a supervisory authority. In Romania this is the National Supervisory Authority for Personal Data Processing (ANSPDCP, dataprotection.ro). If you live in another EU country, you may complain to your local authority instead.
9. Security
The site is served over HTTPS. Passwords are stored as bcrypt hashes and API keys as SHA-256 hashes — neither can be read back by us or by anyone who obtained a copy of the database. Access to production systems is restricted. No system is perfectly secure; if a breach occurs that is likely to result in a high risk to your rights, we will notify you and the supervisory authority as required by law.
10. Children
The Service is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
11. Changes
We may update this policy. The date at the top shows when it last changed. If a change materially affects how we handle your data, we will notify registered users by email before it takes effect.
12. Contact
Privacy questions and data requests: [email protected].