Legal

Privacy Policy

Last updated: July 2026

Introduction

This Privacy Policy explains how QRkode (“we”, “us”, or “our”) collects, uses, and protects information when you use our dynamic QR code and scan analytics service (the “Service”). It is written to meet the EU General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act (Personopplysningsloven), and it applies to visitors and customers in the EU, the EEA, and Norway as well as everywhere else we operate. We believe analytics should be respectful: we collect what we need to make the product work and to show you how your codes perform, and nothing more. The Service is intended for business use and is not directed at children under 16; we do not knowingly collect personal data from them.

By using QRkode, you agree to the practices described here. If you do not agree, please do not use the Service.

Who we are

QRkode is the data controller responsible for the personal data described in this policy — we decide why and how it is processed. You can reach us about any privacy question through our contact page.

Information we collect

Account information. When you sign up, we collect your name, email address, and company name if you provide one, plus the codes and settings you create in the dashboard.

Scan analytics. Each time one of your dynamic codes is scanned, we record technical information about that scan to power your reports. This includes:

  • The scanning device’s IP address, which we use server-side to look up an approximate location (typically country, region, and city) and then store alongside the scan.
  • Device type, operating system, and browser, read from the scanning device’s user-agent string.
  • A one-way visitor fingerprint — a hash of the IP address, user-agent, and the code scanned — that lets us count unique scans and filter out rapid duplicates and bot traffic. It is computed on our server for each request and is never stored as a cookie on the visitor’s device.
  • Referrer, browser language, and the timestamp of each scan.

Free QR generator. When you download a code from our free no-signup generator, we record the type of code, the file format, and a copy of the content you encoded (for example the URL, Wi-Fi network details, or contact card). We use this to measure usage of the tool and to review abuse, such as codes created for phishing. Because you may choose to encode personal data in a code, treat anything you put in one as information you share with us. These records are not linked to an account and are deleted automatically after 90 days.

Cookies and session data. If you sign in to the dashboard, we use a cookie to keep you authenticated. See Cookies below for details.

Under the GDPR, we need a valid legal basis for each way we use personal data. Here is how that applies to QRkode:

  • Account and billing data — to create and run your account, generate your codes, and process payments. Necessary to perform our contract with you (Art. 6(1)(b) GDPR), and to meet our accounting and tax obligations (Art. 6(1)(c)).
  • Scan analytics and visitor fingerprint — to build your analytics dashboard, detect bots and abuse, and keep the Service secure and reliable. Our legitimate interest in operating and protecting the Service, weighed against your privacy (Art. 6(1)(f)).
  • Free-generator content — to measure usage of the free tool and to detect and act on abuse such as phishing codes. Our legitimate interest in preventing misuse of the Service (Art. 6(1)(f)).
  • Support messages — to respond when you contact us. Necessary to perform our contract, or our legitimate interest in helping users who are not yet customers.
  • Anything optional — such as a product update you opt in to receive — only with your consent (Art. 6(1)(a)), which you can withdraw at any time without affecting the Service itself.

Data retention

We keep your account information for as long as your account is active. Scan analytics are retained according to your plan’s analytics history window:

  • Free plan — 30 days of analytics history.
  • Pro plan — 1 year (365 days) of analytics history.
  • Business plan — unlimited analytics history, for as long as your account is active.
  • Free-generator download records (including encoded content) — 90 days, then deleted automatically.

Once a scan ages out of your plan’s window, it is removed from your dashboard and reports. If you delete your account, we remove or anonymize your data in line with this policy, except where we must keep certain records — such as invoices — to meet legal or accounting requirements.

Cookies

We keep our cookie use to what the Service actually needs. When you sign in, we set a single strictly necessary session cookie so you stay authenticated between requests; it is required for the dashboard to work and is not used for advertising or cross-site tracking. We do not place tracking or advertising cookies, and we do not use cookies on the pages people land on after scanning your codes — the visitor fingerprint described above is calculated on our server from the incoming request and is never written to the visitor’s browser. You can block or delete cookies through your browser settings, though you will need to sign in again afterward.

Sub-processors

We do not sell your personal data — ever. We share information only with service providers who help us run the Service, only to the extent they need it to do their job:

  • Stripe — processes payments and billing. Your card details are handled by Stripe and are never stored on our servers.
  • IPInfo, or ip-api.com as a fallback — turns a scan’s IP address into an approximate location.
  • Our transactional email provider — delivers account, billing, and support emails on our behalf.
  • Scaleway — hosts our application and database infrastructure in the Netherlands (EU).

We may also disclose information when required by law or to protect the rights and safety of our users.

International transfers

Our core infrastructure runs on Scaleway in the Netherlands, so your account and scan data are stored in the EU. Some sub-processors — for example Stripe, our geolocation providers, or our email provider — may process data in the United States or elsewhere outside the EEA. Where that happens, we rely on an adequacy decision, the European Commission’s Standard Contractual Clauses, or another lawful safeguard to keep your data protected to the standard described in this policy.

Your rights

Under the GDPR and the Norwegian Personal Data Act, you have the right to:

  • Access the personal data we hold about you.
  • Request rectification of data that is inaccurate or incomplete.
  • Request erasure of your data (the “right to be forgotten”).
  • Export your data in a portable format.
  • Object to, or request that we restrict, certain processing.
  • Withdraw consent at any time, for anything we process on that basis.
  • Lodge a complaint with your supervisory authority — in Norway, that is Datatilsynet, the Norwegian Data Protection Authority (datatilsynet.no).

You can delete your account at any time from your account settings, which removes your data as described above. For any other request, just get in touch.

Security

We use encryption in transit, access controls, and reputable infrastructure providers to protect your information. No system is perfectly secure, but we take reasonable steps to safeguard your data and to respond quickly if something goes wrong.

Changes to this policy

We may update this policy as the Service changes or as data-protection law evolves. If we make a material change, we will update the date at the top of this page and, where appropriate, let you know directly.

Language

This policy is published in several languages for your convenience. The English version is the authoritative text; if a translation differs from it in meaning, the English version prevails.

Contact

Have a question about your privacy or this policy? We would love to hear from you — reach us through our contact page.