shield_lock Privacy

Privacy Policy

Last updated: November 2026 | Controller: Ostheimer OG, Fabriksgasse 20, 2230 Gänserndorf, Austria | office@qr3.app

1. Principles

We process personal data in accordance with GDPR (EU) 2016/679. qr3.app is built with Privacy by Design: IP addresses are never stored — they are immediately pseudonymised with HMAC-SHA-256 using a long-lived master secret, purpose, and UTC day at the Cloudflare edge before any data is persisted.

2. Data We Process

2.1 API Users (Registered Accounts)

  • Account data: Email address, name (via Clerk.com authentication)
  • Billing data: Stripe customer ID, subscription status (no card data — Stripe processes payments directly)
  • Usage data: Created QR codes, workspace configurations
  • Legal basis: Art. 6(1)(b) GDPR — contract performance

2.2 QR Code Scan Analytics (End Users)

  • IP pseudonym: HMAC-SHA-256 with a long-lived master secret, purpose, and UTC day — pseudonymous personal data; not directly recoverable from the hash, though a secret holder can recompute a known IP candidate for that day
  • Device data: Device type, OS, browser (anonymized from User-Agent)
  • Geo data: Country, city (from Cloudflare CF-IPCountry header — no IP stored)
  • Legal basis: Art. 6(1)(f) GDPR — legitimate interest of QR code owners in analytics
  • Retention: 90 days, then automatically deleted

2.3 Website Visits (qr3.app)

  • No tracking cookies
  • Server logs: Cloudflare processes connection data per their Privacy Policy

To count page views per language version, qr3.app uses Cloudflare Web Analytics. The service does not use cookies or any other client-side storage mechanism, does not store IP addresses, and does not build user profiles. Data collected, in aggregate: page path, referrer, browser and device type, and country. Provider: Cloudflare, Inc., as data processor (Data Processing Addendum). Legal basis: Art. 6(1)(f) GDPR — legitimate interest in per-language reach. No opt-out cookie is required, since no data is stored on your device.

2.4 Usage Statistics and Webhook Logs (Registered Users)

  • Usage statistics: Dashboard activity per day (on which UTC days a user opened the dashboard of a workspace) and API usage counters per operation and day (number of requests of an API key by operation and outcome). For dashboard activity, the identifiers of user, organization and workspace, the UTC day and the time of the first visit on that day are stored; for API counters, the identifiers of organization, workspace and API key, the UTC day, operation, outcome, count and the time of the first and the last request of the day — no IP address and no user agent.
  • Webhook delivery logs: Per delivery attempt: event type, time, status, HTTP status code and response time, the event data sent, and the first kilobyte (1 KB) of the receiver's response or an error message. For scan events the event data contain the visitor's country, device type, operating system, browser and language; for code events they contain the complete code including target URL and notes. No IP address and no user agent of visitors are stored, but the event data and the receiver's response can contain personal data.
  • Purpose: Operation, troubleshooting and product improvement
  • Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation, troubleshooting and further development of the service)
  • Retention: 90 days (the current UTC day plus the 89 preceding days), then automatically deleted; deleted immediately on DELETE /v1/account

2.5 Audit Log (Registered Users)

  • Content: Per change in a workspace (for example to codes, API keys, members or webhooks): time, action, the resource concerned, the changed values and who acted (user ID or API key ID). For calls made directly to the API, also the IP pseudonym (HMAC-SHA-256 per UTC day, separate purpose) and the user agent. No IP address, no secrets and no API keys are stored.
  • Purpose: Traceability of changes for the team of a workspace and security of the service
  • Legal basis: Art. 6(1)(f) GDPR (legitimate interest in traceable changes and in the security of the service)
  • Retention: IP pseudonym and user agent 90 days, the entry 365 days (each counted as the current UTC day plus the preceding days), then automatically deleted; on DELETE /v1/account the entries of the person's own organizations are deleted immediately, and in other teams their IP pseudonym and user agent are removed

3. Third-Party Services

We share data only with the following service providers. Unless stated otherwise, they process the data on our behalf (Art. 28 GDPR). Where data reaches the USA, this is based on the EU-U.S. Data Privacy Framework, under which the U.S. companies of these providers are certified (adequacy decision, Art. 45 GDPR), and alternatively on the European Commission's Standard Contractual Clauses in their data processing agreements (Art. 46(2)(c) GDPR).

  • Cloudflare, Inc. (USA) — infrastructure, CDN, Workers: hosting of the website, dashboard and API, database, file storage and queues, sending of system emails (Cloudflare Email Service) and Web Analytics (section 2.3)
  • Clerk, Inc. (USA) — authentication: email address, name, sign-in and session data (including IP address, location derived from it and browser) and confirmation emails. At sign-up, Clerk embeds a protection against automated registrations (Cloudflare Turnstile). If you sign in with a Google account, Clerk receives your name and email address from that account.
  • Stripe Payments Europe, Ltd. (Ireland) — payment processing and invoices. Stripe collects payment details directly; we receive no card data. Stripe is itself responsible for fraud prevention, its own legal obligations and the development of its products.
  • Functional Software, Inc. (Sentry) (USA, data stored in the EU) — error analysis for the API, redirects and dashboard: error messages and samples of requests (method, path without parameters, status code, duration, internal identifiers). We remove IP addresses, headers, cookies and parameters before sending; email addresses and keys in text are redacted. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in error-free and secure operation)
  • Google Cloud EMEA Ltd. (Ireland; Google Cloud Web Risk) — checking target addresses for phishing and malware: when a code is created or changed, when a URL is checked via the API, and in the nightly re-check, the code's target address or the links on its landing page. Only the address is sent, no account or visitor data; if the address itself contains personal data (for example in a parameter), that data is sent with it. Legal basis: Art. 6(1)(f) GDPR (protecting visitors from fraudulent destinations and keeping the service secure)
  • Microsoft (Microsoft 365) — the mailbox office@qr3.app: emails to us, including replies to system emails, and our answers. Legal basis: Art. 6(1)(b) GDPR (enquiries about the contract) or (f) (other enquiries)

No data is shared for advertising purposes.

4. Your Rights (GDPR Art. 15–22)

  • Access (Art. 15): GET /v1/account/privacy or email office@qr3.app
  • Portability (Art. 20): GET /v1/account/export — full JSON export
  • Erasure (Art. 17): DELETE /v1/account or email. Your account is erased immediately: organizations you own, with all workspaces, codes, product passports, files and statistics (if such an organization has another organization admin, they take it over with its data and subscription), your memberships in other organizations, your Clerk login and your Stripe customer record. A running subscription ends immediately, without a pro-rata refund. For very large accounts the erasure completes within a few hours. Erased data remains restorable from the database backups (Cloudflare D1 Time Travel) for up to 30 days, then it is gone for good. Exempt are invoices, which we keep with Stripe for the statutory retention period of seven years (§ 132 BAO), and third-party reports about abusive codes (abuse prevention).
  • Restriction (Art. 18): Email office@qr3.app
  • Objection (Art. 21): At any time for legitimate interest processing

5. Cookies

qr3.app uses only technically necessary session cookies (authentication via Clerk). No marketing or tracking cookies. Cloudflare Web Analytics (see section 2.3) also does not use cookies. Cookie consent banners are not required.

6. Data Security

All data is transmitted encrypted (TLS 1.3). Database encryption at rest via Cloudflare D1. API keys are stored hashed. Webhook signatures use HMAC-SHA256.

7. Right to Lodge a Complaint

You have the right to lodge a complaint with the Austrian Data Protection Authority:
Datenschutzbehörde (dsb.gv.at), Barichgasse 40-42, 1030 Vienna, Austria

8. Contact

Ostheimer OG
Fabriksgasse 20, 2230 Gänserndorf, Austria
office@qr3.app