Privacy policy

Who is responsible

The controller for qrlia.com and qrlia accounts is Castle Group - F.Z.C, B.C. 1307921, Ajman Free Zone C1 Building, Ajman Free Zone, Ajman, United Arab Emirates. Contact: support@qrlia.com.

Our representative in the EU under Article 27 GDPR is Castle Group, Heide 3, 59602 Rüthen, Germany.

What we collect, and why

• Signing up. Your email, name (if given), workspace name and address, chosen plan, the IP address and browser details (user agent, language) of the request, and how you found us (referrer and campaign tags). We use these to create your workspace and to stop automated sign-ups and abuse. Basis: taking steps to enter a contract with you, and our legitimate interest in keeping the service free of abuse.
• Your account. Login email, a hashed password, team members you invite, and the QR codes, designs and files you upload. Basis: performing our contract with you.
• Billing. Your plan and subscription status. Card and payment details go directly to our payment provider; we never see or store them. Basis: contract, and legal obligations to keep accounting records.
• Email. We send verification codes, password resets and service messages. Basis: contract. Newsletters only if you subscribe, and you can unsubscribe at any time.
• Support. What you send us when you write in.

Visiting qrlia.com

We count visits to our website ourselves, without cookies: the page, the site that linked to it, campaign tags in the link, the approximate country and the device type. The IP address is not stored: a one-way hash of it and the browser, with a salt that changes every day, lets us count a visitor once per day without being able to follow them across days. Visits by signed-in customers are not counted. These records are kept for 13 months. Basis: our legitimate interest in understanding how people find qrlia.

If you accept analytics cookies, we also use Google Analytics, provided by Google Ireland Limited, which sets the cookies _ga and _ga_* (up to 2 years) and may transfer data to Google LLC in the USA. We use it to see which pages and campaigns bring visitors. Basis: your consent, which you can withdraw at any time under Cookie settings.

People who scan a QR code

When someone scans a dynamic QR code hosted on qrlia, we record the time, approximate country and city, device and operating system type, and the referring page. The IP address is not stored: we keep only a one-way hash with a salt that changes every day, used to count unique scans.

For QR codes created by our customers, the customer decides what the code points to and is the controller of that scan data; we process it on their behalf. Questions about a specific QR code are best sent to the business that published it.

Cookies

We set the cookies needed for the site to work, and Google Analytics cookies only if you accept them. No advertising cookies.

• qrc_session: keeps you signed in (24 hours).
• qrc_active_company: remembers which company you're working in.
• qrc_theme: your light/dark preference (1 year).
• qrlia_ref: records a referral code if you arrived through a partner link (30 days).

The sign-up form is protected by Cloudflare Turnstile, which checks that you're a person. See Cloudflare's Turnstile privacy notice.

Who processes data for us

• Hetzner Online GmbH (Germany): servers and databases, hosted in the EU.
• Contabo GmbH (Germany): our mail server for support mailboxes.
• Sendinblue SAS / Brevo (France): delivery of transactional email.
• Cloudflare, Inc. (USA): bot protection on the sign-up form.
• Google Ireland Limited (Ireland) and Google LLC (USA): website analytics, only with your consent.
• Our payment provider (shown on the checkout page): subscriptions and payments.

We don't sell personal data or share it for advertising. Where data leaves the EU or goes to a country without an adequacy decision, including to us in the UAE, we rely on the European Commission's Standard Contractual Clauses or the provider's equivalent safeguards.

How long we keep it

Account data is kept while your account is active and deleted when you close it, except records we must keep by law, such as invoices.

• Sign-ups that were never completed are kept until you ask us to delete them.
• Scan records are kept for the life of the workspace they belong to.

Ask us at any time and we will delete what we don't have to keep.

Your rights

You can ask for access to, correction of, deletion of, or a copy of your personal data, and you can object to or ask us to restrict processing. Email support@qrlia.com and we'll answer within one month. If you're in the EU or UK you can also complain to your local data protection authority.

Changes

If we change this policy we'll update the date above, and tell account holders by email about material changes. See also our terms and imprint.