Privacy policy

The data controller is the publisher of GrabyourQR, whose details are in our Legal notice. For any question about your data, write to contact@grabyourqr.com.

Your account: your email address and your password. Your password is stored in a hashed form: nobody, including us, can read it.

Your QR codes: their name, type, content (link, phone number, Wi-Fi network, contact details, PDF file…), colors, shapes and logo. Sensitive fields (phone numbers, email addresses, messages, Wi-Fi passwords, contact card details, PDF file names) are encrypted before being stored. Note that a vCard contact page or a PDF is, by design, visible to anyone who scans the QR code.

Scans of dynamic QR codes: for each scan, we only record the date, the country (deduced from the connection, then discarded) and the type of device (mobile, tablet or desktop). We do not store the IP address or any information that identifies the person who scans.

Your subscription: if you subscribe to Pro, your plan, your subscription status and your Stripe customer number. Your card details are handled by Stripe Payments Europe, Limited only: we never see them.

Waiting lists: if you ask to be notified about an upcoming feature (such as loyalty cards), we keep your email address for that purpose only.

Technical logs: like any website, our hosting providers keep technical logs (including IP addresses) for a short time, to keep the Service secure and working.

• To provide the Service: your account, your QR codes, redirections and statistics (performance of our contract with you).
• To manage your Pro subscription, payments and invoices (contract, and our legal accounting obligations).
• To keep the Service secure and prevent abuse, such as fraudulent QR codes (our legitimate interest).
• To send you important emails about your account: sign-up confirmation, payments, changes to our terms (contract). We don't send marketing emails without your consent.
• To tell you when a feature you asked to be notified about is available (your consent, which you can withdraw anytime).

• Account and QR codes: as long as your account exists. Deleted when you delete it.
• Scan statistics: as long as the QR code exists.
• Waiting lists: until the feature launches and we've told you, or until you ask us to remove you.
• PDF files: deleted when you replace the file or delete the QR code.
• Invoices and payment records: 10 years, as required by French accounting law.
• Technical logs: a few weeks at most.

We never sell or rent your data. We only share it with the providers needed to run the Service:

• Vercel Inc. (United States): website hosting.
• Supabase Inc. (servers in the United States (East US, North Virginia)): database, authentication and file storage.
• Stripe Payments Europe, Limited (Ireland): payments and invoices.
• Resend, Inc. (United States, emails sent from Ireland): account emails (email confirmation, password reset).
• Cloudflare, Inc. (United States): Turnstile, a check that protects the sign-up and log-in forms against bots. It doesn't use advertising cookies.

Some of these providers are located in the United States. These transfers are protected by the European Commission's Standard Contractual Clauses and, where applicable, the EU-U.S. Data Privacy Framework.

Connections are encrypted (HTTPS). Each account can only access its own data, a rule enforced directly in the database. Sensitive fields are encrypted, uploaded PDF files are stored privately and shared only through temporary links when a QR code is scanned.

We only use the cookies needed to keep you logged in. They are essential to the Service, so they don't require your consent. We use no advertising cookies, no tracking cookies and no third-party tracking.

When you sign up, a short-lived cookie remembers the page to bring you back to after you confirm your email. Your browser also remembers your dashboard layout (grid or list). Both stay on your device and are never used to track you.

To know which pages are useful, we use Vercel Web Analytics. It counts visits without cookies and without identifying you: no data is stored on your device and visitors can't be followed from one site to another.

When you pay, you are taken to Stripe's secure payment page, which uses its own cookies to prevent fraud.

Under the GDPR, you can at any time:

• access your data and get a copy of it;
• correct it;
• delete it, along with your account (directly from Settings in your dashboard);
• object to or restrict some uses of it;
• receive it in a reusable format (portability).

Write to contact@grabyourqr.com from the email address of your account. We answer within one month. If you think your rights are not respected, you can file a complaint with the French data protection authority, the CNIL (www.cnil.fr), or the authority of your country.

If you scanned a QR code created with GrabyourQR, we only recorded the date, your country and your type of device, anonymously, to give statistics to its creator. We don't know who you are. The page or file you were sent to belongs to the creator of the QR code, not to GrabyourQR.