Privacy

Your account and saved content

We process your email address, sign-in details, settings and saved content to provide your account and requested functions (GDPR Art. 6(1)(b)). Required information is marked in the form; without it, the respective account function is unavailable. We answer enquiries to fulfil a contract or in our legitimate interest in communication (GDPR Art. 6(1)(b) or (f)). We process reports of illegal content to meet legal obligations (GDPR Art. 6(1)(c)). To document the agreement, we also store your name or organisation, account email, acceptance time and the accepted terms including the DPA until account deletion (Art. 6(1)(b) and (f) GDPR).

Local QR creation and browser storage

Static QR content and exports stay in your browser unless you save them to your account or upload them. Necessary cookies and browser storage support functions you request (§ 25(2) TDDDG). The sign-in cookie lasts up to 30 days. Drafts are discarded when loaded after 12 hours; you can delete them earlier. We store your explicitly selected language for one year in a necessary cookie.

Delivery and protection of the service

We need IP address, time and browser information to deliver the website and prevent abuse (Art. 6(1)(f) GDPR). We do not store general access logs.

QR scans and short-link clicks

To operate dynamic links and evaluate their use, we record the time, link, access channel, device and browser category, operating system, referring website and indications of automated requests. These statistics store no IP addresses or full browser identifiers. Authorised account users can view them. The basis is the legitimate interest in working links and evaluating their use (GDPR Art. 6(1)(f)).

Optional product statistics

Only with your consent do we count generator actions by action, QR type and language, without QR content or visitor identifiers (GDPR Art. 6(1)(a)). Daily totals are kept for 90 days. Your choice stays in browser storage until changed or cleared (§ 25(2) TDDDG). You can withdraw consent here or in the footer at any time for future processing.

Usage statistics allowed

Publication, recipients and external destinations

Published content is accessible to anyone with the link; shared team content is accessible to authorised members. We use processors for hosting, backups and email delivery. Data may be processed outside the EEA, particularly in the United States. Where no applicable adequacy decision exists, agreed EU Standard Contractual Clauses or approved Binding Corporate Rules safeguard the transfer. You can request a copy of the safeguards at info@qrinio.com. External destination sites are governed by their operators’ privacy notices.

How long data are kept

We delete account data and saved content on request unless legal retention or the defence of legal claims requires otherwise. Trash is kept for 30 days and unused uploads for 24 hours. Scan details and daily statistics last 90 days; total counters remain until content deletion. Login records last 30 days, change records 180 days, and sent emails in the application outbox seven days. We keep enquiries and reports until handling is complete and, where necessary, to meet legal obligations or pursue legal claims. The latest 30 backups are retained; new backups replace the oldest ones.

Your rights and contact

Subject to legal conditions, you have rights of access, correction, deletion, restriction and portability. You may object to processing based on legitimate interests for reasons relating to your situation. You can withdraw consent at any time without affecting the lawfulness of earlier processing. Contact info@qrinio.com. You may complain to a data protection authority, such as LDI Nordrhein-Westfalen.

Supervisory authority: LDI Nordrhein-Westfalen

Data controller