Privacy policy

Privacy at a glance

1Controller and Contact Details

The controller of personal data is:

Users may contact us about privacy matters at the email above. EU/EEA users may also contact the Slovak supervisory authority, the Office for Personal Data Protection of the Slovak Republic.

2Scope

This Policy applies to visitors, registered account users, people who scan dynamic QR codes, and people whose personal data is entered into a QR code by an account user.

When an account user enters personal data about another person into a QR code, that account user is responsible for having a lawful basis and providing any required privacy notice.

3Personal Data We Process

4Purposes and Legal Bases

We do not use personal data for solely automated decisions that produce legal or similarly significant effects.

5Third-Party Processors, Recipients and Data Sources

We may share personal data with service providers that help us operate the Service, including:

• hosting and database providers;
• Stripe for payment and subscription processing;
• Google reCAPTCHA and Google Safe Browsing for security and abuse prevention;
• goQR.me / api.qrserver.com for applicable QR-code functionality;
• SMTP/email providers;
• WordPress or cookie-consent components;
• professional advisers, authorities, courts and regulators where required by law.

Approximate scan geolocation is performed on our server using the locally installed GeoLite2 City database. MaxMind supplies the GeoLite data but does not receive scanner IP addresses through these local database lookups.

This product includes GeoLite Data created by MaxMind, available from https://www.maxmind.com.

6International Transfers

Because the Service is available globally and uses global cloud, payment, email, security and other service providers, personal data may be processed outside Slovakia, the EEA, or the user's country.

Where GDPR applies and data is transferred outside the EEA, we rely on appropriate safeguards such as adequacy decisions, Standard Contractual Clauses, processor data protection terms, or another lawful transfer mechanism.

Using the local GeoLite2 City database for a scan does not itself transfer that scanner's IP address to MaxMind.

7Retention

• Account data: kept while the account exists and for a reasonable period afterward where needed for legal, security, accounting or dispute purposes.
• Active QR codes and scan logs: while a dynamic QR code and the QR owner's account remain active, QR records, image files and associated scan logs are retained to provide redirection, historical analytics, reporting, security and service operation. We do not currently apply a fixed automatic expiration period to active scan logs.
• Authentication data: password reset tokens are designed to expire after approximately 1 hour. Remember-me login cookies are designed to last up to 30 days.
• Billing records: may be kept for the period required by Slovak accounting, tax and commercial law.
• Server and security logs: kept for a period appropriate to security needs and may be retained longer when connected to an investigation, dispute, legal obligation or legal claim.

Deleted QR codes and restricted copies

When a QR code is deleted, it is deactivated and removed from the user's ordinary account access. Deletion does not immediately destroy every associated QR image file, configuration record or scan log. These records may persist only as restricted server-side copies. The user can no longer access, modify, export or erase those copies through ordinary account tools.

Restricted recoverable server-side copies may be preserved where reasonably necessary to restore an accidental deletion, maintain service integrity, or protect records that may be relevant to suspected fraud or abuse, an existing or reasonably anticipated investigation, a dispute, a legal obligation, or the establishment, exercise or defence of legal claims. This restricted retention helps prevent the deletion function from being used to destroy or conceal potential evidence. Restoration is not guaranteed.

The retention of deleted QR records and associated scan logs is determined according to the QR code and account lifecycle, the need for recovery, the nature and severity of suspected misuse, applicable legal limitation periods, and whether an investigation, dispute or legal hold is active or reasonably anticipated.

Evidence-preservation retention is applied only where reasonably necessary and proportionate to the relevant risk or matter. Retained server-side information is not available through ordinary account analytics, and access is restricted to authorized personnel and providers with a need to know. It is deleted or irreversibly anonymized when the applicable retention purpose ends, unless continued storage is required by law. Anonymous aggregate statistics may be retained for longer.

Controller and processor roles for analytics

Where we process scan analytics solely on behalf of a QR owner, the QR owner determines the relevant retention instructions as controller, subject to the applicable data-processing agreement. Where we independently retain limited information for our own service security, fraud and abuse prevention, legal compliance or legal claims, we act as controller for that separate processing and retain only the information reasonably necessary for that purpose.

8Security Measures

We use technical and organizational measures intended to protect personal data, including:

• hashed passwords;
• session regeneration on login;
• HTTP-only remember-me cookies where supported;
• CSRF protection for checkout;
• URL validation and malicious URL checks;
• QR ownership checks and access controls;
• pseudonymised storage of scan IP identifiers using SHA-256 hashing; and
• local GeoLite2 lookups that avoid sending scanner IP addresses to an external geolocation API for each scan.

9User Responsibilities for QR Content

Users control the content they enter into QR codes. Users must not submit unlawful, harmful, misleading, infringing or malicious content, and must not enter personal data about another person unless they have a valid legal basis and have provided any required notice or consent.

Users should avoid placing special category data, payment secrets, passwords, private credentials, health data, children's data or confidential third-party data into QR codes unless strictly necessary and legally permitted.

10Your GDPR Rights

Where GDPR applies, data subjects may have rights to:

• access their personal data;
• request correction or erasure;
• request restriction of processing;
• receive portable data where applicable;
• object to processing;
• withdraw consent where processing relies on consent;
• not be subject to solely automated decision-making with legal or similarly significant effects; and
• lodge a complaint with a supervisory authority.

Requests should be sent to info@dynamic-qrs.com. We may need to verify the requester's identity before acting on a request. We normally respond within one month where GDPR applies, subject to permitted extensions.

11Rights for Non-EU Users

Users outside the EU/EEA may have privacy rights under local law, such as rights to know, access, correct, delete, opt out of certain disclosures, or appeal a privacy decision. We will handle such requests according to applicable law.

We do not sell personal data, and we do not knowingly share personal data for cross-context behavioral advertising as those terms may be defined under certain US state privacy laws.

12Children's Privacy

The Service is intended for business and general users and is not directed to children. Users must not create accounts or submit children's personal data unless they have the legal authority and lawful basis to do so. If we learn that we process children's personal data unlawfully, we will take appropriate steps to delete or restrict it.

13Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be posted on the website with a new effective date. If changes are material, we may provide additional notice through the Service or by email.