Privacy policy

1. Controller and contact

The controller is QRVesta. For any privacy question or request, write to info@qrvesta.com or use the contact form.

2. Our two roles

As a controller we process data about visitors to this site, people who write to us through the contact form, and the sign-in and security data of panel accounts.

As a processor we process the content our customers enter in their workspaces (QR codes, their destinations, business card details, logos) and the scan statistics of their codes, on that customer's instructions and only to provide the service. The customer is the controller of this data; the terms are set out in the data processing agreement. If you send us a request about such data, we forward it to the customer concerned.

3. What data we process

• People who scan a QR code: When a dynamic code is scanned, we record only the time, the country, the device type (mobile, tablet, desktop, other) and the operating system. Cloudflare determines the country from the connection; device type and operating system are derived from the identification string the browser sends (user agent). Neither the IP address nor the user agent itself is stored; these records do not identify anyone. At most one scan per minute is counted for the same code from the same network; this limit is kept in Cloudflare's rate limiter and is not written to the database.
• Where a scan leads: Website codes send the person who scans them to the address the customer chose, location codes to Google Maps (Google LLC). The browser then connects to that site directly, and the site processes connection data such as the IP address under its own privacy policy. We send these sites no data and do not pass on the page the visitor came from (referrer).
• Panel users: username, display name, an irreversible hash of the password (never the password itself), workspace memberships and roles, time of the last sign-in; sessions (start, last activity and expiry) and trusted devices. We do not ask for a phone number. An email address is optional: users may add one in their profile to receive notifications by email. It is used only once its owner confirms it through the link we send to it, and only for these notifications and that confirmation (never for marketing). These emails are sent through our email delivery provider.
• Activity log: who did what and when in a workspace (e.g. creating or editing a code, adding a user), the acting user's display name at the time and the name of the record concerned at the time. Some entries also hold usernames and former display names (e.g. adding, deleting or renaming a user). These names remain in the activity log until the entry's retention period ends, even if the user or record is deleted. Sign-in and sign-out events also record a shortened IP address (the last part of an IPv4 address set to zero; only the /48 prefix of an IPv6 address) and the country; failed sign-ins also record the username typed (only if that account exists).
• Sign-in attempt counters: short-lived counters per username (including names that do not exist), network (full IPv4 address or IPv6 /64 prefix) or device that limit password guessing; kept for about 24 hours at most.
• Link previews: When you open the phone preview of a website code in the panel, our server fetches the target page and its preview image itself; your browser does not connect to that site. The page's title, description and image are kept in Cloudflare's cache for at most an hour.
• Workspace content: QR codes and their destinations, content written into codes (e.g. the name, phone number and email on a business card), folders, projects, logos and brand colours. Our customers enter these.
• Contact form: name, email address, optional company name, topic and message. The message is delivered to us by email and is not stored on the site. To prevent abuse your IP address is used briefly by Cloudflare's rate limiter and the Cloudflare Turnstile check; we do not store it.
• Site visitors: We use no analytics, advertising or tracking tools. Cloudflare processes connection data (e.g. IP address, requested address) to deliver and protect the site. Our server logs (Cloudflare Workers Logs) keep only the error and maintenance messages the application writes; automatic per-request logs (including IP address and browser details) are switched off. Cloudflare sets how long these messages are kept (a few days).

We collect data electronically, automatically or as you enter it, while you use the site, the panel, short links and the contact form.

4. Purposes and legal bases

We do not sell your data, use it for advertising or build profiles.

5. Retention

The periods are defined in the code and enforced by an automatic clean-up that runs every day:

• Scans: 366 days, then deleted. A code's total scan count and last scan time remain while the code exists.
• Activity log: 365 days; sign-in, sign-out, failed and blocked sign-in entries (with their shortened IP address) 90 days. Names of deleted users and records remain in the activity log until these periods end.
• Sign-in attempt counters: deleted after 24 hours without use.
• Sessions: end when the browser is closed, after 12 hours at most; with "remember me" after 30 days at most. A session unused for 7 days ends.
• Trusted devices: forgotten when not used to sign in for 365 days.
• Unused logos: deleted after 24 hours.
• Accounts and workspace content: for as long as the service is used; deleted when the customer deletes them or the workspace is deleted.
• Notification email address: until the user removes it or the account is deleted. A confirmation link works for 24 hours. Copies of the emails we send (recipient, subject, text) are kept for 14 days for troubleshooting, then deleted.
• Contact messages: kept in our mailbox as long as the conversation needs, then deleted.
• Backups: the database is backed up automatically every night. Each backup is encrypted with AES-256 under a key only the operator holds (the service itself cannot read the backups) and stored in Cloudflare R2 in the European Union jurisdiction; only the newest 14 are kept, and each new one deletes the oldest. In addition, Cloudflare D1's point-in-time recovery (Time Travel) keeps earlier states of the database for the period Cloudflare sets for the account's plan (at most 7 days). Deleted data may remain in the backups for up to 14 days and in Time Travel for up to 7 days.

6. Where data is held and transfers

The service runs on the infrastructure of Cloudflare, Inc. (USA). The database is held in Cloudflare D1 with a Western Europe location hint. Requests are handled at the Cloudflare data centre nearest to you, so data may also be processed outside the European Economic Area and Turkey. Contact form messages arrive in the operator's Google (Gmail) mailbox. Notification and confirmation emails to users are sent through our email delivery provider, which is listed on the sub-processors page once email delivery is switched on. Encrypted database backups are stored in Cloudflare R2 in the European Union jurisdiction.

Transfers abroad rely on the safeguards of Chapter V GDPR and Art. 9 KVKK (e.g. standard contractual clauses and our providers' data processing agreements). Our providers are listed on the sub-processors page. We share data with authorities only where the law requires it.

7. Security

• Connections are made over HTTPS only.
• Passwords are stored as a salted, deliberately slow hash (PBKDF2); password guessing is limited per username, network and device.
• Session cookies cannot be read by scripts and are sent to this site only.
• Signing in to the panel is protected against bots with Cloudflare Turnstile.
• Roles and per-project access let every user see only the data they are allowed to; Wi-Fi passwords are shown only to roles that may edit codes. Important actions are written to the activity log.
• Pages are served with a strict content security policy; the site and the panel load no scripts from elsewhere (except Cloudflare Turnstile on the contact page and the panel sign-in). The panel loads no images from other sites either; our server fetches link preview images.
• The database is held on Cloudflare's infrastructure; its nightly backups are encrypted with a key only the operator holds, so the service itself cannot read them. The operator panel does not show workspace content. The operator exports a workspace's data only to answer a data request (at the customer's request or when the service ends); every such export is recorded in the operator's own activity log (it does not appear in the customer's). Direct database access is used only for maintenance, backups and support, and only as far as needed.

8. Your rights

Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to its processing and to data portability. Under Art. 11 KVKK you may also learn whether and how your data is processed, to whom it was transferred, have corrections and erasures notified to recipients, object to an adverse result of solely automated analysis and claim compensation for unlawful processing.

Send requests to info@qrvesta.com; we answer free of charge within 30 days. We may ask for information to verify your identity. You may also complain to the supervisory authority of your country (in Hungary the NAIH) or to the Turkish Personal Data Protection Authority.

9. California residents (CCPA/CPRA)

We do not sell personal information, share it for cross-context behavioural advertising or use sensitive personal information to infer characteristics. The categories we collect and why are described above: identifiers (username; optional notification email address; name and email in the contact form; shortened IP address of sign-in events), internet activity (scan statistics that identify no one, the activity log) and what you write in the form.

You have the right to know, correct and delete your information and will not be discriminated against for exercising it. Write to info@qrvesta.com with your request.

10. Children

QRVesta is a service for businesses and is not directed at children under 16. We do not knowingly collect data from children.

11. Changes

We update this page as the service changes; the current date is shown at the top. We announce important changes on this page and try to tell workspace administrators as well, through the contact address they gave us. For cookies, see the cookie policy.