Privacy Policy

1. Who is the controller?

QRZY is the controller of personal data processed through this site and service. QRZY is operated by DATS Digital LLC, based in Wyoming, USA. The full business details are on our Legal Notice.

Privacy inquiries: privacy@qrzy.co
General contact: support@qrzy.co

2. What we collect and why

Account data

• Name and email (from Google OAuth or direct sign-up).
• Tier, preferences, and in-product settings.

Legal basis: performance of contract (GDPR Art. 6(1)(b)).

QR code and workflow data

• QR code names, destination URLs, routing rules, channel attribution slugs.

Legal basis: performance of contract.

QR scan data

When a QR code is scanned, our redirect service briefly processes the scan in order to route the user. We store:

• Timestamp.
• Derived country and city (from IP geolocation at Cloudflare's edge).
• A shortened IP address (IPv4 keeps only the first two parts, IPv6 only the first four groups), kept for at most 7 days.
• Device type, browser family, and operating system (derived from the User-Agent).
• A hash of the User-Agent string. The raw User-Agent string is not stored.
• Channel attribution (if the URL contains a channel slug).

Full IP addresses are not stored: the IP address is shortened before saving, and the shortened form is kept only with the raw scan rows. Raw scan rows are retained for up to 7 days for anti-abuse purposes and are then discarded. Aggregated, non-identifying analytics are retained per the retention defined by your plan.

Legal basis: legitimate interest (GDPR Art. 6(1)(f)) — operating the redirect service, protecting it from abuse, and giving QR code owners aggregated insights.

Payment metadata

Paid subscriptions are processed by Creem.io acting as Merchant of Record. Card details are handled by Creem.io and its PCI-DSS compliant processors; we do not store card numbers. We receive and retain only the metadata needed to recognise your paid status (subscription ID, plan, status, invoice references).

Legal basis: performance of contract + legal obligation (accounting, tax).

Waitlist

If you join the waitlist, we store your email address and the timestamp, solely to invite you to the service.

Legal basis: consent (GDPR Art. 6(1)(a)). You can ask us to delete your waitlist entry at any time.

Support correspondence

Emails you send to any @qrzy.co address are retained for the period needed to handle your request and to comply with applicable record-keeping obligations.

3. Website analytics

Google Analytics (only with your consent)

If you accept analytics cookies in our cookie banner, we use Google Analytics 4 on qrzy.co to count visits and see which pages people use. It is loaded through Cloudflare Zaraz, which sends the page views to Google from Cloudflare's servers rather than from your browser. Google Analytics receives the address and title of the pages you view (dashboard addresses contain internal IDs, not your QR code names or destinations), the referring page, your browser, device and screen details, your approximate location, and a random identifier stored in a cookie (listed in our Cookie Policy).

If you reject analytics cookies or do not answer the banner, Google Analytics does not run. Google Analytics is never loaded on go.qrzy.co, so people who scan a QR code are not part of it.

Legal basis: consent (GDPR Art. 6(1)(a), and the consent required for cookies under EU ePrivacy rules). You can withdraw consent at any time with the Cookie settings link in the footer of our website; this does not affect processing that happened before you withdrew it.

Cloudflare traffic statistics

Basic traffic statistics also come from Cloudflare, our hosting provider. They are produced from the requests our servers receive and store nothing on your device.

Legal basis: legitimate interest (GDPR Art. 6(1)(f)) — running and protecting the website. You can object at any time by emailing privacy@qrzy.co.

We do not use advertising trackers, remarketing pixels, or third-party social tracking pixels (Facebook, LinkedIn, TikTok, etc.) on the QRZY website.

4. Cookies

QRZY sets the cookies needed to sign you in and to remember your cookie choice, and Google Analytics cookies only if you accept them. Scanning a QR code sets no cookies. See our Cookie Policy for the full list.

5. Who processes data on our behalf (sub-processors)

• Cloudflare, Inc. — hosting of the application, Workers execution, D1 database, KV cache, Analytics Engine (edge analytics ingestion, 90-day retention), DDoS and WAF protection, and Zaraz (shows the cookie banner and loads Google Analytics on qrzy.co). Data transfers to Cloudflare rely on Standard Contractual Clauses under Cloudflare's Data Processing Addendum.
• Creem.io — Merchant of Record for subscription billing.
• Google LLC / Google Ireland Ltd. — Google OAuth sign-in (only if you choose to sign in with Google) and Google Analytics 4 (only if you accept analytics cookies).
• Anthropic, PBC: if you use the AI scenario builder, the description and answers you type are sent to Anthropic's API to generate the workflow.
• Sentry: error reporting for our redirect service and for this website and dashboard (server and browser). We configure it to strip request bodies, cookies and query strings, to remove email and IP addresses from error details, and not to record sessions or screen activity.

Each sub-processor processes only the data needed for its function and is bound by a contract that meets GDPR Art. 28.

For data subjects in the European Union and European Economic Area, QRZY's designated EU representative under GDPR Art. 27 is D-NIS, napredne informacijske storitve, Denis Avguštin s.p., Slovenia. You may also direct GDPR-related communications for the controller through this EU representative at privacy@qrzy.co.

6. International data transfers

Some sub-processors (notably Cloudflare and Google) operate globally. Where personal data leaves the European Economic Area, transfers rely on the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

7. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Erase your data ("right to be forgotten"), subject to legal retention requirements.
• Restrict or object to certain processing.
• Receive a portable copy of your data.
• Withdraw consent at any time (where processing is based on consent).

To exercise any of these rights, email privacy@qrzy.co. We respond within 30 days.

You also have the right to lodge a complaint with the data protection authority in your country of habitual residence, place of work, or place of the alleged infringement.

8. Data retention

• Account data: retained while your account is active. If you deactivate your account, we keep your email address so you can reactivate later. If you request erasure, we anonymize your personal data (including your name and email), keeping only records we are legally required to retain (such as billing and tax records). Anonymized data may persist in routine backups for a short period before they rotate.
• QR code and workflow data: retained while your account exists. Deleting a single QR code archives it: the destination is kept so you can restore it, the code shows an archived page, and its short link stays reserved and is never reissued. Deleting your account or requesting erasure blanks the destination URLs, names and descriptions of your codes and removes their rules, channels, hosted pages, scan rows, analytics and your API keys; the short codes stay reserved so a printed QR can never be reassigned to someone else.
• Records kept for audit and security: the audit log of changes to QR codes (which can include a code's name and destination as they were before a change, plus a shortened IP address and a hash of the User-Agent), logs of AI scenario builder requests (the description and answers you submitted and the result), and the endpoint URLs of any webhooks you configured. These are not removed when you delete your account or request erasure, and are retained for as long as needed for security and legal purposes.
• Raw scan rows: up to 7 days, then discarded.
• Aggregated analytics: per the retention window of your plan (Free: 7 days, Starter: 7 days, Pro: 30 days, Business: 365 days, Elite: indefinite).
• Billing and tax records: retained as required by applicable accounting and tax law.

9. Security

We use TLS 1.3 for all connections, encryption at rest for stored data, and least-privilege access controls for our internal operations. For more, see our Security page.

10. Children

QRZY is not directed at children under the age required for lawful digital consent in their jurisdiction. We do not knowingly collect personal data from children below that threshold. If you believe a child has given us personal data without appropriate consent, contact privacy@qrzy.co and we will delete it.

11. California Residents (CCPA / CPRA)

QRZY does not sell or share personal information as those terms are defined under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). California residents have the right to:

• Know what personal information is collected about you and how it is used.
• Delete personal information we hold about you, subject to limited legal exceptions.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of personal information (we do not sell or share it).
• Non-discrimination for exercising any privacy right.

To exercise these rights, email privacy@qrzy.co. We will respond within 45 days as required by CCPA.

12. Changes to this policy

We may update this Privacy Policy as our processing evolves. Material changes will be announced by email or prominent in-product notice before they take effect.

13. Transparency Request (Scanner)

If a QR code created with QRZY was scanned from your device and you want to understand what data was collected, use the form below. Because we do not store per-scanner identifiers, there is typically nothing to delete. We email you the transparency notice right away and are notified of your request at privacy@qrzy.co. Your email address is not stored in our database.