This Policy explains how we collect, use, share, and protect personal data when you use QRkit.io.
Updated:
Controller: marc.IT digital solution
Owner / Responsible person: Marc Wolf
Address: Rehleite 1, 95326 Kulmbach, Germany
Email: [email protected]
Privacy inquiries: Please use [email protected] and mention "Privacy" or "Datenschutz" in the subject line.
Supervisory authority (Bavaria): Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.
This Privacy Policy applies to our website, account dashboard, APIs, checkout, support communication, and related services.
By using QRkit.io, you also acknowledge our Terms of Service.
Processed data
Purpose: Create accounts, authenticate users, support passwordless login and Google Sign-In, keep sessions active, and provide secure access to the dashboard.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (service security and abuse prevention).
Processed data
Purpose: Process paid subscriptions, reconcile Stripe checkout and webhook events, provide billing overviews, handle refunds, and document billing events.
Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(c) GDPR (legal retention and accounting obligations).
Processed data
Purpose: Generate QR codes, keep dynamic destinations working, and provide scan statistics inside the dashboard.
Legal basis: Art. 6(1)(b) GDPR (contract performance).
Processed data
Purpose: Send activation emails, login emails, billing-related notifications, support replies, cancellation confirmations, and service notices through our configured SMTP infrastructure.
Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(f) GDPR (reliable customer communication).
Processed data
Purpose: Measure public-site reach and usage after consent, let you sign in with Google, and, if you explicitly request it in your account settings, connect your own Google Analytics property to your QRkit dashboard.
Legal basis: Art. 6(1)(a) GDPR (consent for non-essential public-site analytics) and Art. 6(1)(b) GDPR (performance of the requested sign-in and integration features), plus Art. 6(1)(f) GDPR (account integrity and feature operation).
Processed data
Purpose: Detect abuse, rate-limit repeated login attempts, investigate incidents, correlate server and application logs with requests, and keep the service stable.
Legal basis: Art. 6(1)(f) GDPR (service security, fraud prevention, and operational integrity).
We use essential cookies and comparable tokens to sign you in, keep authenticated dashboard sessions active, and protect account-related requests. Our primary session cookie is named qr_auth_session. It is configured as HTTP-only, uses SameSite=Lax, and is intended to last for up to 30 days unless you sign out or it is otherwise cleared.
We also generate short-lived action tokens for account activation and passwordless login flows. Those tokens are not used for advertising; they exist to complete user-requested authentication steps and typically expire after about one hour.
If you grant analytics consent, QRkit.io may load Google Tag Manager and Google Analytics on public pages to measure page views, page paths, referrers, approximate location, device or browser data, and selected interaction events. If you choose to connect your own Google Analytics account inside the dashboard, that remains a separate, user-requested product integration described below.
If you grant marketing consent and the relevant integration is enabled, QRkit.io may also load marketing or attribution technologies such as Meta Pixel on public pages. Non-essential analytics and marketing technologies remain disabled until you opt in through our cookie settings, and you can later change your choice there at any time.
Payments for paid plans are processed by Stripe. We do not store raw payment card details in the QRkit.io application. Instead, we store the Stripe customer, subscription, plan, status, invoice references, and related billing timestamps that are needed to keep your subscription state synchronized and visible in your account.
If billing portal access is available for your account, Stripe also receives the data needed to let you view invoices, payment method details, or subscription status inside the Stripe customer portal.
Stripe may also process anti-fraud and payment-risk signals as part of checkout and recurring billing. Additional information is available in our Refund Policy.
If you sign in with Google, Google acts as an identity provider and sends us the profile details needed to authenticate your account. If you do not use Google Sign-In, this processing does not occur.
Separately, QRkit can offer an optional Google Analytics connection inside the dashboard if you explicitly initiate it in your account settings. In that case, we store the access data required to fetch your selected Google Analytics property and show those analytics within your dashboard until you disconnect the integration.
For dynamic QR codes, we record scan events so that dashboard analytics work. Depending on the available request metadata, this may include the scan time, operating system, country, city, the affected QR code, and a hashed fingerprint derived from request attributes to reduce duplicate counting and improve reporting quality.
We also process consent-based public-site analytics data such as page views, page paths, referrer information, approximate location, device or browser signals, and selected interaction events including sign-up, QR creation, or QR downloads. In addition, we record dashboard activity events when authenticated users successfully use relevant dashboard endpoints. These events can include route name, feature key, HTTP method, response status, actor account, owner account, and related request IDs so that product usage, support, and incident analysis remain traceable.
We use technical and organizational safeguards designed to protect personal data, including encrypted transport, access controls, server-side authentication checks, rate limiting, request validation, and operational monitoring.
To prevent abuse such as repeated failed login attempts or suspicious account activity, we may store security-relevant event data including hashed IP or email references, event outcomes, duration measurements, and technical request context. We may also correlate request IDs with web server access logs, application error logs, and infrastructure logs when investigating incidents, fraud signals, or webhook delivery problems.
No online system is completely risk-free, so we cannot guarantee absolute security.
We do not sell personal data. We share data only where necessary to operate the service, complete requested transactions, deliver communications, or comply with legal obligations.
Role: Hosting and infrastructure provider for application servers, database, storage, backups, and operational network services used to run QRkit.io.
Typical data involved: Account records, QR code content, generated assets, scan analytics, server logs, and technical telemetry needed for hosting, backup, and incident response.
Role: Payment processor for checkout, subscription management, invoice handling, customer portal access, and payment-fraud checks.
Typical data involved: Billing email, subscription and invoice metadata, payment-related identifiers, and webhook-related transaction references.
Role: Analytics provider for consent-based public-site analytics, identity provider for Google Sign-In, and optional provider for a user-requested Google Analytics connection.
Typical data involved: Consented public-site analytics data such as page views, page paths, referrer information, approximate location, and selected interaction events, plus OAuth identifiers, account profile basics needed for sign-in, and, if you connect it yourself, Google Analytics account or property metadata plus access tokens.
Role: Optional marketing and attribution provider when Meta Pixel is enabled and you consent to marketing cookies on public pages.
Typical data involved: Consented public-site marketing and attribution data such as page views, event data, browser identifiers, and marketing cookie values.
Role: Mail delivery provider used for transactional emails via the configured SMTP host smtps.udag.de.
Typical data involved: Recipient address, sender metadata, message content, and any invoice or support attachments required for the message.
We may also disclose information where required by law, to enforce our policies, to defend legal claims, or to protect the rights, safety, and integrity of the service.
We keep this data while your account is active and as long as it is needed to provide the service. If an account is deleted or terminated, we remove or block remaining data unless continued retention is required for legal claims, abuse prevention, or statutory obligations.
Our primary session cookie can remain valid for up to 30 days unless you sign out or it is cleared earlier. Activation and login action tokens are generally short-lived and typically expire after about 1 hour.
Billing-relevant records are kept for the legally required retention period, typically up to 10 years where commercial or tax law applies.
Security-relevant data, auth events, access logs, and technical logs are kept only as long as operationally necessary for rate limiting, incident response, fraud prevention, and service integrity. Where an incident or dispute exists, selected evidence may be retained longer until the matter is resolved.
We keep support conversations, cancellation requests, and service communications for as long as needed to process the request, document the outcome, and comply with retention or dispute-handling obligations.
Scan analytics linked to QR campaigns are retained while the related QR code or account data is needed for the dashboard analytics feature, unless earlier deletion is requested or legally required.
Some of our providers process personal data across multiple countries. Where data is transferred outside the European Union or European Economic Area, we rely on appropriate safeguards such as adequacy decisions, contractual protections, and comparable transfer mechanisms required under applicable law.
Typical location: Germany / European Union
Our planned production hosting setup is EU-based. We do not intend regular third-country transfers through the core hosting stack itself.
Typical location: EEA, United Kingdom, United States, and other Stripe group locations
Stripe may process payment and billing data across its international group infrastructure. Where personal data leaves the EEA, Stripe applies the transfer mechanisms offered under its contractual terms and applicable law.
Typical location: EEA, United States, and other Google locations
Consent-based public-site analytics through Google, Google Sign-In, and any user-requested Google Analytics connection can involve processing in countries outside the EEA, including the United States.
Typical location: EEA, United States, and other Meta locations
If marketing consent is given and Meta Pixel is enabled, Meta can process public-site attribution and advertising-related data across its international infrastructure, including outside the EEA.
Typical location: Provider-dependent
Transactional emails are routed through the SMTP infrastructure configured for QRkit.io. Depending on the provider and recipient domain, message processing can involve cross-border routing.
To exercise rights, contact us at [email protected]. We may need to verify your identity before processing certain requests. The same address can be used for general privacy and data protection requests.
Our service is not directed to children under 13. We do not knowingly collect personal data from children under 13. If you believe a child provided data to us, please contact us and we will take appropriate steps.
Our website and dashboard may contain links to third-party services. Their privacy practices are governed by their own policies, not this Privacy Policy.
We may update this Privacy Policy to reflect product, operational, legal, or provider changes. Material changes are reflected by updating the date at the top of this page. Continued use of the service after updates means you accept the revised policy.
If you have questions about this Privacy Policy or our data practices, contact us at [email protected] for privacy, billing, or account-related requests, or via our contact page.
