Privacy policy
Last updated:
This policy explains how QRZeta (qrzeta.com) processes the personal data of people who use the site. Our principle is simple: process only the minimum data needed for the service to work.
1. Controller
The data controller is QRZeta. For any privacy question, email us at [email protected].
2. Data we process
- Static QR codes and logos: generated entirely in your browser. The QR content and the logo image are never sent to our servers.
- Dynamic QR codes: if you choose to create one we store your email address, the short link, the destination URL, the optional name you type and the creation and update dates.
- Access codes: the one-time codes we email you are stored hashed, never in plain text.
- Session: a random session identifier, stored hashed, so you don't have to request a code on every visit.
- Security: an irreversible hash of your IP address to limit abuse (for example, many attempts in a row). Our hosting provider also keeps technical logs of the IP, date and browser of each request.
We do not track scans of your dynamic QR codes, build profiles, ask for passwords or send you marketing emails.
3. Purposes and legal basis
- Creating, showing, editing and redirecting your dynamic QR codes, because you request it (performance of the service and consent).
- Emailing you access codes, for the same reason.
- Preventing fraud, spam and abuse, and keeping the service secure (legitimate interest).
- Showing ads that fund the free service (consent, where required by law).
4. How long we keep data
| Data | Retention |
|---|---|
| Email and dynamic QR codes | While you have dynamic QR codes or until you delete them |
| Access codes | Expire after 10 minutes, deleted after 24 hours |
| Session | 30 days of inactivity, 90 days maximum |
| IP hash for rate limits | 48 hours maximum |
| Server technical logs | According to the hosting provider's policy |
5. Who we share data with
We do not sell or rent your data. Only the providers needed to run the service are involved:
- Banahosting: web hosting, database and email delivery.
- Cloudflare: content delivery, attack protection and bot verification (Turnstile).
- Google: ads (AdSense) and fonts (Google Fonts), which receive your IP when the page loads.
Some of these providers are located outside your country (for example, in the United States). We only work with providers that offer adequate data protection safeguards.
6. Advertising and Google cookies
- Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites.
- Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the Internet.
- You may opt out of personalized advertising by visiting Google Ads Settings, or opt out of other vendors' cookies at www.aboutads.info.
- Learn more: how Google uses information from sites that use its services.
- In the European Economic Area, the United Kingdom and Switzerland we ask for your consent before using advertising cookies, through a Google-certified consent management platform.
Each cookie is listed in our Cookie policy.
7. Your rights
Under Peruvian Personal Data Protection Law No. 29733 and, where applicable, the EU General Data Protection Regulation (GDPR), you can exercise your rights of access, rectification, erasure, objection and portability, and withdraw your consent at any time.
- Instant deletion: in My dynamic QR codes, use "Delete all my data". We will email you a code to confirm. Printed QR codes will stop working.
- By email: write to [email protected] from the associated address. We will reply within the legal deadlines.
If you believe we did not handle your request properly, you can complain to Peru's National Personal Data Protection Authority or to the supervisory authority in your country.
8. Security
We use encrypted connections (HTTPS), store codes and sessions hashed, rate-limit access attempts and verify that requests come from humans. No system is infallible, but we apply reasonable measures and review the service regularly.
9. Children
QRZeta is not directed at children under 14 and we do not knowingly process their data. If you believe a child gave us their email, contact us and we will delete it.
10. Changes to this policy
If we change this policy we will update the date above. If the change is significant and you have dynamic QR codes, we will let you know on the site.