QR Studio

Privacy policy

Last updated: October 7, 2026

This policy explains what personal data QR Studio processes, why, and what rights you have. It covers people who create an account and people who scan QR codes created with QR Studio.

Who is responsible

The data controller is the operator of this website. Contact the administrator using the email address provided on this site.

If you have an account

  • Account data: name, email address, password (stored only as a secure hash), language and time zone.
  • Security data: active sessions with IP address and browser, to show your signed-in devices; two-factor authentication settings.
  • Content you create: QR codes, their destinations, designs, uploaded logos and custom domains.

We use this data to provide the service you signed up for (legal basis: contract, Art. 6(1)(b) GDPR) and to keep it secure (legitimate interest, Art. 6(1)(f)).

If you scan a QR code

  • Date and time of the scan.
  • Device type, operating system, browser and preferred language, derived from your browser's request.
  • Approximate location (country, region, city) when provided by our network provider; never GPS.
  • The domain of the referring page, if any.
  • A pseudonymous visitor identifier: a keyed one-way hash of your IP address and browser. Your IP address itself is not stored.

These statistics are shown to the owner of the QR code so they can measure their campaigns (legitimate interest, Art. 6(1)(f) GDPR). Known bots are not recorded.

Cookies

We only use technical cookies that are necessary for the service: the sign-in session, the language you choose, a short-lived cookie during two-factor sign-in, and a cookie that remembers when you unlocked a password-protected link. We don't use advertising or third-party tracking cookies, so no consent banner is needed.

How long we keep data

Account data is kept until you delete your account; deleting it removes your QR codes and all their scan statistics immediately. Sessions expire after 30 days of inactivity. QR code owners can reset a code's statistics at any time.

Who processes data for us

Our hosting provider (servers and database) and, if configured, our email delivery provider. Data is not sold or shared for marketing.

Your rights

You can access, correct, export or delete your data, restrict or object to processing, and lodge a complaint with your data protection authority (in Italy, the Garante per la protezione dei dati personali). You can update or delete your account at any time from the Account page; for anything else contact us.

Changes

We'll update this page when our practices change and show the date of the latest revision above.