Vai al contenuto principale
DenQr
Create QR
Notice

Privacy Policy

Last updated: 20 October 2026

This notice explains how DenQr (“we”) collects and processes the personal data of people who visit denqr.com, create an account or scan a QR Code generated with the service. It is provided under Regulation (EU) 2016/679 (“GDPR”).

1. Data controller

The data controller is DenQr. For any request about your data you can write to privacy@denqr.com or supporto@denqr.com.

2. What data we collect

If you create an account

  • Name, email address and password (stored only in encrypted form, never in plain text).
  • If you sign in with Google: name, email, profile picture and a technical identifier provided by Google. We do not receive your Google password and cannot access your Google data beyond this.
  • IP address and browser type at sign-in, for account security.
  • Content you enter in QR Codes (links, texts, uploaded files, vCard contact details).
  • Billing details, if you subscribe to a paid plan.

If you scan a dynamic QR Code

  • Date and time of the scan, approximate country and city (derived from the IP), device type, operating system and browser. The full IP address is not stored. Approximate geolocation uses the IP Geolocation by DB-IP database (CC BY 4.0 licence), queried locally: the IP is not sent to DB-IP.

If you write to us or subscribe to the newsletter

  • Name, email, phone number (if you provide it) and the content of your message.
  • For the newsletter: email address, subscription date and IP as proof of consent.

3. Why we process it

  • To provide the service (legal basis: performance of a contract): creating and managing your account, generating and running QR Codes, showing you statistics.
  • For security (legitimate interest): preventing abuse, unauthorised access and fraud.
  • For service communications (performance of a contract): email confirmation, password reset, account notices.
  • For the newsletter (consent): only if you subscribe, and you can unsubscribe at any time from the link in every email.
  • For legal obligations: keeping tax documents.

4. Who processes data on our behalf

We rely on providers acting as data processors, all bound by contract and GDPR-compliant:

  • Railway — hosting of the application and the database.
  • Cloudflare — content delivery network, site protection, storage of uploaded files and email forwarding.
  • Resend — sending service emails and the newsletter.
  • Google — only if you choose to sign in with your Google account.
  • Stripe — payment processing; card details are handled exclusively by Stripe and never pass through our servers.

Some of these providers may process data outside the European Union, on the basis of the standard contractual clauses approved by the European Commission.

5. How long we keep it

  • Account data: as long as the account exists, then deleted within 30 days of its deletion.
  • Scan statistics: as long as the QR Code they refer to exists.
  • Messages from the contact form: 24 months.
  • Newsletter subscription: until you unsubscribe.
  • Tax documents: 10 years, as required by law.

6. Your rights

At any time you can ask for access to your data, its rectification or erasure, restriction of processing, portability, or object to processing based on legitimate interest. You can withdraw your newsletter consent without affecting processing already carried out. Write to privacy@denqr.com: we reply within 30 days.

You also have the right to lodge a complaint with a data protection authority, for example the Italian Data Protection Authority (garanteprivacy.it) or the authority of your country of residence.

Technical cookies (always on). The session cookie qrv_session that keeps you signed in (expires after 8 hours or when you sign out) and the temporary cookie qrv_oauth_state (10 minutes) that protects Google sign-in. We also save a few local preferences in your browser (cookie choice, filters, last page visited) that never leave your device.

Statistics (only with your consent). If you turn on the “Statistics” category we use Google Analytics (Google Ireland Ltd.) to understand which pages are visited and where visitors come from, in aggregate form. We disable personalised advertising signals and Google does not link the data to an advertising profile of yours; IP addresses are not logged by Analytics 4. Without consent the tool is not loaded. You can change your choice from in the footer.

Marketing (only with your consent). If you turn on the “Marketing” category, we load the Google Ads tag (Google Ireland Ltd.) to measure which ads lead to new sign-ups and plan purchases, and to show you our ads on Google. Google may store advertising cookies (for example _gcl_au) and receive your IP address and browser data; for purchases we only send the amount, never card details. Without consent the tag is not loaded. You can change your choice at any time from in the footer. Google’s notice: policies.google.com/technologies/ads.

Third-party services loaded only when you use them. Google Maps in the Location QR generator and in geo-fencing (the address searched and your IP are sent to Google); Stripe on the payment page (card details are entered directly on Stripe, we never see them); Unsplash for stock photos in the digital menu (thumbnails loaded from their CDN). The site’s typeface is served from our own servers, not from Google Fonts.

8. Changes

We may update this notice. The date at the top shows the latest revision; for substantial changes we will notify you by email or with a notice in the service.