Privacy Policy
This policy explains what personal data QR-DigitalCode (https://qr-digitalcode.app) processes, why, and your rights, including under the EU and UK General Data Protection Regulation (GDPR).
1. Product data you enter is not stored
GTINs, batch numbers, serial numbers and other data you type, upload or import are processed in your browser to draw previews and free PNG files. Free previews are counted as a number only — in your browser (local storage) or, for a signed-in free account, on your account; the code itself is never sent for this. When you download a paid format (SVG, PDF, bulk files or GS1 DataMatrix), the codes are sent to our server, turned into files and discarded immediately. We keep only the number of codes, the formats and the time of each download. Spreadsheets imported from Google Sheets are read directly by your browser from Google; they never pass through our server.
2. Personal data we process
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email, optional name, password (stored only as a salted hash), language, consent time | Provide your account, send verification and password-reset emails | Contract | Until you delete your account |
| Session cookie | Keep you signed in | Contract (strictly necessary) | 30 days or until you sign out |
| Download counts (number of codes, format, time) | Apply the free preview allowance and fair-use limits, prevent abuse | Contract, legitimate interest | 24 months |
| Subscription and payment records (PayPal subscription ID, plan, amount, currency, dates, status) | Billing, accounting, refunds | Contract, legal obligation | As long as tax and accounting law requires |
| IP address | Rate-limit sign-up and sign-in attempts, security | Legitimate interest (security) | Deleted within 24 hours |
We do not receive your card number: payments are handled by PayPal. We do not use advertising or analytics cookies and do not sell personal data.
3. Service providers
- Cloudflare, Inc. — hosting, database and network security (processor).
- Resend — sending account emails (processor).
- PayPal — payment processing; PayPal acts as an independent controller for the payment data you give it (see PayPal's privacy statement).
These providers may process data outside your country, including in the United States. Where the GDPR applies, transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision.
4. Your rights
You can ask to access, correct, export or delete your personal data, and to restrict or object to processing. Write to info@qr-digitalcode.app from the email address of your account; we answer within 30 days. You may also complain to your local data-protection authority.
Deleting your account removes your profile and sessions. Payment records are kept only as long as required by law.
5. Cookies and local storage
We set one strictly necessary cookie (__Host-sid) after you sign in. No consent banner is shown because no optional cookies are used.
6. Security
Traffic is encrypted (HTTPS). Passwords are hashed with PBKDF2-SHA256 and a unique salt; session tokens are stored only as hashes.
7. Children
The Service is intended for businesses and adults; it is not directed at children under 16.
8. Changes
We will post updates here and email registered users about material changes.