Privacy policy

Who we are

QR Lasts (qrlasts.com) is run by Yann Marquet, Carrer de Calderon, Bl. 2, P4A, 07820 Sant Antoni de Portmany, Spain. For anything about your data, write to [email protected].

The short version

• There are no accounts. We never ask for your name or email address to make, edit or download a code.
• We do not record who scans your codes. A scan adds one to a counter, nothing more.
• Ads come from Google AdSense. In the EU, UK and Switzerland you are asked for consent before ads use cookies to personalise.

When you make a dynamic code or short link

We store the destination address you enter, the short link, the private edit token, whether the link is fixed, the logo image if you upload one, the total number of scans and the dates the code was created and last changed. We need this to run the redirect you asked for (Art. 6(1)(b) GDPR). We keep it for as long as the code exists, which by design is indefinitely: printed codes have to keep working. To have a code deleted, send us its edit link.

When someone scans a code

The redirect adds one to the code's scan counter. We do not store the scanner's IP address, device, location or time of the scan against the code.

Codes built in your browser

WiFi and contact-card (vCard) codes are drawn in your browser and never sent to us. When you download a static code as a file, its content is sent to our server to draw the file and is discarded straight away; it is not stored.

Safety checks

Every destination address is checked against Google Web Risk when a code is created and whenever it changes, to refuse phishing and malware. Only the address is sent to Google. Legal basis: our legitimate interest in keeping our links safe for the people who scan them (Art. 6(1)(f) GDPR).

Payments

Paid extras such as the Business Pack are paid through Stripe. Stripe collects your payment details, email and billing address under its own privacy policy. We receive the payment reference, amount and status, and the codes you import. We keep payment records for as long as Spanish tax law requires (Art. 6(1)(b) and (c) GDPR).

Signing in with Google or Facebook (optional)

If you choose to sign in with Google or Facebook, we receive your account ID and email address from that provider. We use them only to sign you in and show you the codes you made. We do not use them for advertising, do not sell them and do not share them with anyone. Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. To delete your sign-in, see how to delete your data.

Server logs

Like every website, our servers log each request: IP address, time, page requested and browser type. We use these logs to keep the site secure and fix errors, and delete them after 14 days. Legal basis: our legitimate interest in running a secure service (Art. 6(1)(f) GDPR).

Cookies

We set one strictly necessary cookie that protects forms against forgery. It holds no personal profile and needs no consent. Google AdSense sets advertising cookies only as allowed by your choice in the consent message; you can change that choice at any time from the privacy settings link Google shows on the page.

Advertising

Pages on this site show ads from Google AdSense, provided by Google Ireland Ltd. Google may use cookies and similar technology to show ads and measure them, and to personalise ads where you have consented (Art. 6(1)(a) GDPR). See how Google uses information from sites that use its services. Redirects never show ads.

Who else handles your data

• Hetzner Online GmbH, Germany: server hosting.
• Cloudflare, Inc.: network delivery and protection, DNS, and storage of encrypted database backups.
• Google: Web Risk safety checks, AdSense, and Sign in with Google if you use it.
• Meta Platforms Ireland Ltd.: Facebook sign-in, if you use it.
• Stripe: payments.

Cloudflare, Google and Stripe may process data in the United States. They rely on the EU–US Data Privacy Framework and the European Commission's standard contractual clauses for these transfers.

Your rights

You can ask for access to, correction or deletion of your data, restrict or object to its use, ask for a copy, and withdraw consent at any time. Because there are no accounts, we identify your codes by their edit link. Write to [email protected]. You can also complain to the Agencia Española de Protección de Datos (www.aepd.es) or the data protection authority where you live.

How to delete your data

• A code or short link: email [email protected] with the code's edit link and ask for it to be deleted. We delete the destination, logo and scan count, and the short link stops working.
• A sign-in with Google or Facebook: email [email protected] from the address you signed in with and ask for your sign-in to be deleted. We delete your account ID and email address. You can also remove QR Lasts from your Google account permissions or under Apps and Websites in your Facebook settings.
• A Business Pack: email us the pack's private link. We delete its codes. Payment records stay for as long as tax law requires.

We confirm by email once your data is deleted, within 30 days at the latest.

Children

This site is not aimed at children under 14, and we do not knowingly collect their data.

Changes

When this policy changes, we update it here and change the date at the top.