Privacy Policy

1. Data controller

IoTera Oy (Business ID 3454475-1)
Tampere, Finland
qrleap@iotera.fi

This policy covers the QRLeap service (qrleap.app). It describes what data we process about both users of the service and people who scan QR codes created with it.

2. Users: what data we process

• Account details: the email address, name (optional), and a hash of your password, which you provide yourself when you register. We store sign-in entirely ourselves, in our own database in the EU (Frankfurt) — sign-in no longer goes through an external provider.
• Signing in with Google or GitHub (optional): if you choose to sign in with Google or GitHub, we receive your name, email address, profile picture URL, and the provider's account id for you. We never receive or store your password. Google and GitHub each act as an independent controller for their own services in this respect — see Google's privacy policy and GitHub's privacy statement.
• Service content: the QR codes you create, their destination addresses, names, labels, design settings, routing rules, any passwords (stored as a hash), and any logos you upload.
• Subscription details: if you purchase the paid add-on, we store the subscription's identifier, status, and period end date. Besides the subscription identifiers, we store your Stripe customer identifier. Payment card details are handled exclusively by Stripe. We neither see nor store them.
• Sign-in sessions: for each active session we store the IP address and browser identifier from sign-in. The browser identifier lets you see your active sessions and sign them out; the IP address is used for security, such as investigating abuse. The data is deleted when you sign out; expired sessions are removed by a daily cleanup.
• Technical data: server logs, which store an IP address and browser details for a short period for troubleshooting and security purposes.

3. Scanners: what data we process

When someone scans a QR code created with QRLeap, we store the following data about the scan so the code's owner can see statistics:

• A hash of the IP address: the IP address itself is not stored. A shortened SHA-256 hash is computed from it and used only to link repeated scans from the same device within 30 seconds.
• Browser identification data (user agent) and the device type (phone, tablet, computer), operating system, and browser derived from it.
• Country and city inferred from the IP address by our infrastructure provider (Vercel). No more precise location is collected.
• A timestamp.

We do not collect a scanner's name, email, or any other direct identifier. Password attempts on a password-protected code are rate-limited by IP address, and this data is kept only in server memory for a few minutes.

4. Purpose and legal basis for processing

• Providing the service (contract): maintaining accounts, routing and reporting on QR codes, managing the paid add-on.
• Preventing misuse and ensuring security (legitimate interest): countering phishing and spam, rate-limiting scans, logs.
• Improving the service (legitimate interest): analysing usage in aggregate, not at the level of an individual person.
• Statutory obligations: bookkeeping for payment transactions.

5. Cookies and local storage

• Strictly necessary cookies: the cookies the Service itself sets when you sign in: a session cookie, a signed cache cookie that speeds up session checks and, when you sign in with email without selecting “Remember me”, a marker cookie saying so, and, when you sign in with Google, GitHub or single sign-on, a short-lived (5-minute) security cookie that protects the sign-in redirect. Without them, signing in does not work. They hold a random session identifier and, in the cache cookie, basic account and session details (including name, email, IP address and browser identifier) in signed, not encrypted, form; they are used only to keep you signed in. When you sign in with email and password without selecting “Remember me”, the session ends when you close the browser. Sign-in with Google, GitHub or single sign-on keeps you signed in on that browser for up to 3 days after your last activity unless you sign out; the same maximum applies if you select “Remember me”.
• Local browser storage: we remember that you have dismissed the cookie notice and seen the introductory splash. Neither tracks you across other sites.

We do not use advertising cookies, Google Analytics, or other third-party tracking services. No cookies are set for scanners. On the sign-up and password-reset forms we use Cloudflare Turnstile for bot protection (see section 6); it does not set tracking cookies.

6. Recipients and processors

We use the following providers, who process data on our behalf under data processing agreements:

• Vercel (Vercel, Inc., United States): the application's runtime and content delivery, including country and city inference.
• Neon (Neon, Inc., United States): the database holding account (including sign-in) data, QR code, and scan data. The database is hosted in the EU (AWS, Frankfurt), so this data does not leave the EU.
• Stripe (Stripe Payments Europe Ltd, Ireland, and Stripe, Inc., United States): payment processing and subscription management, only if you purchase the paid add-on. Under Stripe Managed Payments, Stripe (Link) acts as the reseller and merchant of record for the purchase and processes your payment and billing data as an independent controller under its own terms and privacy policy. The purchase appears on your statement and receipt as "Sold through Link", and receipts are sent by Link.
• Cloudflare (Cloudflare, Inc., United States): Turnstile bot protection on the sign-up and password-reset forms. Processes technical identifiers (including IP address) only to identify bots, for the duration of that request.
• Google (Google Ireland Limited / Google LLC): if you choose to sign in with Google, Google verifies your identity and passes us the data described in section 2. Google acts as an independent controller in this respect.
• GitHub (GitHub, Inc., United States): if you choose to sign in with GitHub, GitHub verifies your identity and passes us the data described in section 2. GitHub acts as an independent controller in this respect.

Sign-in-related emails (verification, password reset, email change) are sent through IoTera's own mail server. This is not a separate processor, since it is IoTera's own infrastructure.

We do not sell or disclose data for marketing purposes. We disclose data to authorities only when legally required.

7. International data transfers

Account (including sign-in), QR code, and scan data are stored in the EU (Frankfurt) — sign-in no longer goes through a US-based sign-in provider. The hosting provider Vercel, the payment provider Stripe, the bot-protection provider Cloudflare, and — if you choose to use them for sign-in — Google and GitHub are US companies that also process data in the United States. These transfers rely on standard contractual clauses approved by the European Commission and, where applicable, the EU–US Data Privacy Framework. You can request further information about these safeguards from qrleap@iotera.fi.

8. Retention periods

• Account details and QR codes: for as long as the account exists. After account deletion, data is removed within 30 days.
• Deleted QR codes: marked deleted immediately and permanently removed within 30 days.
• Scan events: retained for 12 months, after which they are deleted or converted into aggregate figures from which an individual scan cannot be distinguished.
• Payment transactions: the 6 years from the end of the accounting period required by Finnish bookkeeping law.
• Sign-in sessions: deleted on sign-out or account deletion; expired sessions are cleaned from the database by a scheduled job.
• Server logs: at most 30 days.

9. Security

Connections are encrypted (TLS). Passwords are stored as salted hashes, and scanners' IP addresses only as hashes. Access to production data is limited to people involved in operating the service.

10. Your rights

Under the GDPR, you have the right to:

• find out what data we process about you, and receive a copy of it
• request correction of inaccurate data
• request deletion of data, unless we have a statutory obligation to retain it
• request restriction of processing and object to processing based on legitimate interest
• receive the data you provided in a machine-readable format.

You can exercise most of these rights yourself from the Service's settings (Dashboard → Settings): exporting your data as a machine-readable JSON file includes your account details, QR codes, and scan summaries, and deleting your account permanently removes your account and all your QR codes and their scan data immediately (a live Instant redirect subscription is cancelled automatically first). For other requests, contact qrleap@iotera.fi. We respond within one month.

If you believe we are processing your data unlawfully, you may file a complaint with the Office of the Data Protection Ombudsman: tietosuoja.fi.

11. Changes

We update this policy as needed. Changes are published on this page, and the update date is shown at the top. We will also announce material changes in the Service.