Privacy policy

What this is about

QReado is an app for Shopify stores that lets merchants create, print and analyse QR codes. This policy explains which data is processed – for merchants who use the app and for people who scan a QR code.

Controller

iara & skay GmbH, Vogelmatt 6, 6216 Mauensee, Schweiz

Contact for all privacy requests: support@qreado.com

We are the controller for merchant data (account, settings). For scan statistics and for the content a merchant puts into their QR codes, we process data on the merchant's behalf; the merchant is responsible for the purpose and lawfulness of that processing.

Merchant data

When a store installs QReado, we store the store address (e.g. name.myshopify.com), the access token issued by Shopify, the app settings and everything the merchant creates in the app: QR codes with their destinations, product names and images, uploaded logos and background images, templates and folders. Content such as Wi-Fi credentials or contact details (vCard) is stored as entered by the merchant.

We do not store names or email addresses of store staff. The purpose is providing the app; the legal basis is the contract with the merchant (Art. 6(1)(b) GDPR).

Data when a QR code is scanned

Dynamic QR codes lead through a QReado short link to the merchant's destination. For each scan we store the time, the country and the device type (iPhone, Android or other). The country is derived from the IP address on our server; the IP address itself is neither stored nor shared.

To avoid counting repeated scans, we keep a shortened, irreversible hash of the IP address and browser identifier in memory for at most one minute. We set no cookies and do not track anyone across websites.

The purpose is anonymous scan statistics for the merchant; the legal basis is the merchant's legitimate interest in evaluating their marketing materials (Art. 6(1)(f) GDPR). After the scan, the privacy policy of the destination page applies. Static QR codes do not go through QReado, so no data reaches us.

Visiting the website

We use no analytics, advertising or tracking tools on www.qreado.com. To show the right language, we determine the country from the IP address on our server; the address is not stored for this.

If you choose a language yourself, we remember it in a cookie (qreado_lang, valid for one year) that contains only “de” or “en”. The font is loaded from Shopify's CDN, which technically receives your IP address. Our hosting provider may briefly keep technical access data such as IP address and time in server logs to keep the service running and secure.

Support requests

When you write to us, we process your email address and the content of your message to answer the request. Our mailbox is run by Infomaniak in Switzerland. We keep the correspondence as long as needed for the request and for statutory retention duties.

We inform merchants by email or in the app about important changes, security matters and their plan. We only send promotional newsletters with explicit consent.

Store customer data

QReado does not read orders or customer data from Shopify. Requests from a store's customers for access or deletion that Shopify forwards to us are answered accordingly: we hold no customer data.

Service providers

We use the following processors: Railway Corporation (running the app and database, data centre in Amsterdam, Netherlands) and Shopify (platform and plan billing). Where data is transferred to the USA, this is based on the European Commission's Standard Contractual Clauses.

Once a day the app checks whether the destinations of QR codes are still reachable by opening those addresses. No personal data is transmitted in the process.

To protect against phishing and malware, we may have new destination addresses checked by Google Web Risk. Only the destination address is sent, no merchant or customer data.

Plans are billed exclusively by Shopify. We neither see nor store payment details; we only learn which plan a store has chosen.

Processing by these providers is additionally governed by their own privacy policies. We do not sell personal data or share it for advertising.

Disclosure in special cases

We only disclose data to authorities or courts when required by law or when necessary to protect our rights, defend against claims or investigate misuse of the app.

If QReado is transferred in whole or in part to another company, for example through a sale or merger, the data may be transferred with it. It remains protected by this policy, and we inform merchants beforehand.

Data security

We protect data with encrypted connections (HTTPS), restricted access and a data centre in the EU. However, nobody can guarantee completely secure transmission and storage on the internet.

Only put content into QR codes that is needed for the purpose and may be public anyway – anyone can read a printed code. Sensitive data (e.g. health data) does not belong in a QR code.

Retention

A store's data is kept as long as QReado is installed. After uninstalling, we delete all of the store's data as soon as Shopify asks us to (usually after 48 hours). Scans belong to their QR code and are deleted with it; individual scans are also deleted after 25 months, only the total per code remains. For a deleted dynamic code we keep only its link ending and the store, so printed copies keep leading to the store's homepage – until the app is uninstalled.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. Write to us at support@qreado.com. You can also lodge a complaint with a data protection authority; in Switzerland this is the Federal Data Protection and Information Commissioner (FDPIC).

If a request concerns data a merchant has put into their QR codes or data from scans of their codes, we forward it to the merchant or help them answer it.

Before answering a request we may ask you to verify your identity. We usually respond within 30 days.

Children

QReado is meant for businesses, not children. We do not knowingly process data of anyone under 16. If we learn of it, we delete it.

Merchant responsibilities

Merchants are responsible for making sure the content and destinations of their QR codes are lawful, that they may use third-party data (e.g. in a vCard) and that they inform their customers about scan statistics in their own privacy policy where required.

Linked pages

QR codes lead to pages of the merchant or third parties. Their operators alone are responsible for their content and how they handle data.

Liability

Liability is governed by the QReado terms of service. To the extent permitted by law, we are not liable for damage arising from processing by service providers, from third-party attacks despite reasonable safeguards or from content merchants store. Mandatory statutory liability, in particular for intent and gross negligence, remains unaffected.

Governing law and changes

This policy follows the Swiss Federal Act on Data Protection (FADP) and, where applicable, the GDPR. We may update it when the app or the law changes; the version published on this page applies. We inform merchants about material changes in the app beforehand.