Privacy policy

What this is about

QReado is an app for Shopify stores that lets merchants create, print and analyse QR codes. This policy explains which data is processed – for merchants who use the app and for people who scan a QR code.

Controller

QReado

Contact for all privacy requests: support@qreado.com

Merchant data

When a store installs QReado, we store the store address (e.g. name.myshopify.com), the access token issued by Shopify, the app settings and everything the merchant creates in the app: QR codes with their destinations, product names and images, uploaded logos and background images, templates and folders. Content such as Wi-Fi credentials or contact details (vCard) is stored as entered by the merchant.

We do not store names or email addresses of store staff. The purpose is providing the app; the legal basis is the contract with the merchant (Art. 6(1)(b) GDPR).

Data when a QR code is scanned

Dynamic QR codes lead through a QReado short link to the merchant's destination. For each scan we store the time, the country and the device type (iPhone, Android or other). The country is derived from the IP address on our server; the IP address itself is neither stored nor shared.

To avoid counting repeated scans, we keep a shortened, irreversible hash of the IP address and browser identifier in memory for at most one minute. We set no cookies and do not track anyone across websites.

The purpose is anonymous scan statistics for the merchant; the legal basis is the merchant's legitimate interest in evaluating their marketing materials (Art. 6(1)(f) GDPR). After the scan, the privacy policy of the destination page applies. Static QR codes do not go through QReado, so no data reaches us.

Store customer data

QReado does not read orders or customer data from Shopify. Requests from a store's customers for access or deletion that Shopify forwards to us are answered accordingly: we hold no customer data.

Service providers

We use the following processors: Railway Corporation (running the app and database, data centre in Amsterdam, Netherlands) and Shopify (platform and plan billing). Where data is transferred to the USA, this is based on the European Commission's Standard Contractual Clauses.

Once a day the app checks whether the destinations of QR codes are still reachable by opening those addresses. No personal data is transmitted in the process.

Retention

A store's data is kept as long as QReado is installed. After uninstalling, we delete all of the store's data as soon as Shopify asks us to (usually after 48 hours). Scans belong to their QR code and are deleted with it; individual scans are also deleted after 25 months, only the total per code remains. For a deleted dynamic code we keep only its link ending and the store, so printed copies keep leading to the store's homepage – until the app is uninstalled.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. Write to us at support@qreado.com. You can also lodge a complaint with a data protection authority; in Switzerland this is the Federal Data Protection and Information Commissioner (FDPIC).