Privacy policy

qrpage.co is built for minimum data collection. This page explains what we store, why, and for how long.

Last updated: 9 October 2026

For visitors of a mini website

When you open a mini website someone published on qrpage.co (for example after scanning a QR code), qrpage.co is the technical provider. The controller for that processing is:

• Visit. We store that the mini website was opened: a shortened hash of the IP address the application receives (not the address in clear text), the referrer if the browser sends one (at most 512 characters), and the time. The same address counts only once within 60 seconds. We read the user agent to leave obvious bots out of the count, and we do not store it. Clicks on the footer, on contact, and on links can be stored the same way.
• Fathom and Ahrefs. Every published mini website loads Fathom Analytics and Ahrefs Analytics. What those two services store is described in their own notices: Fathom, Ahrefs.
• Photos. Only the person who publishes the mini website uploads photos. Someone who visits it does not upload photos. On qrpage.co the files are stored at Amazon S3 and served from https://qrpage.s3.eu-central-1.amazonaws.com. They are publicly readable at that address.
• Map and type. If the mini website shows a map, the browser loads Leaflet from unpkg.com and map tiles from tile.openstreetmap.org. That sends the IP address to the OpenStreetMap Foundation. The typeface is loaded from fonts.googleapis.com.

The legal bases are in section 3. Your rights and the supervisory authority are in sections 8 and 9. Details in a legal notice on the mini website were entered by the person who published it.

1. Data controller

A Data Protection Officer is not legally required for us: we do not regularly employ more than 20 people on automated personal-data processing, nor do we carry out processing that would require a data protection impact assessment.

2. What we process

• Email address — when you publish a mini website, we store the address so we can email you the confirmation, edit and delete links, and so we can contact you about the product (for example feedback or relevant changes). There are no accounts and no passwords.
• Campaign parameters — if you arrive from an ad (UTM tags and, when present, a Google click id) and start a mini website, we store those parameters on that page so we can tell which campaigns lead to publishes. Organic and direct visits stay empty.
• Mini-website content — text, photos, location info you enter yourself. Published at its short address (qrpage.co/…).
• Location data — an address you type is sent to the Photon geocoder (see below) so we can resolve it to coordinates and show a map.
• IP address + user agent — processed transiently by Cloudflare and by our platform for delivery, abuse protection, and rate limiting (kept in logs for at most 7 days).
• View counter — per mini website we count views without cookies; we store the IP address only as a truncated hash, so the creator can see how many people scanned the QR.
• Waitlist signups — if you join the waitlist, we store your email and the templates you ticked, until you unsubscribe or we have notified you that the last template is live.
• Error reports — when a technical error occurs, we send an error report to Sentry (see below). It contains the error message, the place in our code where it happened, the address that was requested (possibly including a mini website's short link), the browser identifier (user agent) and the last technical steps before the error. We remove IP addresses, cookies, email addresses and the confirmation, edit and delete links before the report is sent. We do not send content you enter; in rare cases part of it can appear in the error message itself, for example an address you typed.

3. Legal bases

• Art. 6(1)(b) GDPR — contract performance (providing the service, sending confirmation, edit and delete links, storing your mini website).
• Art. 6(1)(f) GDPR — legitimate interest in security, abuse prevention, rate limiting, error tracking, aggregate cookieless analytics, measuring which campaigns lead to publishes, and contacting publishers about the product they already use.
• Art. 6(1)(a) GDPR — consent, when you actively join the waitlist.

4. Cookies

qrpage.co does not set any tracking cookies of its own, and does not load any consent-requiring third-party cookies. No cookie banner is therefore required under § 25 TDDDG (Germany's implementation of the ePrivacy Directive).

Cloudflare may set a strictly necessary cookie (__cf_bm) for bot detection. That cookie serves only security and service functionality and is exempt from consent under § 25(2)(2) TDDDG.

5. Recipients / processors

We use the following processors, with Data Processing Agreements (DPAs) and EU Standard Contractual Clauses (SCCs) in place where applicable:

• DigitalOcean (application hosting, EU region Frankfurt). Privacy policy
• Cloudflare, Inc. (CDN, WAF, DDoS protection). Processes IP addresses transiently for delivery and security. Privacy policy
• Amazon Web Services (AWS S3) (photo storage). Bucket region: EU. Privacy policy
• Twilio SendGrid (transactional email: confirmation, edit and delete links). Privacy policy
• Photon (Komoot GmbH) — address autocomplete and geocoding. The search string you type is sent to Photon. About Photon
• OpenStreetMap Foundation — map tiles for the map preview on a mini website. Loading the tiles transmits the visitor's IP address to OSM. Privacy policy
• Fathom Analytics — cookieless, privacy-friendly traffic measurement. No cookies, no personal profiling. Privacy / compliance
• Ahrefs Analytics — cookieless SEO analytics (complementary to Fathom). No cookies. Privacy policy
• Sentry (Functional Software, Inc.) (error tracking, US region). Receives technical error reports; we remove IP addresses, cookies and email addresses first. Sentry is certified under the EU–U.S. Data Privacy Framework. Privacy policy

6. International data transfers

Some processors listed above (Cloudflare, AWS, SendGrid, Fathom, Ahrefs, Sentry) may process data in the United States. We rely on the EU Standard Contractual Clauses and, where applicable, the European Commission's adequacy decision under the EU–U.S. Data Privacy Framework.

7. Retention

• Mini websites: kept while published. Deleting one via its delete link removes the content and all associated photos immediately.
• Email address: stored in clear text for as long as the mini website exists, so we can send confirmation, edit and delete links and contact you about the product. We also keep a hashed value of it for spam and abuse prevention (rate limiting). Deleting the mini website removes the clear-text address immediately; the hash may remain so the 24-hour publish cap still works. Mini websites published before 18 September 2026 may have no recoverable address, because we previously stored only the hash.
• Server and security logs: at most 7 days.
• Waitlist: until you unsubscribe, or until we have shipped every template you ticked (then deleted).
• Error reports: at most 90 days at Sentry.

8. Your rights

Under the GDPR you have, in particular, the following rights:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR) — every mini website is self-deletable from the link in the confirmation email
• Right to restriction (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent (Art. 7(3) GDPR)

To exercise these rights, email us at hi@qrpage.co.

9. Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority. Our lead authority is:

10. Security

Traffic is encrypted with TLS. We apply security updates promptly, run regular backups, and restrict internal access to personal data.

11. Changes to this policy

If we make material changes, we will update the date above and, where relevant, notify users in the app.