Who we are
QRCode by saiberlab provides QR code creation, hosting and analytics. In this policy, “we” means QRCode by saiberlab and “you” means the person or organisation holding an account. Where you use QRCode by saiberlab to collect information about your own customers, you are the data controller for that information and we act as your processor.
What we collect about you
| Data | Why |
|---|---|
| Name and email address | To identify your account, sign you in and contact you about it |
| Password, hashed with argon2id | To authenticate you. We never store the password itself and cannot recover it |
| Workspace, code, campaign and page content you create | To provide the service |
| Billing details | Held by our payment processor, not by us. We store the plan, status and the last four digits of the card |
| Session and security records | To keep the account secure and show you where it is signed in. Includes IP address and browser for sign-in events, kept for 90 days |
What we collect when somebody scans your code
This is the part most QR platforms are vague about, so here it is in full. When a code is scanned we receive an HTTP request. From it we derive and store:
- The time of the scan.
- Country, and where the geolocation database reports it accurately enough, region and city. This is derived from the IP address in memory, on our own servers, against a local database. Where the provider's own accuracy radius is too wide to be honest about, the city is discarded rather than guessed at.
- Device category, operating system and browser, parsed from the user agent.
- The referring source, where the scanning app sends one.
- Whether the request looked like a bot.
- A visitor hash, so we can count returning scans without identifying anybody. It is an HMAC of the IP address, user agent and code identifier under a salt that is rotated daily and never written down. Once a day's salt is gone, that day's hashes cannot be recomputed or linked to the next day's.
What we deliberately do not do
- We do not store IP addresses of people who scan. The address is used to derive a country and a hash, in memory, and then discarded. It is never written to the database and never appears in logs.
- We do not set a cookie on a scan. A redirect is a redirect. There is no tracking pixel, no fingerprinting script and no third-party tag on the redirect path.
- We do not collect GPS location. Where a scan is reported as being near is inferred from network address, which is approximate and sometimes wrong. We never ask for or receive precise device location, and nothing in the product should be read as claiming otherwise.
- We do not send scan data to a third party. Geolocation happens against a database on our own servers, so no outside company sees your visitors' traffic.
- We do not sell data, and we do not use your content to train models.
Cookies on this site
We use a session cookie once you sign in, and a preference cookie to remember your chosen theme and workspace. Both are strictly necessary for the service to function, so there is no consent banner for them. We do not run advertising or cross-site tracking cookies. Scanning a QR code sets nothing.
How long we keep things
- Individual scan records: for the retention period of your plan, after which they are deleted. Aggregate daily counts are kept so your historical charts do not disappear.
- Account and content: for as long as your account exists.
- After you delete your account: 30 days, then permanent deletion. The delay exists so that an accidental or malicious deletion can be reversed.
- Audit and security logs: up to 2 years, because they are the record of who changed what.
- Billing records: as long as tax law requires, typically 7 years.
Who we share with
Only the providers needed to run the service: our hosting and database provider, our payment processor, our transactional email provider and our error-monitoring provider. Each is bound by a data processing agreement, and none of them receives your visitors' IP addresses from us. We will publish a current sub-processor list on request, and give notice before adding a new one.
We will disclose data if legally compelled. Where we are permitted to tell you that it has happened, we will.
Where your data lives
Data is stored in the European Union. Where a provider processes data elsewhere, that transfer is covered by Standard Contractual Clauses.
Your rights
You can access, correct, export or delete your data. Export and deletion are both available from your account settings without having to ask us — export produces a machine-readable file of your workspaces, codes and analytics. You can also object to processing, ask us to restrict it, and complain to your local data protection authority.
Security
Passwords are hashed with argon2id. Sensitive fields, including two-factor secrets and integration credentials, are encrypted at rest with AES-256-GCM. Every request for workspace data is authorised on the server against your role; hiding a button is never the only thing standing between someone and data they should not see. Two-factor authentication is available on every account and can be required across a workspace.
If we discover a breach affecting your data, we will notify you and the relevant authority within the periods the law requires.
Children
QRCode by saiberlab is not intended for children under 16, and we do not knowingly collect their data.
Changes
If we change this policy materially we will email account holders before it takes effect. The date at the top always reflects the last substantive change.
Contact
Write to us at privacy@saiberlab.com. If you need a data processing agreement for your own compliance, see the DPA. Our terms of service cover the commercial side.