1. Data controller
This privacy notice has been prepared by QRandQR.com as data controller under the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and related legislation. Contact: [email protected].
2. What data do we process?
When using without an account
- The content you write into a QR code (link, Wi-Fi details, business card, etc.) is processed momentarily only to generate the preview and download file; it's not saved to the database.
- The logo you upload is stored on the server so the preview works. Logos not linked to any saved QR code are deleted regularly.
- If you press “Save” without signing in, the form content is temporarily kept in a signed session cookie so the code can be added to your account after you sign in.
When you're a member
- Identity and contact: your email address and (if you provide it) your name.
- Sign-in details: your password is stored only as an irreversible hash; we can't see it in plain text. If you sign in with Google or Apple, the account ID and email address that provider gives you; and your name if you share it on your first Apple sign-in.
- Content you create: the QR codes you save (title, content, design), digital menus (items, prices, photos), links and content pages. Personal data you add to this content (e.g. the phone number on a business card) is also covered. Link passwords are stored only as hashes.
- Usage data: the total number of visits to your dynamic codes. This counter is just a number; it doesn't record visitors' IP addresses, devices or locations.
Technical data
- On password-protected pages, to prevent brute-force attempts, the IP address of failed attempts is kept in server memory for at most 10 minutes; it isn't stored permanently.
- Our hosting infrastructure may keep standard server logs such as IP address, browser information and request time for a limited period for security and debugging purposes.
- Only if you consent: aggregate usage statistics via Google Analytics, such as the pages you visit, session duration, approximate location (country/city), and device and browser type.
3. Purposes and legal grounds
| Purpose | Legal ground (KVKK Art. 5) |
|---|---|
| Creating your account, letting you sign in, storing your codes and content and showing them to you | Formation and performance of a contract |
| Publishing dynamic codes and digital menus, showing visit counts | Performance of a contract |
| Keeping the Service secure, preventing abuse and fraud | Legitimate interest |
| Fulfilling legal obligations, responding to requests from competent authorities | Legal obligation |
| Measuring and improving how the site is used (Google Analytics) | Explicit consent |
We don't use your data for advertising, don't build profiles and don't sell it to third parties. Apart from mandatory service notices (e.g. account security), we don't send emails without permission.
5. Retention periods
- Your account information and content are kept until you delete your account. When you delete your account, this data is removed from the database immediately.
- Menus and links you delete are kept in the trash for 90 days, then permanently deleted.
- Logos and photos not linked to any saved content are deleted regularly.
- Copies remaining in backups are deleted automatically when the backup cycle completes.
7. Security
We take reasonable technical and administrative measures to protect your data: passwords and link passwords are stored hashed, forms are protected against CSRF attacks, sessions on other devices are invalidated when the password changes, repeated wrong attempts on protected pages are blocked and short addresses are generated randomly so they can't be guessed. Still, no transmission over the internet can be guaranteed to be completely secure.
8. Your rights
Under Article 11 of the KVKK, you have the right to learn whether your personal data is processed; to request information if it has been; to learn the purpose of processing and whether it's used in line with that purpose; to know the third parties it's transferred to; to request correction if it's incomplete or inaccurate; to request its deletion or destruction under the conditions in the KVKK; to request that these actions be notified to third parties it was transferred to; to object to an outcome against you resulting from analysis exclusively by automated systems; and to claim compensation if you suffer damage due to unlawful processing.
You can exercise most of these rights directly: correct your details in Account settings, and delete your content and your account yourself. For other requests, you can write to [email protected]; we'll respond free of charge within 30 days at the latest.
If you live in the European Economic Area, you also have rights under the GDPR (access, rectification, erasure, portability, objection).
9. Changes
We may update this policy from time to time. The current text is always published on this page and the “Last updated” date changes. We announce important changes on the site or by email.
Write to us with any questions or requests about this notice: [email protected]