Last updated: October 11, 2026
Controller: Muhammad Haroon Subhani Shaheen, Magallanes Kalea 37, Barakaldo, Bizcaya, VAT ID 61181103E. Contact: team@qrflick.com.
What we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Account: name, email, password (hashed), language, time zone | Run your account | Contract |
| Content you create: codes, destinations, cards, uploads | Provide the service | Contract |
| Billing: plan, invoices, company name and VAT ID (card details stay with Stripe) | Take payment, issue invoices | Contract, legal obligation |
| Security logs: sign-ins, changes, a shortened IP network | Keep accounts and links safe | Legitimate interest |
| Scans of your codes: time, approximate country/city, device type, language; IP addresses are hashed with a daily-rotating key and never stored in full | Show you analytics | Legitimate interest |
| Leads your business card collects (name, email, phone, message) | Deliver them to you; you're the controller of that data and we process it for you | Contract (processor) |
| A photo of a paper business card, if you use the card scanner (and the contact details printed on it) | Read by Anthropic's Claude to fill in a contact; sent once, not stored by us. Only scan cards you may lawfully process | Your request (contract) |
| Details on a Wallet pass, if you add your card to Apple or Google Wallet | Create the pass you asked for | Your request (contract) |
Who we share it with
Only providers that help us run QRflick, under data-processing agreements: hosting and database (EU), Cloudflare (network and security), Stripe (payments), Anthropic (reading card-scanner photos, only when you use that feature), Apple and Google (Wallet passes, only when you add one), our email provider, Sentry (error reports, without personal content) and MaxMind (country lookup, done on our servers). Some may process data outside the EU under the European Commission's standard contractual clauses. We never sell your data.
How long we keep it
Account data: while your account exists. Raw scan records: 13 months, then only daily totals. Security logs: 12 months. Invoices: as long as tax law requires. When you delete your account, your content is deleted at once and backups roll over within 30 days.
Your rights
You can access, correct, export (Settings → Privacy & data → Download my data), delete (Settings → Privacy & data), restrict or object to processing. Write to team@qrflick.com. If you're unhappy with our answer you can complain to the Spanish Data Protection Agency (aepd.es) or your local authority.
Security
Encrypted connections everywhere, hashed passwords, optional two-factor sign-in (required for our staff), encrypted secrets and regular restore-tested backups.
