Privacy Policy

For qrcandy.co, accounts, orders, support, the partner programme, and QRCandy's own service security, the following company is the data controller:

Privacy questions and rights requests go to privacy@qrcandy.co with the subject Privacy Request.

Data comes from you, people acting for your organisation, a scanner's browser or device, QRCandy customers and partners, payment and delivery providers, our hosting and security systems, and public websites or brand sources when you use discovery.

The table states our purposes and GDPR Article 6 legal bases when QRCandy acts as controller. If you act for a company, contract performance may be the company's contract rather than a contract with you personally; in that case we normally rely on our and the company's legitimate interests in administering that relationship.

Our legitimate interests include operating and improving a secure storefront, fulfilling business orders, preventing fraud and abuse, keeping accurate campaign counts, supporting customers, and managing partner relationships. We balance those interests against the person's rights, minimise the data, and provide a right to object. Where we rely on consent, it can be withdrawn without affecting earlier lawful processing.

Required checkout fields are needed to form, pay for, or deliver the order. Without them we cannot complete that transaction. Optional fields are labelled or can be omitted. We do not use personal data for third-party advertising and do not make solely automated decisions about people that produce legal or similarly significant effects. AI-assisted brand suggestions are optional and remain for you to review.

For each accepted scan request, the application may record:

• timestamp, QR campaign/batch, destination, and resolved URL;
• HTTP user-agent and derived device/browser information;
• referring URL, if the scanner's app or browser supplies one;
• a two-letter country code supplied by hosting/CDN infrastructure; and
• a SHA-256 fingerprint made from the QR slug, request IP address, and user-agent to avoid counting immediate repeats as separate scans.

The application processes the request IP address transiently to route, secure, rate-limit, geolocate at country level, and build the fingerprint. It does not write the raw IP address into the QRCandy scan-event table. Hosting, CDN, or security logs may process IP addresses under their configured log-retention controls. A hash is pseudonymous personal data, not anonymous data.

The fingerprint is used for a five-minute deduplication window and is automatically removed from the event row after seven days. The remaining scan-event row is automatically deleted after 24 months. The relevant customer can see its campaign analytics; authorised QRCandy staff may access data only for support, security, compliance, or service operation.

As processor, QRCandy relies on the customer's documented instructions and the customer must identify its own legal basis. As independent controller for abuse prevention, count integrity, and QR infrastructure security, QRCandy relies on legitimate interests. You may object to that controller processing as explained in Section 8.

We do not sell personal data. We disclose only the data needed for the relevant service. A provider's privacy role depends on the service: some process data for QRCandy, while others—especially payment providers and carriers—also act as independent controllers for their own legal, security, and operational purposes.

We may also disclose data to professional advisers, insurers, auditors, authorities, courts, or law enforcement where necessary and lawful; to protect people, rights, and the Service; or in a merger, financing, reorganisation, or sale subject to confidentiality and continuity of privacy protection.

Providers may process data in Sweden, elsewhere in the EEA, or in countries outside the EEA. The location depends on the selected service, hosting region, support path, and the provider's own infrastructure. We do not describe every provider as “US-based” because their contracting entities and processing locations differ.

Where personal data is transferred outside the EEA, the transfer must be covered by an available mechanism under GDPR Chapter V. Depending on the provider and transfer, that may be a European Commission adequacy decision (including the EU-US Data Privacy Framework where applicable) or Standard Contractual Clauses, together with supplementary measures where appropriate. Processor transfer obligations also appear in Section 11 of the Terms.

Email privacy@qrcandy.co to ask about the mechanism relevant to your data or for a copy of applicable safeguards, subject to protection of confidential and security information.

We keep identifiable data only while needed for the purpose, an active relationship, legal obligations, or a genuine claim or security need. The current application uses these periods or criteria:

We may retain data longer if law requires it, a legal hold applies, or it is needed for a live complaint, chargeback, fraud investigation, or claim. When the exception ends, the ordinary period resumes. Anonymous aggregate statistics that no longer relate to a person may be kept.

Depending on the processing and applicable exceptions, GDPR gives you the following rights:

Send a request to privacy@qrcandy.co with enough information for us to locate the data. We may verify identity and authority before disclosing or changing data. We normally respond within one month. For a complex request or several requests, GDPR allows up to two additional months and we will explain the extension within the first month. Requests are normally free; a reasonable fee or refusal is permitted only where the law allows, such as manifestly unfounded or excessive requests.

For Scan Data controlled by a QRCandy customer, contact the brand/customer shown on the product or destination first. QRCandy will assist that controller and will also handle any part for which QRCandy is controller. Rights are not absolute: for example, erasure does not override accounting retention or the establishment, exercise, or defence of legal claims.

Cookies and local storage both save or read information on your device and are subject to Swedish electronic-communications rules as well as GDPR when personal data is involved. QRCandy currently uses no third-party advertising, retargeting, or cross-site behavioural tracking on qrcandy.co.

For a secure, reliable storefront we use cookieless website analytics (Cloudflare Web Analytics) and error monitoring (Sentry). In their current QRCandy configurations they set no cookies, are not configured to store information on your device, and are not used for advertising or cross-site behavioural tracking. They process limited technical request data—including a transient IP address handled by the provider—to measure aggregate traffic and performance and to detect faults. We rely on our legitimate interest in operating a secure, working Service (Art. 6(1)(f)). If we add a technology that stores or reads non-essential information on your device, we will request consent before using it where the law requires.

Functional storage is used to provide a feature you request, such as login, cart, checkout, language, currency, or an applied referral code. A referral link asks the browser to remember that code so it can follow you to checkout; the cart shows the code and lets you remove it. You can also clear site data in your browser, but doing so signs you out and removes saved carts, drafts, preferences, and referral codes.

Stripe may use cookies or similar technologies on its separately hosted payment pages for checkout, fraud prevention, security, and performance under Stripe's own notices. Those technologies are controlled on Stripe's domain, not qrcandy.co.

We use measures proportionate to the nature and risk of the data, including HTTPS, hosted payment entry, hashed authentication credentials, role-based and row-level database access, separation of public and privileged server credentials, input and destination validation, rate limiting, short-lived deduplication identifiers, retention jobs, and restricted administrative access.

No online service can guarantee absolute security. Tell us immediately at privacy@qrcandy.co if you suspect account compromise, an unsafe QR destination, or an unauthorised disclosure. We assess incidents and notify affected controllers, people, and authorities when the law requires.

Accounts, ordering, and the partner programme are intended for people aged 18 or older acting for themselves or an organisation. We do not knowingly create accounts for children or ask QR scanners for age, name, or contact details.

A child may nevertheless scan candy distributed by a customer. The passive request metadata described in Section 4 may then be processed. Customers must consider the likely audience, avoid unlawful targeting, and provide age-appropriate notices where required. Contact us if you believe a child's data needs review or deletion.

We update this policy when practices, providers, products, or law materially change. The effective date and version at the top identify the current text. Material changes will be brought to registered users' attention by email, dashboard notice, or another appropriate method before or when they take effect, depending on the nature and legal basis of the change.

We will seek fresh consent if a change requires it. An earlier version continues to describe processing that occurred while it applied; changing this notice does not create a new legal basis retroactively.

For privacy questions, objections, or rights requests, contact:

You can lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), particularly if you live or work in Sweden or believe the processing occurred here. You may also contact the competent supervisory authority in another EEA country where applicable.

You do not have to contact us before complaining, though we welcome the opportunity to resolve the concern. Our Terms of Sale and Service govern accounts, orders, QR services, and the processor relationship with customers.