Privacy Policy

The data controller is Khaled Mossab Matar, sole trader, trading as myqrpal, Romania (European Union).

For any privacy question or request, write to myqrpal@gmail.com. We respond within one month.

Account data: your email address and, if you set one, your name. We need this to give you an account and to contact you about the service.

Content: the codes you create, their destinations, titles, designs and any logo you upload.

Billing data: handled by Paddle.com Market Ltd, our Merchant of Record. Paddle collects your name, email, billing address, country and payment details directly at checkout in order to process the order, calculate tax and issue your invoice. We receive only your subscription status, order reference and country for tax purposes; we never see or store your card details.

For each scan of a dynamic code we store the time, the country, the device type and the operating system family, derived from the request.

We do not store the full IP address. It is hashed with a rotating secret and used only for abuse detection and de-duplication, then discarded.

We do not set cookies on the redirect and we do not build profiles of the people who scan your codes.

We use a single strictly necessary cookie to keep you signed in. We do not use advertising or third-party tracking cookies.

Contract: to give you the account and the codes you asked for.

Legitimate interest: to keep the service secure, prevent abuse and produce aggregated scan statistics for the owner of the code.

Legal obligation: to keep the records tax law requires.

We share personal data with a small number of recipients: our hosting and database provider, our email sender, and Paddle.com Market Ltd (Paddle.com, Judd House, 18-29 Mora Street, London EC1V 8BT, United Kingdom) for payments, tax and invoicing. They act on our instructions or, in Paddle's case, as an independent controller for the sale, and are bound by data processing agreements.

We never sell personal data.

Our order process is conducted by our online reseller Paddle.com. Paddle.com Market Ltd is the Merchant of Record for all our orders. Paddle provides all customer service inquiries and handles returns.

When you buy Pro, your order and payment data - name, email address, billing address, country, tax identifiers where relevant and payment method details - are collected and processed by Paddle as a separate data controller for the purposes of taking payment, fraud prevention, tax compliance and invoicing. Paddle's privacy policy is available at https://www.paddle.com/legal/privacy and its buyer terms at https://www.paddle.com/legal/checkout-buyer-terms.

Paddle shares back with us only what we need to run your subscription: your email address, order and subscription reference, plan, status and country. The legal bases are performance of our contract with you and our legal obligation to keep tax records.

Account data is kept while your account exists. Scan records are kept for as long as the code exists so you can see its history; free accounts can view the last 30 days.

Invoices and payment records are kept for as long as tax law requires (normally 10 years).

When you delete your account, we delete your codes, uploads and scan records within 30 days. Static codes you already printed continue to work because they never depended on us.

You can request access, correction, deletion, restriction, portability, or object to processing based on legitimate interest. Write to myqrpal@gmail.com and we will respond within one month.

You also have the right to lodge a complaint with your local data protection authority. In Romania this is ANSPDCP (www.dataprotection.ro).

Our infrastructure is hosted in the European Union. Where a processor operates outside the EU, the transfer is covered by the European Commission's standard contractual clauses.