1. Who is responsible
Kunn AS (organisation number 937 941 463, Ekraveien 30, 0756 Oslo, Norway) is the controller for the personal data described in this policy: data about visitors to makeqr.ai, account holders and customers. Contact us about anything in this policy at hei@makeqr.ai.
For data about people who scan our customers' codes, the customer who owns the code is the controller and we process the data on their behalf. See section 4.
2. What we collect, why, and for how long
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Account: email address, password (stored only as a hash by our sign-in provider), and name and profile picture if you sign in with Google or Microsoft | To create and secure your account and let you sign in | Contract (GDPR art. 6(1)(b)) | Until you delete your account |
| Verification codes sent by email | To confirm that the email address is yours | Contract | Until used or expired |
| Your codes and pages: names, destinations, designs, menus, link pages and uploaded PDFs | To make your codes work and show your pages | Contract | Until you delete them or your account |
| Billing: plan, subscription status, Stripe customer reference, invoices. Card details are handled by Stripe only | To take payment and keep accounts | Contract; legal obligation (art. 6(1)(c)) | Invoices and payment records: five years, as Norwegian bookkeeping law requires |
| Emails with us: what you write and our replies | To help you | Legitimate interest in answering (art. 6(1)(f)) | Up to three years after the matter is closed |
| Error reports: browser, operating system, the page path (without anything after the ?) and what went wrong | To find and fix bugs | Legitimate interest in a working service | Up to 90 days |
| Request logs kept by our hosting provider: IP address, time, the address requested and browser type — for all requests, including scans | Security, preventing abuse, troubleshooting | Legitimate interest in a secure service | 30 days |
We check the links you save against Google's list of unsafe websites. Only the link is sent, not who you are.
We do not use your data for advertising, we do not build profiles, and we do not make decisions about you by automated means alone.
3. People who scan a code
When a dynamic code is scanned, we store the time of the scan, whether the device was an iPhone or iPad, an Android device, or something else, the operating system family and browser family (for example “iOS” and “Safari” — never the version or the full browser string), and the country. The country is looked up from the IP address while the scan is handled, using GeoLite2 data created by MaxMind (https://www.maxmind.com); the IP address itself is never stored. To count unique scanners per day, we keep a one-way hash of the IP address, browser type and code, mixed with a random value that is deleted when the day ends. After that, the hash cannot be recomputed by anyone, including us, so we cannot recognise the same person from one day to the next. We do not store the IP address, city, precise location or full browser details in our database, and we set no cookies on the redirect or on hosted pages.
Like any web server, our hosting provider logs each request — including the IP address — for 30 days, for security. We do not use these logs for statistics.
Once you are sent on to the destination, that website's own privacy policy applies.
4. When we act on behalf of our customers
Scan statistics, and the content of hosted pages, belong to the customer who owns the code. For this data, the customer is the controller and we are their processor under the data processing terms in section 8 of our Terms of Service.
If you scanned a code and have a question about your data, please contact the business or person behind the code. If you contact us, we will pass your request on to them.
6. Transfers outside the EEA
Where a provider processes data outside the EEA, the transfer is covered by the EU–US Data Privacy Framework if the provider is certified under it, or otherwise by the European Commission's Standard Contractual Clauses, with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.
7. How we protect it
- All traffic is encrypted with HTTPS.
- Passwords are never stored in readable form.
- Database rules limit every account to its own data, and anything that decides where a code goes, what it costs or whether it works is written only by our own servers.
- Uploaded PDFs are only served while the code they belong to is active.
- Access to production systems is limited to the people who need it.
If a breach puts your rights at risk, we will notify the Norwegian Data Protection Authority within 72 hours and tell you without undue delay.
8. Your rights
You have the right to:
- see the personal data we hold about you, and get a copy;
- have incorrect data corrected;
- have your data deleted;
- restrict or object to our processing, including processing based on legitimate interest;
- receive your data in a machine-readable format and have it moved to another provider;
- withdraw consent at any time, where we rely on consent.
Write to hei@makeqr.ai from the email address on your account. We reply within one month. Deleting your account also deletes your codes and pages, and your dynamic codes stop working.
You can also complain to the Norwegian Data Protection Authority, Datatilsynet, or to the data protection authority where you live or work. We would appreciate the chance to put things right first.
9. Children
MakeQR is not intended for children. You must be at least 16 to create an account. If we learn that a child under 16 has created one, we will delete it.
10. Changes
We update this policy when what we do changes. The date at the top shows the latest version. If a change significantly affects how we use your data, we will tell you by email before it takes effect.