Privacy Policy for QRGeno by Paperphyte AB
Last updated: 2026-10-22
1. Introduction and responsibility for the processing of your personal data
Paperphyte AB ("the Company", "we", "us") is committed to protecting your personal data and strives to ensure a high level of data protection in accordance with applicable data protection legislation, including Regulation (EU) 2016/679 of the European Parliament and of the Council ("GDPR"). This privacy policy describes how we collect, process, store and protect personal data in connection with the use of our services. We may update this privacy policy at any time, for example when we change our services or our sub-processors, or when the law requires it. The current version, with its date of last update, is always published at qrgeno.com. Material changes are communicated by email or in the dashboard before they take effect.
2. Parties and responsibility for the processing of your personal data
Paperphyte AB acts in two different roles under the GDPR, depending on whose personal data is being processed and for whose purposes. Data controller. The Company is the data controller for the personal data it processes for its own purposes: the Customer's administrators (account, billing and support data), visitors to our public website (including web analytics where you have consented), people who use the contact form, security logs, and service and product development, as described in Sections 3.1 and 3.3 to 3.7. For this processing the Company decides the purposes and means and is responsible for ensuring that it complies with applicable legislation and that your rights as a data subject are upheld. Data processor. When a Customer uses the Services, the Company processes personal data on the Customer's behalf and on the Customer's documented instructions. This is the Customer's Data: scan data and the pseudonymous visitor identifier recorded when someone scans the Customer's dynamic QR codes, gate submissions (email address, or the fact of password entry), voucher recipient details, and shipping details for printed materials (see Sections 3.2 and 7). For this data the Customer is the data controller and the Company is its data processor under the Data Processing Agreement that forms part of our General Terms and Conditions (Appendices 1 to 4). If you have scanned a Customer's QR code, completed a gate on it or received a voucher from a Customer, that Customer is responsible towards you for the processing and is your first point of contact; the Company assists the Customer in responding to your requests. In both roles the Company engages suppliers that process personal data on its behalf (processors, or sub-processors in relation to the Customer). They are bound by data processing agreements and are listed in Section 6.
3. What categories of personal data do we process, for what purpose, storage period and on what legal basis?
The Company processes personal data such as contact details (name, email address), administrator account information (company name, organisation number, VAT registration number), technical information (the user-agent string as sent by the browser, which reveals browser, operating system and device type, together with the device category derived from it, the browser's language setting, the referrer, and a pseudonymous visitor identifier derived from the IP address; the IP address itself is stored only where the Customer has switched on visitor-IP storage for a specific QR code), geographic information derived from the IP address (country, city and region; city and region are shown to the Customer only on paid plans; the lookup is performed locally on our servers using the embedded MaxMind GeoLite2 database — no IP address is transmitted to MaxMind), payment data processed via Mollie, shipping data for printed materials (where the Customer has placed a print order through the Services), submission data captured by gate rules (email address, or the fact of password entry) where the Customer has configured such rules on their QR code, voucher recipient details (name and email address) provided by the Customer when issuing vouchers to its own customers or employees through the Services, contact-form messages (email address where provided, and message content) processed via Mailgun, and other user data linked to our services. Personal data is only stored for as long as necessary to fulfil the purposes for which the data was collected, or for as long as required by applicable law or regulatory decision, including the Swedish Accounting Act (Bokföringslagen 1999:1078).
3.1 Managing orders and purchases of services
Purpose: To enable the management of orders, invoicing and payment. Categories of personal data: Name, contact details, payment information. Legal basis: Performance of a contract. Storage period: The data is stored for the duration of the contract and thereafter for up to seven (7) years in accordance with applicable accounting legislation.
3.2 Provision of services
Purpose: To deliver and administer the Company's services, including the distribution of voucher emails to recipients designated by the Customer. Categories of personal data: Account details, user data, scan analytics (impressions), voucher recipient details (name, email address). Legal basis: Performance of a contract (account details). Scan analytics, gate submissions and voucher recipient details are processed on the Customer's behalf as data processor (see Section 2); the legal basis for that processing is the Customer's to establish. Storage period: Account data is retained for the duration of the contract and up to twelve (12) months after termination, unless longer storage is required by law or to establish, exercise or defend legal claims. Scan analytics (impressions), gate-submission data and voucher recipient details are retained for as long as the Customer uses the Services; when the Customer's agreement ends they are deleted or returned in accordance with the Data Processing Agreement, within twelve (12) months unless the Customer instructs earlier deletion (see Section 7). Customers may request erasure of this data at any time via our contact form. Self-service erasure from the dashboard is limited to switching off IP storage for a QR code, which deletes the IP addresses stored for that code.
3.3 Storage of customer data after termination of contract
Purpose: To fulfil legal obligations and enable restoration of services. Categories of personal data: Customer data, user-generated content. Legal basis: Legal obligation and legitimate interest. Storage period: Up to twelve (12) months after termination of the contract, unless otherwise required by law or specific agreements.
3.4 Security purposes
Purpose: To prevent, detect and investigate security incidents. Categories of personal data: Log data, IP address. Legal basis: Legitimate interest. Storage period: Logs are normally retained for up to twelve (12) months, unless longer retention is required to investigate security incidents.
3.5 Service and product development
Purpose: To analyse usage and improve services. Categories of personal data: Usage data, technical information. Legal basis: Legitimate interest. Storage period: Data is processed in anonymised or aggregated form where possible and stored for up to twenty-four (24) months.
3.6 Marketing
Purpose: Where the Customer has explicitly opted in, to communicate product news, updates and offers from Paperphyte AB. Categories of personal data: Contact details (name, email address). Legal basis: Consent or, in the case of existing customers, legitimate interest with a clear opt-out in every message. Storage period: Data is processed until consent is withdrawn or an objection to the processing is received. Note on current practice: at the time of writing, the Company does not employ third-party marketing or advertising trackers and does not run behavioural marketing campaigns. If we adopt such tools, we will update this policy and obtain the necessary consent before any non-essential third-party tracking is enabled.
3.7 Newsletter and communications
Purpose: To send product newsletters and other product communications, where you have explicitly subscribed. Categories of personal data: Email address (and, where provided, name). Legal basis: Consent. Storage period: Data is processed until consent is withdrawn. Note: at the time of writing, the platform does not host a public newsletter signup. This section will become operative once such a channel is launched.
4. Collection of your personal data
Personal data is collected directly from you when you register an account, use the dashboard, contact us or visit our public website, including through cookies and similar technologies as described in our cookie policy. Personal data that the Company processes as data processor reaches us through the Customer's use of the Services rather than from you directly: it is recorded automatically when you scan a Customer's dynamic QR code or complete a gate on it (see Section 7), or it is provided by the Customer, for example the name and email address of voucher recipients or shipping details for printed materials. In all of these cases the data is processed on the Customer's behalf and on the Customer's instructions.
5. What happens if you choose not to provide us with your personal data?
If you choose not to provide necessary personal data, the Company may be prevented from entering into an agreement with you or from providing some or all of its services.
6. With whom do we share your personal data?
The Company shares personal data only with the data processors necessary to operate the Services, all bound by Article 28 GDPR data processing agreements. Our current sub-processors are: • Amazon Web Services (AWS) — Infrastructure, application hosting, database and file storage (eu-north-1, Stockholm). Stored data, backups and server logs remain in that region. Requests to our API and scans of dynamic QR codes are terminated at AWS CloudFront edge locations in Europe, North America and Israel before being forwarded to Stockholm; no access logs are kept at the edge • Auth0 (Okta group) — Authentication and identity (EU region: Germany, with failover in Ireland) • Mollie B.V. — Payment processing (Netherlands) • Cloudprinter.com B.V. — Print production and fulfilment for printed materials ordered through the Services (Barendrecht, Netherlands). Cloudprinter routes each order to a print partner in or near the delivery country, which receives the delivery name and address and the print file. For deliveries outside the EU/EEA, the delivery details are therefore transferred to the destination country • Sanity.io — Content delivery for marketing pages, legal pages and the product catalog (EU region, Belgium); images are served from Sanity's global CDN • Mailgun (Sinch Email) — Transactional email for account messages, the contact form and voucher emails sent to recipients designated by the Customer (recipient name and email address; Mailgun EU region) • Vercel Inc. — Hosting and global edge delivery for the public website and web app. Pages are served from the edge location nearest to the visitor; request metadata (IP address, requested URL, browser type) is processed by Vercel in the United States for routing, caching, security and DDoS protection, under Standard Contractual Clauses and Vercel's certification under the EU-U.S. Data Privacy Framework. Account data, QR codes and scan data are not stored on Vercel • InnoCraft Ltd — Provides Matomo Cloud web analytics for the public website, hosted on servers in Germany (EU). InnoCraft is incorporated in New Zealand, which is covered by a European Commission adequacy decision. Used only with the visitor's consent; processes anonymised IP address, pages viewed, referrer and device/browser type • MapTiler AG — Map tiles shown on the landing page of location (geo) QR codes and in the QR builder's map picker. The visitor's browser fetches the tiles directly, which transmits the IP address and User-Agent to MapTiler (Switzerland, covered by an adequacy decision; personal data processed in France and Ireland). No cookies are set and no scan data is shared • OpenStreetMap Foundation — Map tiles loaded by the visitor's browser in the same way as above (tile servers in the United Kingdom and the EU), and the Nominatim geocoding service: when a Customer creates a geofence rule, the address the Customer enters is sent from our server to Nominatim to be converted into coordinates. Only the address text is sent, no account or scan data. The Foundation is incorporated in the United Kingdom, which is covered by a European Commission adequacy decision Typography on the website and on the login page is served from our own domain, so no requests are made to Google Fonts. Geolocation from IP addresses uses a database stored on our own servers; no data is sent to its provider (MaxMind). When a Customer enters a VAT number we verify it against the European Commission's VIES service (EU) and store the result, including the registered trader name. We use Matomo (Matomo Cloud, provided by InnoCraft Ltd) for privacy-friendly web analytics on our public website, loaded only after the visitor has given consent (Article 6.1(a) GDPR) and never on the pages linked to dynamic QR codes. The visitor can withdraw or renew consent at any time via the "Manage cookies" control in the website footer. We do not use Google Analytics and do not share personal data with advertising platforms (such as Google Ads, Facebook Ads or LinkedIn Ads). If this changes we will update this policy and obtain consent where required. Beyond the above, the Company may share data with banks, auditors, tax authorities, or other authorities where required by law.
7. Use of tracking technology and profiling
When using the Company's services, including dynamic QR codes, certain technical information may be collected automatically. When a visitor follows the redirect for a dynamic QR code, the following information is recorded and linked to the visit (impression): • A pseudonymous visitor identifier: a keyed hash (HMAC) of the visitor's IP address and the account that owns the QR code. It lets the Customer see unique scans and lets us enforce per-visitor scan limits, gate rate limits and password lockouts without keeping the IP address itself • Geographic location derived from the IP address: country, city and region. City and region are shown to the Customer only on paid plans, but are recorded for every code • The user-agent string as sent by the browser, unchanged. It reveals browser, operating system and device type; we also derive a device category (mobile, tablet, desktop) from it • The browser's language setting (the Accept-Language header) • Referrer (where supplied by the browser) • Timestamp of the scan, whether the scan was blocked by a rule and, if so, by which rule type, and which content variant was shown • IP address — only where the QR code's owner has switched on "Store visitor IP addresses" for that specific QR code (Advanced → Tracking Preferences). The setting is off by default for every code, including codes created before the setting existed With IP storage off, which is the default, the visitor's IP address is used during the scan to derive the geographic information above, to compute the visitor identifier and to evaluate the rules configured on the code, and is then discarded. It is not written to the impression. The visitor identifier is pseudonymised data, not anonymous data: it is computed with a secret key held by the Company and is scoped to the account that owns the QR code, so it cannot be traced back to an IP address or matched across accounts without that key. It is retained for as long as the impression it belongs to. If the owner of a QR code later switches IP storage off, the IP addresses already stored for that code's impressions and gate submissions are deleted at the same time as the setting is saved. The visitor identifier is kept so that unique-scan counts and limits remain consistent. Where the QR code's owner has explicitly enabled precise-geo capture for that specific QR (an opt-in setting per QR), the visitor's browser is also asked for GPS coordinates (latitude, longitude, accuracy radius). The visitor sees the standard browser permission prompt and may decline; declining does not block the redirect. Where the Customer has configured an email-gate or password-gate rule on a QR, the email address (or the fact of password entry) submitted by the visitor before the redirect is recorded as a gate submission, together with the same visitor identifier, country, user-agent and — under the same per-code setting as above — IP address. The Customer may export this submission data on the Enterprise plan. Roles and legal basis: this information is stored as part of the impression and made available to the Customer who owns the QR code, so that it can see when, from where and with which device the code was scanned. For this processing the Customer is the data controller and the Company is its data processor (see Section 2). The Company processes the data only to provide the Services to the Customer and on the Customer's instructions, and does not use it for its own purposes beyond aggregated statistics that do not identify any visitor. The Customer is responsible for having a legal basis for the processing and for informing the people who scan its codes, for example in its own privacy notice. If you have questions about how the scan data of a particular QR code is used, or want to exercise your rights regarding it, please turn to the business that published the code; the Company assists that Customer in responding. No tracking cookies are set on the QR redirect itself. On our public website and in the dashboard we also derive your country from your IP address, using the same local lookup, to pre-select the interface language and, when you request a quote for printed materials, the default shipping country and price. The IP address is not stored for these purposes. Here the Company is the data controller, on the basis of legitimate interest (Article 6.1(f) GDPR). Other technical information (server logs, error reports) is used for analysis, security and service improvement, on the basis of legitimate interest, with the Company as data controller (see Section 3.4). Storage period — impression and gate-submission data: retained for as long as the Customer uses the Services, unless the Customer requests earlier erasure. IP addresses stored under the per-code setting are deleted when the Customer switches the setting off for that code. When the Customer's agreement with the Company ends, the Customer's scan and gate-submission data is deleted or returned in accordance with the Data Processing Agreement (Appendix 1 to our General Terms and Conditions): unless the Customer instructs earlier deletion, within twelve (12) months after the agreement ends, except for data the Company is required by law to retain. Deleting your administrator account from the dashboard (see Section 8) counts as such an instruction: it anonymises your account information, soft-deletes the QR codes you own and erases voucher recipient details immediately; the impression and gate-submission records behind those codes are deleted within the same twelve (12) months. Server logs are normally retained for up to twelve (12) months unless longer retention is required to investigate a security incident.
8. Your rights as a data subject
In accordance with the GDPR, you have the following rights: Right of access – You have the right to request information about what personal data we process about you. Right to rectification – You have the right to request that incorrect or incomplete data be corrected. Right to erasure ("the right to be forgotten") – You have the right to request that your personal data be deleted under certain conditions. Right to restriction of processing – You have the right to request that the processing of your personal data be restricted. Right to data portability – You have the right to receive your personal data in a structured, commonly used and machine-readable format. Right to object – You have the right to object to processing carried out on the basis of legitimate interest. Right to withdraw consent – You have the right to withdraw consent given at any time. You can delete your account yourself at any time from the dashboard (Profile → Account → "Delete account"). This cancels any active subscription, anonymises your account information, soft-deletes the QR codes you own and deletes your Auth0 identity. To exercise any of the other rights listed above — or to request erasure of impression records that remain after account deletion, as described in Section 7 — please contact the Company via the contact form. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).
9. Supervisory authority
The Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) is the competent supervisory authority in Sweden. You have the right to lodge a complaint with IMY if you believe that our processing of your personal data is in breach of applicable data protection legislation.