This Privacy Policy explains how we process personal data in connection with the website, the product, and the related support, security, and integration processes of QR Vello.
Niclas Pilz IT Dienstleistungen
Niclas Pilz IT Dienstleistungen
Große Bleiche 27
55116 Mainz
Email: [email protected]
Phone: +4917657914455
Website: https://qr-vello.com
Privacy Policy: https://qr-vello.com/privacy
Where we process personal data on behalf of business customers and exclusively under their instructions, we act as a data processor. In such cases, the nature and scope of processing are additionally governed by the respective agreements with the customer, in particular a data processing agreement (Art. 28 GDPR).
Depending on how you use our service, we process in particular the following categories of data:
When you access our website, we process technical access data to deliver content, ensure the stability and security of our systems, and detect attacks or abuse. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is in providing our service securely and reliably.
We process data necessary for registration, sign-in, session management, multi-factor security, permission management, and account recovery. The legal basis is Art. 6(1)(b) GDPR; additionally Art. 6(1)(f) GDPR for abuse prevention, security monitoring, and forensic traceability.
If you sign in via Google, we receive from Google the data required for authentication and account association, in particular the Google user ID, name, email address, language preference, and where applicable a profile picture. The legal basis is Art. 6(1)(b) GDPR. Where Google processes data outside the European Economic Area, the notes in section 8 apply additionally.
When you or your authorized team members use the QR Vello platform, we process the data you enter or generate via the API, in particular target URLs, QR code content (e.g. vCard fields, Wi-Fi credentials, campaign labels), uploaded branding assets, and workspace configurations. Processing takes place for the performance of the contract under Art. 6(1)(b) GDPR or, where we act on behalf of a business customer, under Art. 28 GDPR.
For dynamic QR codes, every scan is routed through the QR Vello redirect infrastructure. In doing so we process technical metadata of the scan: truncated IP address (for country/region-level geo derivation, then discarded), timestamp, user agent (device type, OS, browser), and referrer information where transmitted. This processing takes place on behalf of the respective QR Vello customer (Art. 28 GDPR). The legal basis is Art. 6(1)(f) GDPR with the legitimate interest of measuring QR code campaign performance, together with Art. 6(1)(b) GDPR for performance of the contract with the QR Vello customer. We do not use third-party tracking cookies, browser fingerprints, or cross-device identifiers. Scan logs are retention-capped per plan tier and are automatically aggregated or deleted after the retention period expires.
When you integrate our REST API into your own systems, receive webhooks on your own endpoints, or attach custom domains for short links, we process the related technical data: API token IDs, endpoint calls, rate-limit counters, webhook delivery logs (including response status), DNS configuration of your custom domain, and TLS certificate status. This processing serves the provision, error analysis, security, and traceability of the service. The legal basis is Art. 6(1)(b) GDPR as well as Art. 6(1)(f) GDPR for security and support purposes.
To handle paid plans, we use payment service providers (in particular Stripe). Contract, billing, and payment data are transmitted to the provider to the extent required for processing the transaction. The legal basis is Art. 6(1)(b) GDPR.
We process inquiries, support cases, questions about QR codes or plans, security reports, and other communications in order to handle your request, resolve issues, and enable use of the product. The legal basis is Art. 6(1)(b) GDPR and, where there is no direct contractual relationship, Art. 6(1)(f) GDPR.
We process log and audit data to track access, detect unauthorized use, investigate security incidents, meet regulatory requirements, and demonstrate the integrity of QR code and account data. The legal basis is Art. 6(1)(f) GDPR and, where statutory obligations apply, Art. 6(1)(c) GDPR.
Where we are legally required to do so, we process personal data to fulfill commercial, tax, supervisory, or security-related obligations. The legal basis is Art. 6(1)(c) GDPR.
We receive personal data primarily directly from you or from authorized users of your company.
In addition, data may come from the following sources:
We disclose personal data only where necessary for the purposes described, where required by law, or where you have consented. Recipients may include in particular:
We use cookies, local storage mechanisms, and comparable technologies to the extent technically necessary to provide the explicitly requested digital service, maintain sessions, implement security functions, or store user preferences. The data protection legal basis is Art. 6(1)(b) or (f) GDPR. Where consent is required for the use of a particular technology, it is obtained based on Art. 6(1)(a) GDPR. For access to information on terminal devices, § 25 of the German TDDDG applies additionally.
We only use non-essential technologies if a valid consent has been obtained.
We store personal data only for as long as necessary for the relevant purposes or as required by law. Key criteria are the duration of the contractual relationship, the necessity for support, security, and proof, as well as statutory retention obligations.
Account deletion therefore does not necessarily result in immediate full removal of all data where statutory retention obligations or overriding legitimate interests apply.
Where we use service providers or integration partners outside the European Economic Area, or where features from providers processing data in third countries are used, we ensure an adequate level of data protection. Transfers take place in particular on the basis of an adequacy decision, standard contractual clauses, or other legally provided safeguards.
Subject to statutory requirements, you have in particular the following rights:
To exercise your rights, a message to [email protected] is sufficient.
You have the right to lodge a complaint with a data protection supervisory authority, in particular at your usual place of residence, your place of work, or the place of the alleged infringement.
We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you, unless we inform you separately.
We may update this Privacy Policy if our processes, integrations, statutory requirements, or the product change materially. The version published on this page applies.
Last updated: 25. May 2026