Privacy Policy

Last Updated: August 17, 2026

Note (August 17, 2026): Two promises in §5 were being made that the software did not keep, and one that it now does. Analytics retention was a period with nothing behind it: nothing ever deleted a scan event, so "up to 90 days" described a table that kept everything forever. A purge now runs on our servers and deletes them, and §3 says so. Erasure claimed we delete your data from our operational systems; there is no delete-my-account button, and until this revision the deletion itself was incomplete. Erasure is now carried out properly — hosted files removed from storage, lead submissions and workspaces included — but it is done by a person when you ask, and §5 says that plainly rather than implying a control you cannot find. It also now lists what survives, why, and admits that stripping your name from a payment record is pseudonymisation and not anonymisation. Rectification and portability were described as self-service. The profile page is read-only and there is no export button, so both are now stated as requests we fulfil by hand under Article 12(3). Two things were then corrected in §3. The machine the Service runs on was missing from the list of where your data lives — it is a virtual server we rent from Hetzner in Finland, and it also still holds the files uploaded before we moved hosting to Backblaze. And the edge was described as running with "zero persistent logging"; the worker's own code writes a line for every scan, and since the pixel consent banner shipped that line also records the scanner's answer. §3 now states what is in that line, what is not, and how long Cloudflare keeps it.

Note (August 13, 2026): Two descriptions were corrected. On-chain anchoring (§2, §3, §4, §5) previously spoke of "the encrypted routing record and its metadata"; there is no separate metadata — exactly two values are written, a random code identifier and the encrypted destination — and the Right to Erasure section now states the on-chain limit instead of leaving it to the Data Processing Agreement. Hosted files (§2.4) said they are stored on our own server disk; since August 2026 they are held in a private object-storage bucket at Backblaze in the United States, which is now listed under storage and international transfers.

Note (June 13, 2026): The encryption description (§2) was revised for accuracy — encryption is server-side and we decrypt destinations at request time to operate redirects; it is not end-to-end or zero-knowledge.

1. Introduction and Controller Details

This Privacy Policy describes how eqr.link ("we", "us", or "our") collects, uses, and shares personal data when you use our website, web application, and services (collectively, the "Service").

For the purposes of the General Data Protection Regulation (GDPR) and other applicable data protection laws, the data controller is:

• Legal Entity: Piaxonika Software Services SINGLE MEMBER S.A.
• Company Number: 179072201000
• Address: 3is Septemvriou 144, 112 51 Athens, Greece
• Contact Email: support@eqr.link
• Data Protection Representative (EU/UK): Not applicable — the controller is established in the EU (Greece)

2. Data We Collect and Processing Purposes

We collect and process personal data only when necessary to provide the Service, comply with legal obligations, or pursue our legitimate interests.

2.1. Account and Profile Data

When you register an account via Google Sign-In (OAuth) or Magic Link (delivered via email), we collect:

• Email Address: Used for authentication, account management, and sending transaction/magic link emails.
• Google User ID: Used to authenticate your account when logging in via Google.
• Lawful Basis: Contract necessity (Art. 6(1)(b) GDPR).

2.2. QR Code Configuration Data

When you create QR codes, we process:

• Destination URLs: The URLs you configure for redirects. These are encrypted with a per-user key (derived via HKDF-SHA256 from a master secret) before being stored in our database, so a leak of the database alone does not expose them (the master secret is held in our application environment, not in the database). This is server-side encryption — not end-to-end or zero-knowledge: our redirect service decrypts a destination at request time to route each scan, so Eternal QR can access destination URLs while operating the Service. You can export your key to decrypt your destinations independently of us.
• On-Chain Anchoring: For paid Eternal codes only, exactly two values are written to the public, immutable Base L2 blockchain: the random 10-character identifier of the code, and the AES-256-GCM ciphertext of its destination. The transaction is signed and paid for by our own relayer wallet, whose address is therefore also public. No email address, account identifier, IP address, scan data or plaintext destination is ever written on-chain. Encryption is not anonymisation: we hold the key, so the on-chain ciphertext remains personal data under data protection law. Basic codes and codes carrying only the Dynamic upgrade are hosted, not anchored, and nothing about them is written on-chain.
• Lawful Basis: Contract necessity (Art. 6(1)(b) GDPR).

2.3. Redirect Analytics Data (Scan Events)

When a third party scans your QR code or clicks a redirect link, we log the scan event to compile analytics. To protect scanner privacy, we do not store raw IP addresses. Instead, we process:

• IP Hash: A truncated 16-character SHA-256 hash of the IP address with a fixed application salt, used to count unique visits rather than to identify or track individuals. We do not store the raw IP address.
• Technical Metadata: User-Agent string (browser/OS info), screen size, and referer host (domain-only).
• Geographic Data: Country code derived dynamically from the Cloudflare edge request (using the CF-IPCountry header).
• Lawful Basis: Legitimate interest in providing analytics and detecting abuse/malicious traffic (Art. 6(1)(f) GDPR).

2.4. Hosted Files and Lead Capture Forms

If you use our advanced features:

• Hosted Files: Files you upload are stored in a private object-storage bucket operated by Backblaze (United States) and are associated with your account, and optionally with a specific QR code. They are served from a separate, cookieless domain (content.eqr.link) at an unguessable address, and marked for exclusion from search engines. That address is not a permission check: anyone holding the link can retrieve the file without signing in. We re-encode uploaded images before storing them, which removes their embedded metadata, including camera location data.
• Lead Capture Forms: If you enable lead collection, we store the data submitted by scanners in our database. Scanners receive a signed bypass cookie (eqr_lead_submitted_<form_id>) to remember their submission and bypass the form on future scans.
• Lawful Basis: Contract necessity for hosted files (Art. 6(1)(b) GDPR); Consent or legitimate interest for lead capture, depending on the B2B configuration (Art. 6(1)(a) or Art. 6(1)(f) GDPR).

3. Data Storage, Location, and Retention

We utilize third-party infrastructure to secure and host your data.

• Primary Database: Hosted by Turso (LibSQL) in the European Union (EU).
• Application Server: The API backend, the web application it serves, and the ingress that terminates TLS in front of both run on a virtual server we rent from Hetzner Online GmbH, in Finland (EU). Files uploaded before August 2026 are still held on that server's local disk rather than at Backblaze.
• Edge Routing & Workers: Executed on Cloudflare's global network. The redirect worker writes one short line per scan: the first four characters of the code's identifier and the two-letter country code, plus — where a code carries a retargeting pixel — the first eight characters of the pixel identifier and the scanner's answer to the consent banner. No raw IP address, and no destination URL, appears in it. Cloudflare keeps those lines for at most seven days. Section 1.1 of the List of Subprocessors sets this out in full.
• Transactional Emails: Handled via Resend (US).
• Payment Processing: Handled via Stripe (US).
• Hosted Files: Held in a private object-storage bucket at Backblaze (United States).
• Retention Periods:
  • Account Data: Retained until you request account deletion.
  • Redirect Logs/Analytics: Retained for up to 90 days. A job on our servers deletes scan events older than that, on a schedule, without anyone having to ask. What survives is the running scan count on the code itself — a number, with no record of who produced it, when, or from where.
  • Hosted Files: Retained until you delete them or your account. Deleting a hosted file removes the stored object and every version of it, and deletes the database row that recorded it; we keep no hidden copy and no tombstone.
  • Edge Scan Logs: The per-scan line described above is kept by Cloudflare for at most seven days and is not exported anywhere else.
  • On-chain Records: Retention is permanent and outside our control. Anchoring transactions on the Base L2 blockchain are public and cannot be deleted or modified. The chain also records when each write happened, and re-anchoring a destination leaves the earlier ciphertext in the transaction history, so the anchoring timeline of an Eternal code is permanent and publicly visible.

4. International Data Transfers

When we transfer personal data outside the European Economic Area (EEA), we ensure appropriate safeguards are in place. These include:

• Stripe & Resend (US): Standard Contractual Clauses (SCCs) and/or verification of certification under the EU-U.S. Data Privacy Framework.
• Backblaze (US): Standard Contractual Clauses (SCCs). Hosted files are held in a private bucket reached with bucket-scoped credentials.
• Base L2 Blockchain: Anchored records are public and permanent. Do not put personal data in a destination URL, including in its path or query string. The URL is encrypted before it is written, but encryption is not anonymisation, and the identifier written alongside it is the same short identifier that appears in your public link.

5. Your Rights

Under the GDPR and other applicable laws, you have the following rights regarding your personal data: Some of these you exercise yourself in the app, and some you exercise by writing to us. We say which is which, because a policy that describes a button you cannot find is worse than one that gives you an address.

• Right of Access: You can see your account profile, your codes, your transaction history and your monthly add-ons in the dashboard, and you can export your encryption key at any time. For a copy of everything we hold about you in one file, write to support@eqr.link — that is a request we fulfil by hand, within one month, as Article 12(3) allows.
• Right to Rectification: Your profile page is read-only today: it shows your email address and your account details but has no editable fields. To correct anything, write to support@eqr.link.
• Right to Erasure (Right to Be Forgotten): Ask by emailing support@eqr.link. There is no delete-my-account button in the app; erasure is carried out by a person on our side, so allow us the time Article 12(3) gives us rather than expecting it to happen the moment you click. What then happens:
  • Your account, codes, analytics, hosted files, lead forms and the submissions they collected, API keys, webhooks and workspaces are deleted. Hosted files are removed from the storage bucket itself, not merely unlinked; if the bucket cannot be reached we stop and retry rather than deleting the record of a file that still exists.
  • If you have a live monthly add-on we cancel it before erasing, because a subscription billing an account that no longer exists helps nobody. You can also cancel it yourself first, from the billing page.
  • Some records are kept, and they still count as your personal data. Payment, dispute and stored-value records are retained where tax, accounting or the defence of a legal claim requires it — Article 17(3)(b) and (e). We strip your name and contact details from them, but they keep an internal account identifier and, in the checkout records, the IP address and browser the purchase came from. That is pseudonymisation, not anonymisation: it no longer names you, and we are not claiming it can never be linked back to you.
  • If you have ever reported content to us, the address you reported from is held with that report, because a takedown record has to remain reviewable. Tell us if you want that considered separately.
  • For paid Eternal codes, the encrypted record already written to the Base L2 blockchain cannot be deleted or altered by us or by anyone else: it stays public, and we retain the technical ability to decrypt it. Erasure therefore covers everything within our control but cannot reach the on-chain ciphertext — which is why we ask you not to put personal data in a destination URL.
• Right to Data Portability: You can export your encryption key from your profile at any time, and use it to decrypt your redirected URLs independently of our Service. A structured export of the rest of your data is a request we fulfil by hand — write to support@eqr.link. There is no self-service export button, and we would rather say so than have you look for one.
• Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority in your country of residence.

6. Contact Us

For any privacy-related inquiries, data requests, or complaints, please contact us at:

• Email: support@eqr.link
• Postal Address: 3is Septemvriou 144, 112 51 Athens, Greece