Who we are
QRalo (“QRalo”, “we”, “us”) operates qralo.com, the QRalo dashboard and the QRalo iOS app. QRalo lets organizations create signed QR codes and lets anyone verify them on a public page.
QRalo is the data controller for the data described in this policy. The publisher’s details are in our legal notice.
When someone scans a code, we process scan data to show the verification page and protect the service, and we make scan statistics available to the organization that issued the code. That organization decides where its codes are placed and may have its own privacy policy.
Data we collect
If you create an account
- Identity and contact: email address, first and last name if you give them, organization name and the website domain you declare.
- Sign-in: a password stored as a bcrypt hash (never in clear), or, if you use “Sign in with Google”, your Google account identifier, name and email address. We request only the “profile” and “email” permissions.
- Account security: a pseudonymized (hashed) version of the IP address used to create the account, used to detect abuse; email verification and password reset tokens.
- Your content: the codes you create (destination URL, purpose, optional label, dates, status), your custom logo if you upload one, and domain verification records (domain, TXT code, status).
- Subscription: your plan, the Stripe customer and subscription identifiers for web payments, and the RevenueCat identifier for iOS purchases. We never receive or store your full card number.
When someone scans a QRalo code
Scanning does not require an account. Each verification records:
- the date and time of the scan and the verification result;
- the browser’s user-agent string, and the device type and browser we derive from it;
- a pseudonymized IP address: a salted SHA-256 hash of the IP address, shortened. Under the GDPR, a pseudonymized address may still be personal data;
- an approximate location (city, country and approximate coordinates). To obtain it, the IP address is sent at scan time to a third-party geolocation service, ipapi.co. We do not store the IP address itself.
When you use the QR scanner on qralo.com, the camera image is processed in your browser. Only the decoded text of the code is sent to our server.
If an automated check flags a code’s destination as malicious, we also record a security incident containing the destination URL, the pseudonymized IP address and the user agent of the scan that triggered it.
If you contact us
The “Plan a pilot” form on our contact page collects your first and last name, work email, company name, company size, phone number (optional) and your message. It is sent to our team by email. Emails you send to contact@qralo.com are kept in our mailbox.
Technical data
Like any website, our servers process the IP address of each request to deliver pages and to apply rate limits that protect the service against abuse.
Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and running your account, signing and hosting your codes, customer support | Performance of our contract with you (Art. 6(1)(b)) |
| Billing, subscriptions and accounting records | Contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) |
| Showing the verification page and running automated link checks when a code is scanned | Our legitimate interest, and that of the issuer, in letting people check a code before using it (Art. 6(1)(f)) |
| Scan statistics and maps provided to the organization that issued the code | Legitimate interest of QRalo and the issuer in measuring the use of their codes (Art. 6(1)(f)) |
| Preventing fraud and abuse, rate limiting, revoking malicious codes, security incidents | Legitimate interest in keeping the service and its users safe (Art. 6(1)(f)) |
| Service emails: email verification, password reset, payment and subscription notices | Contract (Art. 6(1)(b)) |
| Answering sales and contact requests | Steps taken at your request before a contract, or legitimate interest (Art. 6(1)(b) and (f)) |
We do not sell personal data, we do not use it for advertising, and we do not make decisions with legal effects based solely on automated processing. The automated link checks produce a risk indication about a website, not about a person.
Cookies and local storage
We do not use advertising or analytics cookies.
- When you sign in, we set one HTTP-only cookie (
qrseal_token) containing your session token. It is strictly necessary and expires after 7 days. - The dashboard keeps your session token and basic account details (user and organization) in your browser’s local storage so you stay signed in. Signing out removes them.
Because these are strictly necessary for the service you request, they do not require consent.
Service providers
Personal data is accessible to the QRalo team members who need it, and to the following providers, each for its own part of the service:
| Provider | Role | Data involved |
|---|---|---|
| Hetzner (Germany) | Server hosting | All data stored by QRalo |
| Stripe | Web payments and billing portal | Email address, payment details, subscription |
| Apple and RevenueCat | Subscriptions bought in the iOS app | Purchase and subscription status, app user identifier |
| Brevo | Sending service emails (SMTP) | Email address, name, email content |
| ipapi.co | IP geolocation at scan time | IP address of the person scanning |
| “Sign in with Google”, if you choose it | Google account identifier, name, email address | |
| CARTO | Map tiles for the scan map in the dashboard | IP address of the account holder viewing the map |
| Google Safe Browsing | Checking a destination against Google’s list of unsafe sites when a code is created | Destination URL of the code |
| PhishTank and URLhaus (abuse.ch) | Public threat lists used in link checks at scan time (PhishTank also when a code is created) | Destination URL of the code |
We may also disclose data when required by law or by a competent authority, or to defend our rights, for example in cases of fraud using QRalo codes.
Transfers outside the EU
Our servers are in Germany. Some providers listed above (such as Stripe, Apple, RevenueCat, Google and ipapi.co) may process data outside the European Economic Area, in particular in the United States. In that case, we rely on the safeguards they offer, such as the European Commission’s Standard Contractual Clauses or the EU–U.S. Data Privacy Framework where the provider is certified.
How long we keep data
- Account data, codes and logo: for as long as your account exists. When you delete your account from Settings, your organization, users, codes, scan history, keys and domain verifications are deleted from our database.
- Scan data: for as long as the code it belongs to exists. It is deleted when the code is permanently deleted or when the issuer’s account is deleted. We do not currently delete scan data automatically after a fixed period.
- Billing records: kept by Stripe or Apple, and by us where required, for the periods set by accounting and tax law (up to 10 years in France).
- Sales and contact emails: for as long as needed to follow up on your request and any resulting business relationship.
Deleting your account cannot be undone. Codes you have printed will no longer verify once the account is deleted.
Your rights
Under the GDPR, you have the right to:
- access your personal data and get a copy of it;
- have inaccurate data corrected;
- have your data erased;
- restrict or object to processing based on legitimate interest;
- receive the data you gave us in a portable format;
- give instructions about what happens to your data after your death (a right specific to French law).
You can update your profile and delete your account yourself from the dashboard settings. For anything else, email contact@qralo.com. We may ask you to confirm your identity and will answer within one month.
If you scanned a code, we cannot link a scan to you directly, because we don’t store your IP address. Tell us which code you scanned and when, and we will do our best to find the record.
You can also lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr), or with the authority of the EU country where you live.
Security
Passwords are hashed with bcrypt, signing keys are stored encrypted, and connections use HTTPS. Our Security page describes how verification works and where its limits are.
Children
QRalo accounts are meant for organizations and require account holders to be at least 18. Anyone can scan a code, and we collect the same limited scan data whatever the age of the person scanning.
Changes to this policy
We will update this page when our practices change, and change the date at the top. If a change materially affects how we use account holders’ data, we will tell them by email before it applies.
Contact
For any question about this policy or your data, email contact@qralo.com. See also our Terms of Service.