Privacy policy

Who we are

qrshaper.com is operated by HDWR Global sp. z o.o., ul. Dmowskiego 28, 63-000 Środa Wielkopolska, Poland, KRS 0000527575, NIP (VAT) PL7861700636, REGON 302852637 (“we”). We are the controller of personal data processed by the service. Contact: [email protected].

What we process and why

• Account: your email address (and, if you sign in with Google, the email address Google confirms) — to create your account and sign you in (contract, Art. 6(1)(b) GDPR). We send a one-time sign-in link to this address; we do not send newsletters.
• Session cookie qs — keeps you signed in for up to 60 days. It is strictly necessary; we use no analytics or advertising cookies on qrshaper.com.
• Your codes: names, destination URLs and their history, design settings — to provide the service.
• Scans of dynamic codes: time, approximate location (country, region, city derived from the network by Cloudflare), network operator number (ASN), device type, operating system, browser, language and the user-agent string. To count unique people we compute a daily one-way hash of the IP address and user-agent with a secret salt; IP addresses are not stored. Scan statistics are shown only to the owner of the code (legitimate interest, Art. 6(1)(f) GDPR — providing statistics requested by the code owner).
• Static codes made in the generator are created in your browser; their content is not sent to us.
• Marketing e-mails: QRshaper is free; in return, creating an account requires consent to receive QRshaper news, tips and offers by e-mail (consent, Art. 6(1)(a) GDPR). You can withdraw it at any time with the unsubscribe link in every e-mail or by writing to us — your account and codes keep working. Your e-mail address and consent are kept in our own mailing system on servers in the EU.

Who processes data for us

Cloudflare, Inc. (network, redirects of dynamic codes, DNS), OVHcloud (servers in the EU), VIPserv (sending sign-in emails), Google LLC (only if you choose “Continue with Google”). Data may be transferred outside the EEA by Cloudflare and Google under the EU–US Data Privacy Framework / standard contractual clauses.

How long

Account data — until you delete the account. Detailed scan records — up to 25 months, after which they are deleted automatically. Sign-in links expire after 20 minutes, sessions after 60 days.

Your rights

You have the right to access, rectify and erase your data, restrict or object to processing and to data portability. Write to [email protected] — we also delete accounts on request. You may lodge a complaint with a supervisory authority, in Poland the President of the Personal Data Protection Office (UODO).

Changes

We will publish changes to this policy on this page. Last updated: 30.10.2026.