Privacy policy

The data controller is Adnan Be., registered under SIREN number 827 669 011. For any question or to exercise your rights: [email protected].

This document distinguishes two audiences: users who hold an account, and consumers who scan a QR code without ever creating one. The processing is not the same.

Account holder data

Creating an account requires the following data, necessary to provide the service (legal basis: performance of the contract).

• Identity and contact: name, email address.
• Authentication: a hash of the password, never the password in clear text. One-time verification codes are likewise stored as hashes.
• Membership: organisation, and role within that organisation.
• Billing: Stripe subscription and customer identifiers. No card data passes through or is stored by QLabel.
• Support: the subject and content of requests you send us.

Scan statistics

When a QR code is scanned, the event is recorded to provide brands with usage statistics for their products (legal basis: the brand’s legitimate interest in measuring the reach of its product pages).

Recorded are: date and time, the country inferred from the network, the language declared by the browser, the device type (mobile or desktop), the browser family, and the referring page where applicable.

No IP address is retained, no cookie is set for measurement purposes, and no persistent identifier is attached to the scan. These records cannot reconstruct an individual’s journey or re-identify them.

Cookies and local storage

QLabel uses no advertising cookie, no analytics cookie and no third-party tracker. The only items stored are strictly functional, which exempts them from consent — hence the absence of a cookie banner.

Site traffic is measured without cookies, by the delivery network that serves the pages: no identifier is stored on your device and no profile is built.

• ql_lang — cookie storing the chosen display language. Duration: one year.
• ql_token — session cookie, set only after signing in, removed on sign-out.
• ql_theme — light or dark theme preference, kept in the browser’s local storage and never sent to the server.

Subprocessors

QLabel relies on the following providers, each for a defined purpose:

• Stripe — subscription payments and billing management.
• Resend — delivery of transactional emails (address verification, password reset).
• Cloudflare — page delivery, storage of product images and documents uploaded by brands, and cookieless traffic measurement.
• GitLab — internal tracking of support requests.

Retention periods

• Account data: for the duration of the subscription, then deleted or anonymised promptly after closure.
• Scan statistics: depending on the brand’s subscription tier, the depth of history available is limited in time.
• One-time verification codes: a few minutes, until they expire.
• Accounting and billing records: for the applicable statutory retention periods.

Your rights

You have rights of access, rectification, erasure, restriction, objection and portability over your data. Exercise them at [email protected].

You may also lodge a complaint with the CNIL, the supervisory authority competent in France.