Privacy Policy

Last updated: October 7, 2026

Qrious provides QR-code generation, file sharing, analytics and subscription services. This policy explains how the service processes personal data under the GDPR and applicable Romanian law. For a dedicated rights overview, see the GDPR page.

Service operator

Qrious is operated by Radulescu D Stefan-Radu PFA, CUI 55429019.

Trade Register registration number: F2026040144003. Registered office: Bd. Constantin Brancoveanu nr. 13, bl. B16, sc. 2, et. 6, ap. 47, Bucuresti, Sector 4, 041433, Romania. +40 749 439 302

Data we process

• Account information such as email address, profile name and authentication events.
• QR titles, destinations, design settings and files uploaded by the account owner.
• Billing contact and address details, business tax identifiers where provided, subscription identifiers, payment and refund status, invoices and contract confirmations. Stripe processes card details; Qrious does not store complete card details.
• Scan timestamp, approximate country/city, browser and device category. Raw scanner IP addresses are not stored.
• Temporary file-access counters use a daily keyed hash of the network address to prevent excessive requests. The counter does not contain the raw address; entries older than one day are eligible for cleanup during subsequent file requests.
• For QR conversion goals configured by an account owner: a random scan identifier, the configured confirmation-page path and conversion time. Qrious does not receive form fields or email addresses through this feature.
• Messages submitted through the Contact form.
• If you opt in to QR tips and offers: your consent choice and version, email delivery records, whether you have saved QR codes or started a trial, and your most recent signed-in visit. We use these to choose relevant onboarding messages, not to track browsing outside Qrious.
• Campaign parameters and conversion events used to measure sign-ups and other actions. The Google tag adjusts its use of advertising cookies according to your choice.

Why we process it

We process data to provide and secure the service, authenticate users, deliver QR content, enforce plan limits, process subscriptions, provide scan analytics, answer support requests, measure advertising performance and prevent abuse.

Processors

Promotional onboarding emails require a separate optional opt-in. You can withdraw it in Settings or through the unsubscribe link in each message. Cookie choices do not subscribe you to these emails. Unsubscribing does not stop account-security or billing emails, and weekly scan reports have their own preference. No email-opening tracking pixel is added by this flow.

Qrious uses Supabase for authentication, database and private storage, Stripe for payments, invoices and subscriptions, Vercel for application hosting, email delivery providers for transactional messages, and Google Ads for advertising measurement. Their roles depend on the service and applicable data-processing terms.

Advertising choice

Internal campaign attribution requires Accept in the cookie banner. Without acceptance, campaign parameters are not stored and browser campaign events are not sent to Qrious. Reject clears existing attribution from this browser and stops future events; it does not erase previously received records. Operational billing records and QR scan delivery are separate from campaign attribution.

Advertising cookies are denied by default. If you allow advertising measurement, Google Ads may use cookies and conversion data to attribute actions to ads. If you reject it, the tag may send cookieless signals. You can change your choice at any time through Cookie settings.

Scan privacy

Every visit to a dynamic Qrious short link counts as a scan. A daily HMAC hash derived from network and browser signals estimates unique visitors without retaining the raw IP address. Location is approximate and may be unavailable.

These scan identifiers are pseudonymous, not a guarantee of irreversible anonymity. Infrastructure providers may process network information separately to deliver and secure the service.

When an account owner enables QR conversion tracking, the QR destination link includes a random click identifier. The optional script on the owner's destination site stores that identifier in first-party local storage only after the site signals analytics consent. It is valid for attribution for seven days and is cleared on a later script load after expiry. Visiting the configured confirmation page can then be counted as a conversion for that QR. Refusing or withdrawing consent prevents or clears this local attribution; it does not erase an event already sent. Site owners are responsible for their own notices and consent integration.

Retention

Account, QR and uploaded-file data is retained while the account or service relationship remains active. Scan events and billing records may be retained as needed for analytics, security, legal and accounting obligations. Contact messages are retained only as long as reasonably necessary to resolve the request.

Cancelling or refunding a subscription does not delete the account, saved QR codes or uploaded content. You may request deletion separately. Temporary editor drafts are kept in this browser with a 24-hour validity period and removed during later draft cleanup. Locally saved templates remain until removed or browser storage is cleared.

Your GDPR rights

You may request access, correction, deletion, restriction, portability or objection where applicable. You may also complain to the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP).

Contact

Submit privacy and deletion requests by email at stefan@qrious.now or through the Qrious Contact page. Verification may be required before account data is disclosed or deleted.