Privacy Policy for qsy

Last updated: 27 October 2026 · Version 1.1

qsy is a service for designed QR codes and short links with scan statistics. This policy explains which personal data we process, why, for how long, and what rights you have. We wrote it to be read, not to hide anything.

This is an English translation of the Norwegian privacy policy («Personvernerklæring for qsy»). In the event of any conflict or discrepancy between the two, the Norwegian version prevails.

In short: We collect little. The scan statistics are built without personal data about the people who scan: no IP addresses are stored in the statistics, and no cookies are set for those who scan. As a signed-in customer, we only use cookies and browser storage that are strictly necessary for features you yourself choose to use (section 10). What you give us as a customer (email, links, designs) is used only to provide the service.

1. Data controller

The data controller for personal data in qsy is:

Jon Marius Nilsson (sole proprietorship) Org. no. 991 578 307, registered in the Norwegian Register of Legal Entities (Enhetsregisteret) Schweigaards gate 34, 0191 Oslo, Norway

VAT on subscriptions is calculated and collected by Paddle, which is the seller (Merchant of Record), see section 2.5.

Contact us via the form at /hjelp or at support@qsy.no. We reply as quickly as we can.

For the payment itself, Paddle is an independent data controller, see sections 2.5 and 4.

2. What data we process, why, and on what legal basis

2.1 Account and sign-in

When you create an account, we process:

If you sign in with Google or Apple, we receive your email address and your name from them (from Google possibly also a link to your profile picture). We show the name in the app, for example in the account menu. If your account comes from a partner (Mekanismer), we receive your email address and name from the partner in order to create the account. We do not receive contacts, calendars or any other content from your account there.

To prevent abuse of the sign-in page, we count attempts per IP address and per email address for a few minutes. The counters are stored only as salted hashes, never in plain text, and expire automatically (legitimate interest, Art. 6(1)(f): protecting accounts and the service). A password is optional and is only set if you actively choose it in your account settings.

2.2 Links, QR designs and logos

Note on logos: Logos are stored in storage with public read access, because they must be viewable in QR codes that are shared openly. The address is not guessable, but anyone who has it can view the logo. Do not upload images you want to keep private. Because the address is public, copies cached by third parties (for example in browsers or on edge networks) may persist for a short period after you delete the logo with us, see section 6.

Note on destination addresses: The address you link to may in some cases contain personal data (for example a name in a URL). You decide what you link to. When a link is created, we check the address against Google Safe Browsing to stop phishing and malware (legal basis: legitimate interest, Art. 6(1)(f), protecting those who scan). Links may also be deactivated later if we receive reports of abuse. See sections 3 and 4 regarding the transfer to Google.

2.3 Anonymous guests and demo links

You can design QR codes and create a temporary link without an account. In that case we process:

We never store your IP address in plain text in the demo flow. The hash is nevertheless pseudonymised personal data for as long as the salt exists with us, and we treat it as such. The salted hash is stored in two places, both short-lived: (1) as a counter in the abuse protection, which lives for up to one hour in a sliding window and then expires automatically; and (2) on the demo link row itself, which expires after 20 minutes and is deleted continuously (at least hourly) together with the rest of the row. Guest work is deleted after 24 hours. See sections 5 and 6.

2.4 Support requests

If you send us a message via /hjelp, we process your email address, the subject and the message text, as well as the reply we give you.

We use an AI model (Claude from Anthropic) to draft replies. A human always reads and approves the reply before it is sent: no reply is sent automatically. We do not send your email address to Anthropic: only the subject and the message text. This content is processed by Anthropic in the USA, with the EU Standard Contractual Clauses (SCCs) in Anthropic's data processing agreement as the transfer mechanism, see sections 3 and 4.

If you send a request without being signed in, we limit the number per day with a counter that contains only a salted hash of your IP address. The counter expires automatically after up to 24 hours.

Support requests are deleted no later than 24 months after the last reply, or when you delete your account, see section 5.

2.5 Subscriptions and payment

Payment is handled by Paddle, which is the seller (Merchant of Record) for the subscription. Responsibility is divided as follows: Paddle is an independent data controller for everything that happens in the checkout window and for your payment details (card, invoice, VAT, refunds) under its own privacy policy: <https://www.paddle.com/legal/privacy>. We are the data controller for what happens in qsy after the purchase is completed.

On purchase, we receive your email address and subscription status from Paddle in order to create or link your account and grant it the correct access. The legal basis is our contract with you (Art. 6(1)(b)), and this policy is the information you receive about that processing (GDPR Art. 14). If you purchase a subscription without an existing account, we create the account automatically using the email address from the purchase. After each purchase, you receive a confirmation email from us with the plan, your consent to immediate delivery and links to the terms, this policy and the withdrawal form.

We store only what we need in order to know what your account has access to:

We never see and never store your card number.

2.6 Scan statistics: built without personal data

This is the core of qsy, and here we have made a deliberate choice: the statistics are designed so that they contain no personal data about the people who scan.

If you scan a qsy code (you are an "end user"):

• You are redirected to the destination. That is all.
• We set no cookies and no other storage in your browser.
• We do not store your IP address or your browser identifier (user agent) in the scan statistics. Short-lived technical operations and security logs at our providers may contain IP addresses; these are never used in the statistics, are governed by our data processing agreements, and are deleted automatically after a short time (see section 5).
• Your IP address is processed transiently at the moment of redirection: our infrastructure provider (Cloudflare) uses it to determine country and city and to deliver the response to you. We never store it. Cloudflare may, as a data processor, process it briefly in its own operations and security logs, governed by our data processing agreement. The legal basis for this transient processing is legitimate interest (Art. 6(1)(f)): providing the redirection and giving the customer aggregated statistics without tracking you.
• The scan statistics cannot be used to find out who scanned a code. That is deliberate.

What is stored per scan consists only of derived values: among other things which link, the timestamp, country, city, coarse device class (mobile/tablet/desktop), whether the scan came from the QR code or the short link, plus the customer's own user ID (the owner of the link) and a technical weight value used for sampling. None of these identify the person scanning. City is only shown when at least five scans come from the same city, so that individuals cannot be singled out. This threshold applies to every extraction of the statistics: the dashboard, CSV export and folder statistics.

If you are a customer, what you see are numbers: scan counts over time, countries, cities (subject to the threshold above), device class and source. Never individuals.

An important condition: The statistics are anonymous because a link is normally shared with several people. If you as a customer create one link or code per recipient in order to monitor an individual, the scan data in practice becomes information about that person. In that case you are yourself the data controller for that use and must have your own legal basis and inform the person concerned. The Terms of Service prohibit using qsy to identify or track individuals, and we may deactivate links used in that way.

3. Who we share data with (processors and recipients)

We never sell personal data. We use the following providers to deliver the service. The legal bases (GDPR Art. 6) are set out in section 2; the "Transfer mechanism" column states the safeguard under GDPR Chapter V where data may be processed outside the EU/EEA:

Beyond this, we disclose data only if we are legally required to do so, for example by order of a court or public authority.

4. Transfers to countries outside the EU/EEA

Our aim is that data is stored in the EU/EEA. Account data and the scan statistics are stored in the EU. Some providers are nevertheless American or global:

• Cloudflare, Vercel and Google LLC are certified under the EU-US Data Privacy Framework (DPF), which the European Commission has approved as a transfer mechanism.
• Anthropic (USA) is not DPF-certified. The transfer of the subject and message text of support requests is based on the EU Standard Contractual Clauses (SCCs) in Anthropic's data processing agreement.
• Resend and Upstash (which operates Vercel KV) are US companies; the processing is governed by data processing agreements incorporating the EU Standard Contractual Clauses (SCCs).
• Cloudflare's edge network is global: when someone scans a code, the request is processed at the nearest data centre, which may be located outside the EU/EEA. The processing there is transient: no personal data about scanners is stored in the statistics, whether inside or outside the EU. Short-lived operations and security logs may exist with the provider and are covered by the safeguards above.

You can ask us for a copy of, or more information about, these safeguards via /hjelp.

5. How long we keep data

We keep data only as long as it is needed for its purpose, and we have built automatic deletion into the service:

6. Deletion

You can delete your account yourself at /konto. This deletes:

• your account and sign-in identities
• all links, folders, QR designs and uploaded logos
• your support requests
• the scan statistics linked to your links, across all datasets (deletion in the analytics database is completed within 30 days at the latest)
• copies in caches (the edge network)

The only thing we keep after account deletion is accounting records we are legally required to retain (section 5, last row). They are used for nothing other than accounting.

If you delete a single link, its statistics are deleted as well, within the same time limit as above.

For logos, the following also applies: because the logo address is public, copies already cached by third parties (browsers, edge networks) may persist for a short period after deletion, until the caches expire.

7. Your rights

You have the right to:

• Access: to know what data we hold about you, and to receive a copy.
• Rectification: to have inaccurate data corrected. You change your email and sign-in methods yourself at /konto.
• Erasure: see section 6. Self-service, without having to ask us.
• Data portability: to receive your data in a machine-readable format. You can export links as CSV from the studio; request the rest via /hjelp.
• Restriction: to require that processing be restricted in certain situations.
• Objection: to object to processing based on legitimate interest (for example the IP hash in the demo flow, section 2.3).

Where processing is based on consent, you can withdraw it at any time, without affecting the lawfulness of the processing carried out before the withdrawal. Today, none of our processing is based on consent, which is also why we do not ask you to tick any privacy consent boxes.

If you want to exercise a right that is not self-service, contact us via /hjelp. We reply within one month at the latest. In particularly complex cases, or if we receive many requests, the deadline may be extended by up to two further months, as permitted by GDPR Article 12(3). In that case you will be informed of the extension and the reason within the first month. We may ask you to confirm your identity (for example by signing in) before we disclose anything.

If you have scanned a qsy code: Because the scan statistics are built without personal data, we cannot identify you in them (GDPR Article 11). The rights of access, rectification, erasure, restriction and portability therefore do not apply to the scan data, unless you yourself provide us with information that makes identification possible, which our statistics are not designed for.

You do not need to provide anything more than an email address to use qsy. Without it, we cannot provide an account and subscription: it is the only piece of data that is a contractual requirement.

We make no decisions with legal effect for you based on automated processing or profiling.

8. Security

We build security into the service rather than making promises in words:

• All traffic is encrypted (HTTPS).
• Sign-in is passwordless by default: passkey, magic link, Google or Apple. A password exists only if you actively choose it.
• API keys are stored only as a cryptographic hash: we cannot read them ourselves.
• IP addresses in the abuse protection (demo, support and sign-in) are stored only as a salted hash.
• Database access is restricted with row-level security: your account sees only its own data.
• The most effective security measure is data minimisation: data we do not hold cannot leak. That is why the scan statistics are built without personal data.

9. If something goes wrong (personal data breaches)

If a personal data breach occurs, we notify Datatilsynet (the Norwegian Data Protection Authority) without undue delay and no later than within 72 hours, as required by GDPR Article 33, unless the breach is unlikely to result in a risk to you. If the breach is likely to result in a high risk to your rights, we notify you directly without undue delay (Article 34). Nothing in our terms limits the rights you have directly under the GDPR.

10. Cookies and browser storage

qsy uses no cookies for analytics, advertising or tracking: neither towards you as a customer nor towards those who scan your codes. Everything we store in your browser is strictly necessary for features you yourself choose to use: the sign-in you request, the language you select, and the design you carry with you through sign-in. That is why we show no consent banner: ekomloven § 3-15 (the Norwegian Electronic Communications Act) does not require consent for storage that is strictly necessary to provide a service you have expressly requested. Should we ever wish to use analytics or tracking cookies, we would introduce a banner first, but that is not on the roadmap.

Exception: When you open the checkout window, we load Paddle's payment solution. Paddle sets its own cookies in the checkout window, as an independent data controller for the payment. This happens only when you actively start a purchase, never during ordinary use of qsy, and never towards those who scan codes.

11. Children

qsy is a service for creating and managing links and QR codes, and is not directed at children. To use qsy with an account (including free guest use that is converted into an account), you must be at least 13 years old, the age limit for information society services under personopplysningsloven § 5 (the Norwegian Personal Data Act). To take out a subscription, you must be of legal age (18), because it is a payment agreement; on purchase you confirm that you are over 18. Scanning a qsy code requires no age and collects no personal data, see section 2.6.

12. Complaints to the supervisory authority

If you disagree with how we process personal data, we would like to hear from you first via /hjelp, so we can put things right. In any case, you have the right to lodge a complaint with Datatilsynet (the Norwegian Data Protection Authority):

Datatilsynet, Postboks 458 Sentrum, 0105 Oslo, Norway, <https://www.datatilsynet.no>

If you live in another EU/EEA country, you may also complain to the supervisory authority where you live.

13. Changes to this policy

We update this policy when the service or the applicable rules change. The date and version number at the top always show the current version, and earlier versions are archived, so you can see what applied at any given time. Request a copy via /hjelp.

For changes to your detriment (for example if we start processing more data, sharing with more recipients or extending retention periods), we notify you by email at least 30 days before the change takes effect, and you may cancel free of charge before it takes effect. Changes that are not to your detriment (for example clearer language, shorter retention periods or fewer providers) may take effect upon publication.