Privacy policy
Last updated: 2026-10-15
This policy explains what personal data QR Boost processes, why, on what legal basis, who we share it with, how long we keep it and how to exercise your rights. We process the bare minimum.
1. Data controller
Diego Manuel Béjar Santiago (Wandary) · Tax ID 10880184B · C/ Cardenal Benlloch, 74, esc. izq., 1-1, 46920 Mislata (Valencia), Spain · qrboost@wandary.com.
2. What data we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Email, name, language | Create your account, let you log in and manage your QR codes | Performance of a contract (art. 6.1.b GDPR) |
| Sessions: device (browser and OS), usage dates and a pseudonymised IP identifier | Keep you logged in and protect your account (attempt limits) | Contract and legitimate interest in security (art. 6.1.b and 6.1.f) |
| Google account (identifier, email and name), if you log in with Google | Let you log in with Google | Performance of a contract (art. 6.1.b) |
| Your QR content: destinations, rules, UTM parameters, contact, Wi-Fi, email, SMS or location details you enter, logos and design | Provide the service: redirect and show the information to people who scan your QR codes | Performance of a contract (art. 6.1.b) |
| Record of accepting the terms and, if ticked, marketing communications (version, date, language, pseudonymised IP and browser) | Prove your acceptance | Legal obligation and consent (art. 6.1.c and 6.1.a) |
| Email for marketing communications | Send you news and offers from QR Boost and Wandary, only if you agree | Your consent (art. 6.1.a); withdraw it in My account or in any email |
| Scan stats: country, device type and day | Show you how often your QR codes are scanned | Performance of a contract (art. 6.1.b) |
| QR code reports (anonymous): reported code, reason, any details you write and a pseudonymised IP identifier | Review abuse (phishing, scams) and prevent mass reporting | Legitimate interest in the security of the service (art. 6.1.f) |
| Our own audience measurement: page visited, date, country, website you came from (its domain only), the link's campaign (utm parameters) and two random identifiers (see section 3) | Learn how many people visit QR Boost and which pages are read, to maintain and improve it | Legitimate interest (art. 6.1.f), exempt from consent (art. 22.2 of the Spanish LSSI) |
People who scan your QR codes. When someone scans a QR code, we use their country (from their connection), device type, browser language and the time at that moment to choose the destination. We don't store their IP or any identifier: we only add one scan to the day, country and device-type counter. Bots and link previews don't count.
Third-party data in your QR codes. If a QR code includes other people's data (e.g. in a contact card), you're responsible for having their permission. That data is shown to whoever scans the code, which is its purpose.
3. Audience measurement
To know how many people visit QR Boost and which pages are read, the website counts visits itself, without Google Analytics or any other third-party tool. Each time you open a page on the website, your browser sends us the address of that page (without the domain and without any parameters that might carry your data) and two random identifiers. On the first page you open, it also sends us the website you came from, but only its domain (for example, google.com), never the full address, and, if the link carries one, the campaign it's tagged with (the utm_ parameters added by whoever publishes the link, such as the name of a newsletter or a social network). The click identifiers that some advertising platforms add to links (such as gclid or fbclid) are not stored. We add the date and time and the country you're connecting from, which is inferred from the connection. Your IP address is not stored. QR code scans are not part of this measurement (they have their own counter, described in the previous section), and neither are the administration pages.
The two identifiers are random numbers generated by your browser, and they don't contain or reveal your name, your email or your account:
- The visit identifier is kept in your browser's session storage (
qrb-visita, in sessionStorage) and is deleted when you close the tab. It's used to count visits. - The browser identifier is kept in its local storage (
qrb-navegador, in localStorage) together with the date it was created. It's used to count how many different people visit us and how many come back. It expires 13 months after it's created and isn't renewed by visits: after that a new one is created, unrelated to the previous one.
This measurement is used only to produce audience statistics for QR Boost: it isn't combined with any other data (not even with your account, if you have one), it isn't used for advertising or any other purpose, and it isn't shared with third parties. The data collected is deleted after 25 months.
Because it meets these conditions, this measurement is exempt from consent under article 22.2 of Spanish Law 34/2002 on information society services (LSSI), as set out in the Spanish Data Protection Agency's guide «Uso de cookies para herramientas de medición de audiencia» (use of cookies for audience measurement tools, January 2024). The legal basis for the processing is our legitimate interest in knowing how the service is used in order to maintain and improve it (article 6.1.f GDPR).
You can delete both identifiers at any time by clearing this site's data in your browser settings. On your next visit new ones will be created, unrelated to the previous ones.
4. Who we share data with (processors)
| Provider | Purpose | Location and safeguards |
|---|---|---|
| Amazon Web Services EMEA SARL (Paris region, EU) | Servers, database and file storage | EU |
| Twilio SendGrid | Sending emails (codes, welcome, account closure) | USA: EU-US Data Privacy Framework and standard contractual clauses |
| Google (Google sign-in and Web Risk) | If you choose, sign-in; and checking that QR code destinations aren't dangerous sites (only the destination addresses are sent) | USA: EU-US Data Privacy Framework and standard contractual clauses |
We don't sell your data or share it with third parties for their advertising.
5. How long we keep it
- Account, profile and QR codes: while you have an account.
- Sessions: until they expire (24 hours without use, or 30 days if you choose to stay signed in) or you close them.
- Login codes: valid for 10 minutes; deleted the next day.
- Security and consent records: while you have an account. When you close it, we only keep a pseudonymised record that the request was handled.
- Scan stats: they're anonymous and kept while the QR code exists.
- Audience measurement: 25 months; the browser identifier expires 13 months after it's created.
6. What happens when you close your account
We immediately and permanently delete your account, name, email, sessions, consents, associated records, logos and your QR codes' downloadable files. Your QR codes are not deleted: they're no longer linked to anyone and keep redirecting to their last destination, so nothing already printed breaks. Since no data remains linking them to you, we can't give you back control of them. If any of them contains personal data (e.g. a contact card) and you want it no longer shown, change or delete that QR code before closing your account.
7. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw your consents at any time, by writing to qrboost@wandary.com. You can close your account yourself from My account.
If you think we haven't handled your request properly, you can complain to the Spanish Data Protection Agency (www.aepd.es) or your local authority.
8. Security
We use encrypted connections (HTTPS and TLS to the database), secure session cookies whose token we only store hashed, one-time codes instead of passwords, attempt limits and IP pseudonymisation.
9. Children
QR Boost is not aimed at children under 14. If you're under 14, don't create an account.
10. Changes
If we change this policy significantly, we'll let you know on the website or by email.