Privacy Policy

Lavder QR is a QR code and short-link service operated by Lavder Enterprise SRL ("Lavder", "we", "us"). This policy explains what personal data we process when you use qr.lavder.com, why we process it, and the rights you have over it.

For any privacy matter, including data subject requests under the GDPR, contact us at [email protected].

We process three categories of data:

• Account data. Your name, email address, password hash, workspace membership and billing status. If you sign in with Google we receive your name, email address and Google account identifier; we never see your Google password.
• Scan analytics. When someone scans a dynamic code or opens a short link, we record the time of the visit, the approximate location derived from the IP address (country and city), the device type, operating system, browser and referrer. IP addresses are hashed with a salt before storage and are never kept in readable form. We do not build individual profiles of the people who scan your codes.
• Cookies. We set strictly necessary cookies to keep you signed in (httpOnly session and refresh tokens) and a small preference cookie for your workspace display and theme. We do not use advertising or cross-site tracking cookies.

We process account data to provide the service you signed up for (contract performance), scan analytics to deliver the reporting features that are the core of the product (contract performance and our legitimate interest in operating a measurable service), and security logs to protect accounts and infrastructure (legitimate interest). Billing data is processed to meet legal and tax obligations.

Data is stored on servers located in the European Union. Payments are handled by our payment processor, which receives only what it needs to charge you; we never store full card numbers. Transactional email providers receive the address and content of the messages we send you.

Account data is kept while your account is active and deleted within 30 days of account closure, except where the law requires longer retention (for example invoices). Scan analytics belong to your workspace and are deleted when you delete the related code, the workspace, or your account. Hashed IP records used for unique-visitor counting are rotated on an ongoing basis.

Under the GDPR you can ask for access to, correction of, deletion of, or a portable copy of your personal data, and you can object to or restrict certain processing. Write to [email protected] and we will answer within 30 days. You also have the right to lodge a complaint with your local supervisory authority.

For scan analytics, the workspace owner is the data controller and Lavder acts as processor. If someone scanned your code and you have questions about that data, please contact the organization that published the code first; we support them in answering your request.

We will announce material changes to this policy by email or in-app notice at least 14 days before they take effect. The date at the top reflects the latest revision.