Privacy Policy
What we collect, why, who sees it, and your rights. If you scanned a Qero tag you found, jump to "If you found a tag".
1. Who is responsible
The controller of your personal data is Sinisa Strosar, 64 Gort Fionnbarra, Ireland (see the Imprint). Contact for privacy questions: [email protected].
2. What we collect
Your account
Email address, username, first and last name (if you give them), a hashed password, and, if you use Google sign-in, your Google account identifier. We also keep when you last signed in.
Your tags, links and cards
Links, short slugs, QR settings, routing rules, notes, tag names, tag types and icons, and what you choose to put on a tag or card: contact details such as name, phone number and email address that can be shown to a finder when you switch reveal on.
Orders
Details needed to deliver your order and link the tag to your account, such as the delivery status and tracking reference. Orders for physical tags are taken and fulfilled by Shape and Shine Studio, which handles delivery details under its own privacy notice.
Scans and visits
When a Qero link, QR code or tag is opened we record the date and time, approximate location (country or region), device type, browser and operating system, the referring page, whether it came from a QR scan, and a hashed or pseudonymous visitor identifier. We do not record the visitor's name.
Sign-in codes and security
If you ask to reset your password we send a 6-digit one-time code to your email. We store only a hash of it, the time, and the IP address of the request, and the code expires after 10 minutes and can be used once. Our servers also keep technical logs for security.
Payments
If paid plans or online payments are used, they are processed by Stripe. We do not store full card details. We may keep Stripe customer and subscription references.
Support
Messages you send us and our replies.
3. Why we use it, and our legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Provide your account, links, QR codes, tags and dashboard | Contract |
| Show a finder your details when you switch reveal on, and tell you when your tag is scanned | Contract and your instruction |
| Process orders and payments | Contract; legal obligation (accounting and tax) |
| Sign-in, one-time codes, account security, preventing abuse and fraud | Legitimate interests (keeping the service and users safe) |
| Scan analytics for the owner of a link or tag | Contract; legitimate interests |
| Improving and measuring our website (where analytics cookies are used) | Consent |
| Support and complaints | Contract; legitimate interests |
If you found a tag (finders)
If you scanned a Qero tag you found, here is what happens to your information:
- What we record: that the tag was scanned, with date and time, approximate location (country or region), device and browser type, and a pseudonymous identifier. This is shown to the tag's owner as part of their scan history.
- If you choose to contact the owner (for example by entering your email or a message), we pass what you enter to the owner so they can reply. Only enter what you are happy for them to see.
- Why: to help get the item back to its owner (our legitimate interests, and the owner's interests, in reuniting people with lost property).
- You do not need an account and we do not ask for your name unless you give it.
- Your rights in section 9 apply to you too. To ask about or delete something you sent, email [email protected].
4. Cookies and similar technologies
We use essential cookies to keep you signed in and for security and basic site function. These do not need consent. If we use analytics or other non-essential cookies, we ask for your consent first and you can withdraw it at any time.
5. Who we share data with
We do not sell personal data. We use service providers (processors) only to run Qero, including:
- web hosting and content-delivery providers (hosting and network security);
- Stripe, for payments;
- Google, for sign-in with Google and, if enabled and consented to, analytics;
- email delivery for messages such as one-time codes;
- Shape and Shine Studio, which makes and ships tags and handles orders.
We may also disclose data where the law requires it or to protect people from harm.
6. Transfers outside the EEA
Some providers may process data outside the European Economic Area. Where they do, we rely on an adequacy decision or Standard Contractual Clauses, or another safeguard allowed by GDPR.
7. How long we keep data
- Account, tag and link data: while your account is open. When you close it we delete or anonymise it, except what we must keep by law.
- Scan history: while the tag or link exists, or until you delete it.
- Orders and invoices: as long as tax and accounting law requires.
- One-time codes: valid for 10 minutes, one use.
- Security logs: only as long as needed for security.
8. Security
Passwords and one-time codes are stored hashed, connections use HTTPS, and tag contact details are hidden until the owner chooses to reveal them. No system is completely secure, so please use a strong, unique password.
9. Your rights
You have the right to access your data, correct it, have it deleted, restrict or object to its use, receive it in a portable format, and withdraw consent at any time. To use any of these, email [email protected]. We will reply within one month.
You can also complain to the Irish Data Protection Commission at dataprotection.ie, or to the authority in your own country.
10. Automated decisions
We do not make decisions about you that have legal or similarly significant effect by automated means.
11. Children
Qero accounts are for adults. We do not knowingly collect data from children. If you think a child has given us personal data, contact us and we will delete it.
12. Third-party links
Qero links and QR codes can redirect to other websites. We are not responsible for their content or privacy practices.
13. Changes to this policy
If we make a significant change we will tell you by email or in your account before it takes effect. The current version is always on this page.