Who is responsible

The name of the operator of qrme.to is not published yet.

Each code belongs to an organization that uses qrme.to to create it. That organization chooses where its code leads and sees the scan statistics of its codes.

What a scan records

When you open the short link of a code (such as qrme.to/abc123) or a page it shows, the service records:

  • the date and time;
  • the IP address of your device or network;
  • the approximate country and city of that address, looked up in a database kept on the server itself (the address is not sent to a location service);
  • your browser's user agent, which names the type of device, its operating system and the browser;
  • the referring page, when your browser sends it;
  • whether the visit looks automated, such as a link preview;
  • a visitor key: a code computed from the address and the browser that changes every day, used to count approximate unique visitors.

Opening a code does not ask for your name, phone number or the location of your device.

Why

To show the organization that owns a code how it is used (number of scans, times, countries and devices), and to protect the service and its visitors from abuse: limits on repeated requests, the daily limits an organization may set, and investigating harmful links.

The legal basis is the legitimate interest of running and protecting the service (Article 6, paragraph 4 of the Personal Data Protection Law). No sensitive data is processed. Recording the scan is part of how a short link works: it happens whenever the link is opened.

Cookies

Opening a short link sets no cookie. Only codes protected by a password use cookies: their password form sets a security cookie against forged submissions, and submitting it sets a session cookie that keeps the code unlocked in your browser.

How long it is kept

Scan records are not deleted automatically yet: a retention period has not been set. When one is set, it is shown here.

Daily totals (the number of scans and of approximate visitors per day) contain no address and are kept while the code exists. When a code is deleted, its scan records are deleted with it when it leaves the trash, 30 days later.

Counters that limit repeated requests and password guesses hold the address for at most 15 minutes.

Where it is stored

On servers of Hetzner Online GmbH in Germany, outside the Kingdom of Saudi Arabia. Encrypted backup copies are kept with a cloud storage provider.

Members of the organization that owns a code see its scans in their dashboard. The people who operate qrme.to can see them to run and protect the service.

Your rights

Under the Personal Data Protection Law you may ask to be told how your data is processed, to access it and receive a copy, to have it corrected or completed, and to have it destroyed when it is no longer needed.

A scan record carries no name. So that your records can be found, include the short link you opened, the approximate date and time and, if you know it, your IP address.

The contact address for privacy requests is not published yet. Meanwhile, you can ask the organization whose code you scanned.

You may also complain to the Saudi Data & AI Authority (SDAIA).