Introduction

IllumiNode LLC ("we," "our," or "us") operates QREasy (qreasy.eu), a professional QR code generation and management platform. We are committed to protecting your privacy and ensuring transparency about how we collect, use, and safeguard your personal information.

This Privacy Policy explains our data practices in compliance with the General Data Protection Regulation, California Consumer Privacy Act, and other applicable privacy laws. By using QREasy, you agree to the collection and use of information as described herein.

Data Controller and EU Representative

Data Controller: IllumiNode LLC
Address: 16192 Coastal Highway, Lewes, Delaware 19958, USA
Email: contact@qreasy.eu
EU Representative: [Name, Address, and Contact Information of EU Representative]
If you are an EU resident, you may contact our EU representative for privacy-related concerns.

Information We Collect

1. Account Information

Email address and encrypted password for authentication
Name and profile information (optional)
Billing and payment information processed securely via Stripe; we never store full credit card details

2. QR Code Data

Static QR codes generated without signing in: processed client-side in your browser only, never stored on our servers.
Dynamic QR codes: We store destination URL, title, and configuration for management on your dashboard.
Static QR codes saved to account: stored configurations only; actual code generation remains client-side.

3. Analytics & Scan Tracking (Dynamic QR Codes Only)

Anonymized IP addresses (last octet removed for GDPR compliance)
Geographic location limited to country and city level (no precise coordinates)
Device type classification (mobile, tablet, desktop) inferred without storing full user-agent strings

4. Technical & Usage Information

Browser type and version
Operating system
Log data including access times, pages viewed, actions, error logs

How We Use Your Information

Service delivery: maintain and improve QR code services including analytics and wallet passes
Analytics and insights: generate aggregate usage statistics to help optimize your campaigns
Communication: send account and billing notifications, service updates, and support responses; no unsolicited marketing without consent
Security and fraud prevention: detect misuse, unauthorized access, and enforce service policies
Legal compliance: respond to lawful requests and protect rights

Data Retention

Static QR codes (unsigned): not stored on servers
Dynamic QR codes: data retained only while codes are active; deleted data removed within 24 hours
Analytics data: deleted after 12 months to minimize retention

Your Rights Under GDPR

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights:

Right of Access to your personal data
Right to Rectification
Right to Erasure ("Right to be Forgotten")
Right to Data Portability (data in structured JSON format)
Right to Restriction of Processing
Right to Object to processing for legitimate interests, including opting out of analytics
Right to Withdraw Consent at any time where relevant
Right to lodge a complaint with a supervisory authority

Data Sharing & Third-Party Services

We share data only with trusted service providers strictly necessary for operation:

Supabase (database & authentication; EU data center in Frankfurt, Germany, AWS eu-central-1. Supabase, Inc. is a US company; any access from outside the EU is covered by GDPR-compliant Standard Contractual Clauses)
Stripe (payment processing; PCI DSS compliant)
Vercel (hosting & CDN; global with EU data residency options)

Security Measures

TLS 1.3 encryption for data in transit
AES-256 encryption at rest for sensitive data, bcrypt for passwords
Access control limiting data access on a need-to-know basis

Cookies & Tracking Technologies

Essential cookies: required for authentication and service functionality
Analytics cookies: track anonymized usage; opt-out available via browser settings
Preference cookies: remember language, theme, and customization

Children's Privacy

QREasy is not intended for users under 16 years old. We do not knowingly collect data from children under 16. If you believe we have collected such data, contact us immediately at privacy@qreasy.eu to have it deleted.

Changes to This Privacy Policy

We may update this policy to reflect legal requirements or service changes. Significant updates will be communicated by email or prominent site notice. Continued use constitutes acceptance of changes.

Contact Us

For privacy-related questions or to exercise your rights, please contact:
privacy@qreasy.eu

Google Drive Files in Microsite Downloads

If you use Google Drive with a microsite Downloads section, QREasy requests only the non-sensitive Google Drive file scope for files you select or upload through the Google Picker. We do not request broad read-only access to your entire Drive.

QREasy stores the selected file name, MIME type, size, Google file ID, provider share URL, and download/open URL so the file can be shown on your microsite.
QREasy does not browse all Drive files, does not store Google refresh tokens, and does not use Google Drive data for advertising or AI/ML model training.
For a selected non-Google file, QREasy asks Drive to allow anyone with the link to read that file so visitors can use the microsite download. If Drive cannot update access, QREasy warns you and visitors may need permission until you update the sharing setting manually.
Removing a download item or deleting the microsite removes the stored Drive file metadata from QREasy. The original file remains in your Google Drive unless you delete it there.

OneDrive Files in Microsite Downloads

If you use OneDrive with a microsite Downloads section, QREasy uses the Microsoft picker so you can select one file from your personal OneDrive. QREasy requests read-only picker access for selection and asks for Microsoft Graph Files.ReadWrite only if you confirm that QREasy should create or reuse a read-only visitor sharing link for that selected file.

QREasy stores the selected file name, MIME type, size, OneDrive file ID, provider share URL, and open URL so the file can be shown on your microsite.
QREasy does not store Microsoft refresh tokens and does not store Microsoft Graph temporary download URLs.
If Microsoft cannot create an anyone-with-the-link sharing URL, QREasy falls back to the regular OneDrive link and warns you that visitors may need permission.
Removing a download item or deleting the microsite removes the stored OneDrive file metadata from QREasy. The original file remains in your OneDrive unless you delete it there.

Affiliate Program Data and Referral Tracking

QREasy processes affiliate applications, agreement acceptances, referral attribution, commission records, and payout status to operate the Affiliate Program. Stripe hosts identity and payout onboarding. QREasy receives connected-account and payout status, but does not store raw bank-account details or identity-verification documents.

Referral activity may include a random anonymous identifier, affiliate and campaign identifiers, the QREasy destination, sanitized referrer and UTM values, consent state, timestamps, coarse country where permitted, and fraud or bot classifications.
With the relevant consent, QREasy may store a signed first-party referral cookie for the configured attribution period. If persistent tracking is refused, signed session-only referral state may be used and expires with the browser session.
Affiliates receive aggregate reporting. They do not receive referred-customer names, email addresses, payment details, complete IP addresses, or other unnecessary personal information.
Application, contract, accounting, fraud-prevention, commission, and payout records are retained only for documented operational and legal periods. Individuals may exercise applicable privacy rights through QREasy's published privacy contact.

Read the complete Affiliate Privacy and Cookie Notice.

Optional subscription measurement

If you accept optional cookies, we can link your account to the browser identifier used by Google Analytics. We send the invoice reference, amount paid in euros, plan and billing period to Google Analytics when a subscription payment succeeds, including after a trial or at renewal. We do not send your name, email, card details or website content in these events. This measurement is separate from the free statistics for your QREasy website.

This permission expires after 180 days unless you make a new choice. We keep your current choice with your account, remove expired browser identifiers, and keep invoice delivery records for up to 90 days. Deleting your account removes these local records. Google Analytics has its own configured retention period.

Open Cookie settings and choose Necessary only to stop future optional measurement and cancel events waiting to be sent. On this browser, a protected cookie also lets you withdraw after signing out. On another browser, sign in first to update your account choice. A request already being sent cannot be recalled; contact us about deletion of data already received. Required billing records in Stripe are unaffected.