Legal

Privacy Statement

Last updated: 2 November 2026

QRControl is designed around data minimisation and European digital sovereignty. We process as little personal data as possible, use European infrastructure for the services we select, and store your QR records in your own AT Protocol Personal Data Server (PDS) rather than in a central QRControl database.

This Privacy Statement explains which personal data QRControl processes, why we process it, and how we protect your privacy under the General Data Protection Regulation (GDPR).

1. Who is responsible?

QRControl is operated by:

Enterprise number: 0698.712.081
VAT number: BE 0698.712.081

Email: info@allagis.be

For the processing described in this Privacy Statement, the QRControl operator is the data controller unless stated otherwise.

2. Personal data we process

QRControl processes only a limited amount of personal data necessary to provide and secure the service.

Our legitimate interest is to operate QRControl securely and reliably, detect technical problems and protect the service against misuse.

QRControl does not require your name, postal address, telephone number or other conventional identity information to provide the service.

3. Your QR data and AT Protocol

QRControl is built on the AT Protocol.

When you create a QR code, the canonical QR record is stored in your own ATProto repository on your PDS. QRControl does not maintain a central database containing copies of users' QR records.

These records include information such as the QR title, destination URL and timestamps. Information stored in an ATProto repository should be considered public data. You should therefore not use QRControl to store confidential or secret destination URLs.

QRControl uses your ATProto identity to locate your current PDS and to read or update your QR records when you ask QRControl to do so.

Your PDS is operated by the PDS provider associated with your ATProto account. You choose that provider independently of QRControl.

4. Authentication

QRControl uses ATProto OAuth to let you connect your ATProto account and authorise QRControl to perform the operations required for the service.

QRControl never asks for your PDS password, recovery key or private cryptographic keys.

OAuth and session information is processed only as necessary to authenticate you, maintain an authorised session and perform the operations you have authorised.

5. Privacy-friendly analytics

We want to understand how QRControl is used without tracking the people using it.

For this reason, QRControl uses Simple Analytics, a European privacy-focused analytics service, instead of conventional behavioural analytics and advertising platforms.

QRControl measures website page views using a fixed Simple Analytics script protected by Subresource Integrity. It collects visits even when browser Do Not Track (DNT) is enabled. Referrer and campaign data are disabled. Browser analytics does not use cookies or persistent visitor identifiers. The browser sends technical metrics such as browser, screen size, language, time zone, time on page and scroll depth to Simple Analytics. The provider receives the connection IP address but states that it does not store it. Visitors in the dashboard are estimated visits, not identified unique people. QR redirect pages and OAuth callback responses do not load this tracker. When a public QR code resolves successfully, the server sends a best-effort scan event containing an opaque QR identifier to Simple Analytics. It does not send the raw account identity, QR title, destination URL, record identifier, visitor IP address or visitor user-agent.

We do not use analytics to create individual user profiles, follow visitors across websites or build advertising profiles. Browser Do Not Track (DNT) settings do not affect these server-side scan events.

6. Infrastructure providers

QRControl uses only European providers for the infrastructure and services that we select ourselves. This is a requirement of our architecture, not a preference.

Gcore provides DNS, TLS, CDN and reverse-proxy services. Gcore was selected because it is a European provider, allowing us to operate QRControl’s edge and delivery infrastructure under EU jurisdiction.

Scaleway provides the container infrastructure and application runtime on which QRControl operates. Scaleway is a European cloud provider and allows QRControl to run its application infrastructure within the European Union.

Simple Analytics receives browser page views and separate server-side successful QR-scan events. It is a European provider whose privacy-focused analytics model allows us to obtain basic usage statistics without conventional individual visitor tracking.

Where these providers process personal data on our behalf, they are required to process that data in accordance with applicable data protection requirements.

QRControl also communicates with the PDS associated with your ATProto account and with infrastructure required to resolve ATProto identities. Where possible, QRControl uses EU-based ATProto infrastructure provided, managed and operated by Eurosky. However, because ATProto is a decentralised ecosystem, some infrastructure may be selected by the user or determined by the ATProto network rather than by QRControl itself.

7. Data location and international transfers

QRControl selects only European infrastructure and service providers for the services under its control.

Our architecture is designed to keep the processing we directly organise within the European Economic Area and to avoid international data transfers.

Your PDS is different because it is not selected or controlled by QRControl. AT Protocol gives you the freedom to choose the provider that hosts your personal repository and to use QRControl independently of that choice.

If you choose a PDS outside the EEA, the location and data-processing arrangements of that PDS result from your independent choice of PDS provider and fall outside QRControl's selection and control.

For users who want their ATProto data hosted in Europe, we recommend EuroSky, which provides European ATProto PDS hosting.

8. How long do we keep personal data?

Authentication and session data: authentication data is kept only for as long as needed to maintain your authorised session. It expires when the session expires, is revoked, or you sign out.

Technical and security logs: our infrastructure providers may retain network, security and operational logs for limited periods in accordance with their configured retention policies. QRControl does not retain these logs longer than necessary for security, troubleshooting and service operation.

9. Your data and your GDPR rights

QRControl processes the limited identifiers and technical information described above when you use the service, but does not maintain a central personal-data database containing your account, profile or QR records.

Your QR records are stored in your own ATProto repository and can be managed there independently of QRControl.

Under the GDPR, you retain the rights applicable to personal data processed by QRControl. Because QRControl deliberately avoids centrally storing personal data, QRControl will have no stored personal data about you that can be retrieved, corrected or deleted. Only authentication and session data, as well as technical or security-related data such as IP addresses, are retained for limited periods.

Use the contact details specified in the General Terms for questions concerning personal data.

You also have the right to lodge a complaint with the competent data protection authority. In Belgium, this is the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données).

10. Automated decision-making and profiling

QRControl does not use your personal data for profiling or automated decision-making that produces legal or similarly significant effects.

11. Changes to this Privacy Statement

We may update this Privacy Statement when QRControl, its infrastructure or applicable legal requirements change.

The current version will always be published on the QRControl website. Material changes affecting how personal data is processed will be communicated appropriately.