Privacy policy

1. Who is responsible?

GoQR is responsible for processing personal data through GoQR. Address: [Add business address]. Chamber of Commerce number: [Add Chamber of Commerce number]. Privacy contact: privacy@goqr.online.

2. Data we process

• Account data, including name, email address, hashed password, account dates, accepted terms, Premium status, and Premium end date.
• QR content, including names, short codes, destination URLs, published text, social profiles, Wi-Fi credentials, locations, event details, opening hours, donation links, email templates, music-set artwork, status, and change dates.
• Scan data, including date and time, shortened or anonymized IP address, browser user agent, and referrer when supplied.
• Payment data, including selected pass, amount, currency, provider payment identifier, status, and access activation date. GoQR does not receive full bank or card details from Mollie.
• Spotify access and refresh tokens kept in the host's server-side session while the Music Quiz Scanner is connected. GoQR does not receive the host's Spotify password.
• Security and session data required to keep accounts signed in and prevent abuse.

Information published through QR pages is publicly accessible through its QR short address. Wi-Fi passwords are therefore visible to anyone who can access the Wi-Fi page. Private music-set gift links provide access to the game and answers to anyone who receives the link. GoQR does not store account passwords in readable form.

3. Purposes and legal bases

We process account and QR data to provide the service requested by you. We process limited security and scan data for our legitimate interests in protecting GoQR, preventing misuse, operating redirects, and giving users useful scan statistics. Where the law requires consent, we request it separately.

4. Service providers and sharing

We only share data where necessary to operate GoQR, comply with law, or protect the service. QR images are generated through an external QR image service, which receives the short GoQR URL and technical request data. Premium payments are processed by Mollie. When a host connects the Music Quiz Scanner, Spotify receives the authorization and playback requests needed to list devices and control the selected device. Google provides optional Analytics and advertising services. Before production launch, complete the provider details and verify the relevant processing agreements.

5. Retention

Account and QR data is kept while the account is active. QR scan records are intended to be retained for a maximum of 12 months, unless a shorter or longer period is required for security, legal claims, or user-requested statistics. Deleted records may remain in restricted backups for a limited period.

6. Your privacy rights

Depending on the situation, you may request access, correction, deletion, restriction, portability, or object to processing. You may also complain to the Autoriteit Persoonsgegevens. Contact us at privacy@goqr.online. We may need to verify your identity before handling a request.

7. Advertising on Free pages

GoQR may load Google AdSense on account pages and public QR information pages belonging to users without active Premium access. Premium account pages and public QR pages belonging to an active Premium account do not receive the AdSense script. Login, registration, payment, Spotify authorization, and active scanner pages are excluded.

Google may process device, browser, network, page, interaction, cookie, and consent information to select, deliver, measure, secure, and limit advertisements. Advertising consent for visitors in the EEA, the United Kingdom, and Switzerland must be managed through a Google-certified consent management platform. Choices and available advertising modes may depend on the visitor's region and the configured Google consent message.

8. Optional analytics

With your consent, GoQR uses Google Analytics 4 to understand page visits and general use of the service. Google Analytics is not loaded until you choose “Accept analytics” in the cookie banner. If you reject analytics, GoQR does not load the Google Analytics tag and the website continues to work normally.

When accepted, Google may process information such as visited pages, approximate location, device and browser information, referral information, interactions, and identifiers stored in analytics cookies such as _ga. We disable Google Signals and advertising personalization in our Analytics implementation. You can change your Analytics choice at any time with the “Cookie settings” button. Your preference is stored locally in your browser.

9. Security, cookies, and changes

GoQR uses password hashing, prepared database statements, CSRF protection, secure session settings, authorization checks, and IP anonymization for GoQR scan statistics. Registration and login forms use Google reCAPTCHA v3 to detect automated abuse. Google receives the technical information needed to calculate a risk score. This security check protects accounts and the service and is separate from optional Analytics consent.

The service uses an essential login session cookie. Optional Google Analytics cookies are only permitted after Analytics consent. Advertising cookies and similar storage are controlled through the configured advertising consent mechanism. We may update this policy when the service, providers, or law changes and will publish the current version here.

10. Official guidance

This draft follows the transparency topics described by the European Commission and Dutch supervisory guidance. It is not a substitute for legal advice or a processing register.