Privacy policy

1. Who is responsible?

CSGOSMS is an independently operated web service based in the Netherlands and is responsible for processing personal data through GoQR. Address: Hilversumschelaan 17, Dronten. Chamber of Commerce number: 97195324. Privacy contact: privacy@goqr.online. General support is available through the contact page.

2. Data we process

• Account data, including name, email address, optional profile photo, account dates, accepted terms, Premium status, Premium end date, and account moderation status.
• QR content, including names, short codes, destination URLs, published text, social profiles, Wi-Fi credentials, locations, event details, opening hours, donation links, email templates, music-set artwork, status, moderation status, and change dates.
• Scan data, including date and time, shortened or anonymized IP address, browser user agent, referrer when supplied, and a country code when the hosting network or proxy supplies one. GoQR does not request the visitor's name or precise GPS location.
• Analytics email preferences and delivery records, including selected frequency, report period, delivery status, retry count, and delivery time.
• Payment and invoice data, including selected pass, amount, currency, provider payment identifier, status, access activation date, invoice number, invoice date, VAT breakdown, and delivery status of the invoice email. GoQR does not receive full bank or card details from Mollie.
• Spotify access and refresh tokens kept in the host's server-side session while the Music Quiz Scanner is connected. GoQR does not receive the host's Spotify password.
• Security and session data required to keep accounts signed in and prevent abuse, including the hashed account password, temporary hashed password-reset tokens, encrypted MFA secret, hashed one-time recovery codes, and MFA confirmation time.
• Administrative audit data, including the administrator, action, affected account or QR code, stated reason, date and time, IP address, browser information, and non-secret action context.

Information published through QR pages is publicly accessible through its QR short address. Wi-Fi passwords are therefore visible to anyone who can access the Wi-Fi page. Private music-set gift links provide access to the game and answers to anyone who receives the link. GoQR does not store account passwords, password-reset links, or MFA recovery codes in readable form.

3. Purposes and legal bases

We process account and QR data to provide the service requested by you. We process limited security and scan data for our legitimate interests in protecting GoQR, preventing misuse, operating redirects, and giving users useful scan statistics. Where the law requires consent, we request it separately.

4. Service providers and sharing

We only share data where necessary to operate GoQR, comply with law, or protect the service. QR images requested through the account may be generated through an external QR image service, which receives the short GoQR URL and technical request data. Premium payments are processed by Mollie. When a host connects the Music Quiz Scanner, Spotify receives the authorization and playback requests needed to list devices and control the selected device. Google provides optional Analytics and advertising services. These providers process data under their own terms and privacy information as well as the arrangements applicable to GoQR.

5. Retention

Account and QR data is kept while the account is active. QR scan records are intended to be retained for a maximum of 12 months, unless a shorter or longer period is required for security, legal claims, or user-requested statistics. Invoice and payment administration is retained for the period required by Dutch tax and accounting law. Password-reset links expire after 30 minutes and their temporary records are routinely removed. Deleted records may remain in restricted backups for a limited period.

6. Your privacy rights

Depending on the situation, you may request access, correction, deletion, restriction, portability, or object to processing. A logged-in user can download a machine-readable copy of their account, QR, scan, purchase, and design data from My profile after confirming the current password. Security secrets and password hashes are excluded from that download. You may also complain to the Autoriteit Persoonsgegevens. Contact us at privacy@goqr.online. We may need to verify your identity before handling a request.

7. Advertising on public content

GoQR may load Google AdSense on selected public pages containing substantial GoQR content or a public browser tool. Advertising is not loaded on account management, login, registration, checkout, payment, Spotify authorization, active scanner, or user-created QR destination pages. Premium access remains ad-free within the GoQR account experience.

Google may process device, browser, network, page, interaction, cookie, and consent information to select, deliver, measure, secure, and limit advertisements. Advertising choices for visitors in the EEA, the United Kingdom, and Switzerland are managed through a Google-certified consent management platform. Available advertising modes may depend on the visitor's region and consent choice.

8. Optional analytics

With your consent, GoQR uses Google Analytics 4 to understand page visits and general use of the service. Google Analytics is not loaded until you choose “Accept analytics” in the cookie banner. If you reject analytics, GoQR does not load the Google Analytics tag and the website continues to work normally.

When accepted, Google may process information such as visited pages, approximate location, device and browser information, referral information, interactions, and identifiers stored in analytics cookies such as _ga. We disable Google Signals and advertising personalization in our Analytics implementation. You can change your Analytics choice at any time with the “Cookie settings” button. Your preference is stored locally in your browser.

9. Security, cookies, and changes

GoQR uses password hashing, optional time-based multi-factor authentication, encrypted MFA secrets, hashed recovery codes, prepared database statements, CSRF protection, secure session settings, authorization checks, and IP anonymization for GoQR scan statistics. Registration and login forms use Google reCAPTCHA v3 to detect automated abuse. Google receives the technical information needed to calculate a risk score. This security check protects accounts and the service and is separate from optional Analytics consent.

The service uses an essential login session cookie. Optional Google Analytics cookies are only permitted after Analytics consent. Advertising cookies and similar storage are controlled through the configured advertising consent mechanism. We may update this policy when the service, providers, or law changes and will publish the current version here.

10. Questions and changes

Questions about this policy or the processing of personal data can be sent to privacy@goqr.online. Material changes are published on this page with an updated revision date.