Privacy

Who is responsible

Sure-QR is operated by Driiv Works AS, org. no. 828 135 562, Bratsbergvegen 2E, 7031 Trondheim, Norway. Driiv Works AS is the data controller for the data described on this page. For privacy questions, data access or deletion requests, write to post@sure-qr.com.

Static codes collect nothing at all

A static code is generated in your browser and the destination is encoded into the image. When someone scans it, their phone goes straight to that destination without ever contacting Sure-QR. There is no request for us to see, so there is nothing for us to record — for you or for the person scanning.

Aggregate website analytics

Our hosting platform measures aggregate traffic on the published website, including visitors, page views, visit duration, bounce rate, traffic sources, device types and countries. It does not build profiles of visitors or follow people across separate visits. This website traffic measurement is separate from the scan-event data described below.

What we record for a dynamic scan

A dynamic code resolves through our redirect. For each scan we store one row containing:

• The code that was scanned.
• The time of the scan.
• A country, and where available a city, derived from the network request.
• A broad device type: mobile, tablet or desktop.

What we never store

• Raw IP addresses. The address is used in memory to resolve a country and city while the request is being handled, and is discarded when the response is sent. It is not written to the database, in hashed, truncated or any other form.
• Cookies. The redirect sets none.
• Device fingerprints. We do not build or store any identifier that could link one scan to another.
• The full user-agent string. Only the resulting mobile, tablet or desktop label is kept.

Because of this, scan rows cannot be traced back to an individual and we cannot tell whether two scans came from the same person.

Why we are allowed to do this

Our lawful basis for processing scan data is legitimate interest: producing aggregated, anonymised statistics so the owner of a code can tell whether their printed material is working. The data is coarse by design — a country, a city and a device class — and is not used for advertising, profiling or resale.

How long we keep it

Individual scan events are kept for 24 months. After that they are rolled up into daily totals by country and device type, and the individual rows are deleted. The aggregate totals contain no timestamps beyond the day and no location detail beyond the country.

Account data

If you create an account we store your email address, the codes you create, and — if you subscribe — a customer and subscription reference from our payment provider. Card details are handled by the payment provider and never reach us. Logos you upload with a saved code are stored privately and are readable only by your own account.

To have your account and its data deleted, email post@sure-qr.com from the address on the account.