Privacy policy

Lumitra QR (qr.lumitra.co) is a dynamic QR code service operated by Marlin Jai Pohl, Grumbkowstr. 6, 13156 Berlin, Germany. Contact: marlin@lumitra.co. For account holders we are the data controller. For people who scan a customer's QR code, our customer is the controller and we process scan data on their behalf.

We store the data you give us and what the service needs to run:

• Email address, name, and a hashed password (or your Google/GitHub identity if you sign in with them).
• Your links, QR codes, custom domains, and plan and billing state.
• Payment processing happens at Stripe; we never see or store card numbers. Stripe's processing is described in their own privacy policy.
• Transactional emails (trial and billing notices) are sent through Resend from qr@lumitra.co.
• Your interface language, if you set one.

Account data is kept while the account exists and deleted on account deletion, except records we must keep for tax and accounting law.

When you scan a code served by us, we redirect you to the destination the code's owner configured. About that scan we record:

• Coarse location derived at the network edge: country, city, region.
• Device class (mobile, tablet, desktop) and operating system family.
• The time of the scan and which link was scanned.

We deliberately do not store your IP address, your full browser fingerprint or user agent string, or any identifier that could recognise you across scans. There are no cookies on the redirect. Location and device events are deleted after at most 90 days; anonymous daily scan totals per link are kept for up to one year; beyond that only an anonymous lifetime total per link remains.

This processing runs on Cloudflare's network under our instructions and those of the code's owner, on the legal basis of legitimate interest (Art. 6(1)(f) GDPR) in measuring whether printed material works, in a way designed not to identify anyone.

The service runs on Cloudflare (hosting, DNS, storage). Data is processed in Cloudflare's network, which may include processing outside the EU under their standard contractual clauses.

Under the GDPR you can request access, correction, deletion, restriction, and portability of your personal data, and object to processing based on legitimate interest. Write to marlin@lumitra.co. You can also complain to a supervisory authority; for us that is the Berliner Beauftragte für Datenschutz und Informationsfreiheit.