Privacy Policy

1. What this policy covers

QList is a service for creating QR codes with scan analytics and for forwarding HTML form submissions by email. This policy explains what personal data we handle, why, which services we rely on, how long we keep data, and what rights you have. It applies to the website qlist.io, the application at app.qlist.io, QR codes that redirect through qlist.io, and forms that submit to api.qlist.io.

2. Two roles: when we decide, and when our customers decide

Under the General Data Protection Regulation (GDPR) we act in two different roles, and which one applies to you depends on how you came into contact with QList.

• We are the controller for people who visit qlist.io, create an account, or contact us. We decide what is collected and why. Sections 3a, 3d and 3e describe this.
• We are a processor for data generated when someone scans a QR code created by one of our customers, or submits a form that one of our customers has connected to QList. The customer (the owner of the code or form) is the controller; we process that data on their instructions, which are set out in our Terms and Conditions. Sections 3b and 3c describe this. If you scanned a code or filled in a form on another organisation's website or printed material, that organisation is responsible for the data and you should contact them first. We will help them respond to you.

3. What data we collect

a. Account holders (we are the controller)

• Email address, used to sign in (one-time code by email) and to contact you about the service.
• If you sign in with Google: the email address, name and account identifier Google shares with us. We do not receive your Google password.
• Name and organisation details if you enter them.
• Settings you configure, including the recipient email addresses for your forms, your Google reCAPTCHA or Cloudflare Turnstile keys (stored encrypted), and a Telegram chat identifier if you link a Telegram chat for notifications.
• The QR codes, groups, forms and files you create. Uploaded files and generated contact cards (vCards) are stored so that your QR codes can serve them.

b. People who scan a QR code (we are the processor; the code owner is the controller)

Every QList QR code points at a short link on qlist.io. When the code is scanned, we redirect the visitor to the destination the code owner has set and record the scan. For each scan we store:

• the date and time;
• the IP address of the device;
• the browser's user-agent string, from which we derive the device type and operating system;
• an approximate location derived from the IP address (country, region, city and approximate coordinates), together with an indication of whether the address belongs to a data centre or anonymising network. For this we send the IP address to ipapi.is, a geolocation service based in Germany; if that service is unavailable, the lookup is done on our own server using the GeoLite2 database created by MaxMind.
• a "bot" score that estimates whether the request came from an automated tool (for example a link-preview crawler) rather than a person, calculated from the above.

Nothing is installed on the scanning device and no account is needed. We do not learn the name or identity of the person scanning. The code owner sees this data in their dashboard, grouped by country, city, time and device.

c. People who submit a form (we are the processor; the form owner is the controller)

When a form connected to QList is submitted, we receive and store:

• every field the form sends, exactly as the form owner designed it (typically name, email address and a message);
• the IP address of the device that submitted it;
• whether the submission succeeded or was rejected (for example by spam protection);
• if the form owner has enabled Google reCAPTCHA or Cloudflare Turnstile, the verification token, which we send to Google or Cloudflare to check. Those services may set their own cookies on the page where the form is shown; the form owner's website is responsible for that.

We forward the submission by email to the address(es) the form owner has configured and, if they have linked a Telegram chat, as a Telegram message. The submission is kept in the form owner's dashboard history.

d. Visitors to qlist.io and app.qlist.io

• Analytics (only with your consent): we use Google Tag Manager and Google Analytics to understand how the website is used (pages visited, approximate location, device and browser, referring site). These tools are blocked until you accept them in the cookie banner. See section 5.
• Server logs: our API records the path requested, the IP address and the user-agent string of each request for security and troubleshooting. These logs are deleted after 30 days.
• Error reports: when something breaks, a report is sent to our error-monitoring service (Sentry) with technical details. Request bodies, cookies and authorisation headers are removed before sending so that form contents and sign-in data are not included.

e. The contact form on qlist.io

Our own contact form is a QList form. What you enter is handled as described in 3c, with us as the controller, and is used only to answer you.

4. Why we use the data and on what legal basis

• Providing the service (creating an account, redirecting QR codes, delivering form submissions, showing analytics to the owner): performance of a contract, Article 6(1)(b) GDPR, or processing on the customer's instructions where we are a processor.
• Security, abuse prevention and troubleshooting (server logs, bot scoring, error reports, spam protection): our legitimate interest in running a reliable and safe service, Article 6(1)(f).
• Website analytics (Google Analytics): your consent, Article 6(1)(a), given through the cookie banner and withdrawable at any time.
• Service announcements (for example, telling you in advance about any change to pricing): performance of a contract and legitimate interest. We do not send marketing newsletters.
• Legal obligations: Article 6(1)(c), where we are required to keep or disclose data.

5. Cookies and similar technologies

qlist.io shows a cookie banner on your first visit. Until you choose, Google's consent mode is set to "denied" for analytics, advertising and personalisation storage, and no analytics cookies are set. Your choice is stored in your browser (localStorage key consentMode) and can be changed at any time with the cookie icon in the bottom-left corner. We also store your language preference (langPref) in your browser if you dismiss or use the language switcher; this is not a tracking cookie.

app.qlist.io uses the cookies and local storage needed to keep you signed in. These are strictly necessary and do not require consent.

Forms embedded on our customers' websites do not set cookies by themselves. If the form owner enables Google reCAPTCHA or Cloudflare Turnstile, those providers may set cookies on the customer's site under the customer's responsibility.

6. Who we share data with

We do not sell personal data. We use the following service providers (processors), each bound by a data processing agreement:

We may also disclose data where required by law, a court order or a public authority, and to professional advisers under confidentiality.

7. International transfers

Our database and file storage are in the European Union. Some providers in section 6 (Google, Sentry, Resend, Telegram, and parts of Render's and Cloudflare's networks) may process data in the United States or elsewhere outside the European Economic Area. Where that happens we rely on the European Commission's adequacy decisions (including the EU-US Data Privacy Framework for certified providers) or on Standard Contractual Clauses, together with technical measures such as encryption in transit.

8. How long we keep data

• Account data: for as long as the account exists, then deleted within 30 days of a deletion request.
• QR codes, scan logs, forms and submissions: until the owner deletes the code, form or account. Owners can delete individual codes and forms in the dashboard; deleting a code removes its scan log, deleting a form removes its submission history.
• Uploaded files and vCards: until the associated QR code is deleted.
• Server request logs: 30 days.
• Error reports: up to 90 days, per Sentry's retention.
• Emails sent through Resend: delivery logs are kept by Resend for a limited period for deliverability troubleshooting.
• Cookie consent and language preference: in your browser until you clear it.

9. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to processing, including processing based on legitimate interest;
• withdraw consent at any time (for analytics, use the cookie icon on this site);
• receive the data you provided in a portable format;
• lodge a complaint with a supervisory authority. In Slovenia this is the Information Commissioner (Informacijski pooblaščenec), www.ip-rs.si. You may also complain to the authority of the EU country where you live.

To exercise these rights, email info@qlist.io from the address linked to your account, or describe the QR code or form in question. We answer within one month. If your request concerns a scan or a form submission on another organisation's code or website, we will forward it to that organisation and assist them, because they are the controller of that data.

10. Security

• All connections to qlist.io, app.qlist.io and api.qlist.io use HTTPS.
• Each customer's data is isolated at the database level (row-level security), so one customer cannot read another's codes, scans or submissions.
• Captcha secret keys you store with us are encrypted at rest.
• Sign-in uses one-time codes or Google sign-in; we never store a password.
• Form contents and sign-in data are stripped from error reports before they leave our servers.
• Access to production systems is limited to the operator and protected by multi-factor authentication.

No system is perfectly secure. If we become aware of a breach affecting your data, we will inform you and the supervisory authority as the GDPR requires.

11. Children

QList is not intended for children under 16 and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

12. Changes to this policy

We will publish any change on this page with a new effective date. If a change materially affects how your data is used, account holders are told by email before it takes effect.

13. Contact

FRISEMA d.o.o., Koliška ulica 17B, Vir, 1230 Domžale, Slovenia
Registration number 8379025000, VAT ID SI45732507
info@qlist.io

See also our Terms and Conditions. Customers who need a signed data processing agreement for the scans and form submissions we process on their behalf can request one at info@qlist.io.