Privacy policy

1. Who is responsible

Runless AS is the data controller for account data and for the analytics we derive from scans. Contact us at support@example.com.

2. If you only make a free static code

We collect nothing about your code. Static codes are generated in your browser: the URL you paste, the design you choose and the file you download never reach our servers. There is no account, no email address and no record of what you made.

3. Account data

• Your email address, used to sign in and to send transactional email.
• Your workspace name, plan and subscription status.
• Your QR codes: name, type, destination, design and destination history.
• Files you upload, such as logos and PDFs.
• Basic security logs: sign-in times and coarse request metadata, kept for a short period to investigate abuse.

Payment details are handled by our payment provider. We receive the plan, the amount, the status and the last four digits, and never the full card number.

4. Scan data, and what we choose not to keep

When someone scans a dynamic code, we record:

• the time of the scan;
• an approximate location, at country and city level;
• the device category, operating system family and browser family;
• the referrer, when the scan came from a link rather than a camera.

We do not store raw IP addresses. To count returning visitors we compute a keyed hash over coarse request signals using a salt that rotates every day. The same person is countable within one day and cannot be linked across days, and the original address is never written down. We do not set cookies on the redirect, do not fingerprint devices, do not track people across sites, and do not sell or share scan data.

5. How long we keep things

6. Why we are allowed to process it

• Contract - running your account, serving your redirects, taking payment.
• Legitimate interests - keeping the service secure, preventing abuse, and producing aggregate scan statistics for the customer whose code was scanned.
• Legal obligation - keeping invoices and responding to lawful requests.

7. Who else is involved

We use a small number of processors: hosting and database infrastructure, a payment provider, an email delivery provider, and object storage for uploaded files. They act on our instructions and are bound by contract. Where data leaves the EEA it is covered by standard contractual clauses.

Our marketing pages use Google Ads conversion measurement so we can tell which advertising pays for itself. It runs on the public pages, not on the redirect path, so people scanning your codes are not measured for advertising.

8. Your rights

You can ask for a copy of your data, correct it, delete it, restrict or object to processing, or take it elsewhere in a portable format. Email support@example.com and we will respond within 30 days. You can also complain to your national data protection authority; in Norway that is Datatilsynet.

9. Deleting your account

Account deletion is available in the dashboard and takes effect immediately. Your codes, destinations, uploaded files and analytics are erased within 30 days, and backups roll off within 90 days.

Deleting your account stops your dynamic codes from redirecting, because there is no longer a destination to send anyone to. That is the one situation where a printed code does stop working, and it happens only because you asked for it. If you want the codes to keep redirecting, cancel the subscription instead of deleting the account - see the terms.

10. Changes

If we change this policy in a way that affects you, we will email account holders before it takes effect. The date at the top always shows the current version.