Privacy policy

1.In brief

QrRota is designed to let businesses manage their printed QR codes without having to reprint them. We take care not to collect more data than we need to do that. This policy applies to the qrrota.com website, the user dashboard and the short-link redirect service operated by QrRota Yazılım ve Teknoloji A.Ş..

• We do not sell or rent your personal data, and we do not use it for advertising.
• We do not use advertising or third-party analytics cookies on our site.
• Scan analytics never contain IP addresses. The connection records Law No. 5651 requires us to keep are stored separately from analytics, encrypted, for one year (see “Connection (traffic) records”).
• You can manage your data from the dashboard and delete your account yourself at any time under Settings → Profile. Records the law requires us to keep stay until their period ends (see “How long we keep information”).

This policy supplements the Privacy notice under Turkish Law No. 6698 (KVKK), which sets out the legal details. If the two documents differ, the KVKK privacy notice prevails.

2.Information we collect

• Account information: the name and email address you give us when you sign up, your language preference and, if you upload one, your profile photo. Your password is never stored in plain text, only as an irreversible hash; no one, including us, can see it.
• Sign in with Google or Apple: if you use one of these options, Google or Apple shares your name, email address and (with Google) profile photo with us, to the extent you allow, along with your account identifier at that provider. We never have access to your Google or Apple password.
• Account security settings: if you turn on two-step verification, your authenticator app’s secret key and your backup codes (stored encrypted); if you add a passkey, only its public key and the name you give it.
• Workspace and team information: your workspace’s name and logo, if any, the email addresses of team members you invite, and members’ roles.
• QR code content: the names, destination links, routing rules and design settings (including your logo) of the QR codes you create, the brand styles and rule templates you save, and any business card, text, Wi-Fi or location content.
• Payment and billing information: your subscription plan, payment dates and amounts, and the details needed for invoicing: full name or company name, address, Turkish ID number or tax details, email address and mobile number. We also record when you accepted the distance sales contract and the information on the right of withdrawal at checkout. After payment, we email you a copy of the contract and of the preliminary information form filled in with these details (your Turkish ID number isn’t included) and record which version of the texts we sent and when. You enter your card details directly into iyzico’s secure payment form; your full card number never reaches us and is never stored on our systems.
• Free trial record: when you start the 14-day free Pro trial, we record the user who started it, the workspace, the trial’s start and end dates and a one-way fingerprint of your email address made with a secret key, so that each user, each workspace and each email address can use the trial only once. We collect no payment details for the trial.
• Email preferences and consent records: your preferences for informational emails, and the date, source and email address of every time you gave or withdrew consent to commercial electronic messages.
• A record of the emails we send you: for each email, the recipient address, the kind of email, the subject line, when it was sent and the result. We don’t keep the content of emails.
• Support correspondence: messages you send us through the contact form or by email. Contact form messages are forwarded to our support inbox. Emails to our company addresses (for example for official correspondence and abuse reports) that are brought into our admin panel are kept there too, with the sender and recipient addresses, subject and plain text; for attachments we record only their names and sizes, not their content.
• Abuse reports: if you use the abuse report form, the short link you report, the reason, the description you write, the email address you choose to give us, and a one-way fingerprint of your IP address (not the IP address itself).
• Security checks and appeals: a record of the automated security checks we run on your QR codes’ destination links (when, with which source, which link was checked, and the result), and a risk score calculated from these records; the risk score only sets the order in which our admins review codes and never triggers an action on its own. If you appeal a paused QR code or a suspended workspace from the dashboard: the user who sent the appeal, the explanation you write, the optional business details and evidence links, when you confirmed the information is accurate, and the decision.
• Technical and security information: when you sign in, the IP address and browser information of the session are stored with the session record to protect your account against unauthorized access. Connection records of actions taken with your account are also kept, as described under “Connection (traffic) records” below. When an unexpected error occurs in the app, its technical details (error message, the page and the browser type) are sent to our error tracking system; IP addresses, email addresses, cookies and form content are removed from these reports.

3.Data about people who scan your QR codes

When your QR codes are scanned, we record a limited amount of information per scan so we can give you meaningful analytics. You, as the owner of the QR code, are the data controller for this data; we process it on your behalf as a data processor.

What we record for each scan: the time of the scan; the approximate location derived from the IP address at the moment of the scan (country, region, city); the device type and brand, operating system and browser (with versions); the app the code was opened in (for example Instagram’s in-app browser); the language preference; the referring page address the browser sends (referer); campaign tags (UTM) and the placement marker in the short link; the routing rule that matched and the destination; whether the traffic was generated by a bot; and a pseudonymous visitor identifier. A visitor opening the same code again within a few seconds isn’t recorded as another scan.

What scan data never contains: raw IP addresses, precise (GPS) location, or the name or contact details of the person scanning. The short-link redirect and the pages we host (business card, text, Wi-Fi and location pages) set no cookies on the scanner’s device. As Law No. 5651 requires, IP addresses appear only in encrypted connection records that are kept separately from analytics and are never shared with the QR code owner (see “Connection (traffic) records”).

Approximate location is determined at the moment of the scan by matching the IP address against DB-IP’s “IP to City Lite” database on our own servers; the IP address is not sent to any third party for this purpose. IP geolocation data by DB-IP (licensed under CC BY 4.0).

The visitor identifier is an HMAC of the IP address and browser information, computed with a secret key. This lets us tell repeat scans by the same person apart and show them the same variant in A/B tests, but it is not possible to work back from this value to the IP address.

When you present your QR codes to your own audience, it is your responsibility to inform the people who scan them as required by KVKK (for example through a privacy notice on your destination page). If you scanned a QR code and have a request about your data, you can contact the business that published the code, or reach us at destek@qrrota.com; we will forward your request to the business concerned.

4.Connection (traffic) records

As a hosting provider under Turkish Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed by Means of Such Publications, QrRota must keep traffic data for the services it provides (Article 5(3) of the Law). These records are kept separately from scan analytics and are never used for analytics, marketing or profiling. QrRota Yazılım ve Teknoloji A.Ş. is the data controller for them. We keep three kinds of connection records:

• Account activity records: For sign-ups, every sign-in method (failed attempts included), sign-outs, password resets and changes, email changes, turning two-factor authentication on or off, account deletion and every change you make in the dashboard (for example creating, editing or deleting a QR code): the start and end time, the IP address, the source port (where our network infrastructure passes it on) and the destination port, the browser information (user agent), the type and result of the action, the ID of the record it concerns (for example the QR code’s short name), the amount of data transferred, your account, your workspace and your email address at the time. For a failed sign-in, the email address that was tried is recorded. What you type into forms and your passwords are never written to these records.
• Visitor connection records: For every request to a short link or to a page we host (such as vCard, text and Wi-Fi pages): the IP address, the source port (where our network infrastructure passes it on) and the destination port, the time and duration, the requested address, the request method, the response status, the amount of data transferred, the browser information and the QR code the request concerned.
• Server access logs: The technical logs the reverse proxy in front of our servers keeps for every request to the website, the dashboard and short links: the IP address and source port, the time and duration, the requested domain name, whether the connection used HTTP or HTTPS, the request method, the response status, the amount of data transferred and the browser information. The path and parameters of the requested address (such as the keys in sign-in and password reset links) and cookies are not written to these logs.

Purpose and legal ground: To meet the obligation to keep traffic data under Article 5(3) of Law No. 5651 and to answer requests for it from judicial bodies and other authorities entitled by law, and to keep accounts and our infrastructure secure. The legal ground is compliance with a legal obligation of the data controller (KVKK Article 5(2)(ç)).

Retention: One year. The records are then deleted automatically; visitor connection records are deleted in monthly batches, so within 13 months at the latest. Deleting your account does not shorten this period: the law requires us to keep them until it ends.

Security: In account activity and visitor connection records the IP address, port and browser information (and, in account activity records, the email address) are encrypted with AES-256; searches use keyed hashes (HMAC) only. The other fields, such as the time, the requested address and the response status, are stored unencrypted. The database doesn’t allow these records to be changed, and daily cryptographic seals let us prove they have not been altered afterwards. Only named, authorized staff can access them (in the admin panel, with two-step verification), and every view and export is logged. Server access logs are compressed into hourly files and encrypted so that they can only be opened with a key that is kept offline, never on the server; the current hour, until it is encrypted, is kept in a file only the server administrator can access. Only the authorized person who holds the key can open these files.

Who receives them: Only judicial bodies and other authorities entitled by law, on a decision or formal request, and only within its scope. They are not shared with anyone else, including the customers who own the QR codes.

5.How we use information

• To create your account, authenticate you and provide the service;
• To redirect your QR codes, apply your rules and show you scan analytics;
• To manage your subscription and free trial (including making sure the trial is used only once), take payments and issue invoices;
• To send the emails the service needs (email verification, password resets, team invitations, payment and account notifications);
• To answer your support requests;
• To protect accounts and our infrastructure against abuse, fraud and attacks; to protect people who scan our short links, we check destination links against threat lists and Google’s Web Risk service, put suspicious or reported QR codes through an AI-assisted first review, and review abuse reports and appeals;
• To find and fix errors in the app and improve the service, using aggregated statistics that don’t identify anyone wherever possible;
• To meet our legal obligations (for example keeping connection records under Law No. 5651, carrying out decisions of competent authorities, and keeping invoices and records of consent to commercial messages).

We may also send informational emails about how your account is being used (product tips, first-scan notices, the monthly scan report); you can turn these off at any time under Settings → Notifications. Commercial electronic messages such as offers and plan or feature suggestions are sent only with the separate, optional consent you give at sign-up or in your settings, and every such message includes a link that lets you easily withdraw it (see Commercial email consent). We do not use your data to build advertising profiles.

6.Who we share information with

To provide the service, we share your data only to the extent necessary and only with service providers (sub-processors) bound to us by contract:

• Hetzner Online GmbH (Germany): our application and database are hosted in Hetzner’s data centers in Germany, and our backups in Hetzner data centers in the European Union. All data processed in the service is held on these servers.
• Amazon Web Services (data in Frankfurt, Germany): your name, email address and the content of the emails we send you (account, notification and, if you consented, commercial emails), so they can be delivered (Amazon SES); emails sent to our company addresses and their attachments, so we can receive them (Amazon S3; the raw messages are kept for up to 30 days); and notices about email addresses that bounce or complain (Amazon SNS).
• Resend, Inc. (USA): only if used as our backup email provider, the email data above.
• iyzico: iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş. processes card payments and recurring subscription charges; for this we pass your billing details (full name or company name, email, mobile number, address, Turkish ID or tax number) to iyzico.
• Google and Apple: only if you use “Sign in with Google” or “Sign in with Apple”, for authentication.
• Cloudflare, Inc. (Turnstile): to stop automated software (bots) from abusing the sign-up, sign-in link, password reset and abuse report forms. During this check Cloudflare processes your IP address and technical signals about your browser.
• Google Web Risk: the destination links (web addresses) of your QR codes are sent to Google’s Web Risk service to check them for phishing and malware. No data about the people who scan QR codes is included in these checks.
• Anthropic, PBC (USA, Claude): QR codes that our automated checks catch, that are flagged as possibly abusive or that someone reports may get a first review by Anthropic’s Claude AI service before an admin looks at them (to prevent phishing and fraud). For this we send the code’s destination links (with any email addresses and long number sequences in them masked), summaries of the pages they open, which our server makes by visiting each link once like any member of the public (the title, a masked part of the visible text, the types of form fields), the content we host for the code (on business cards names are reduced to initials and the address is hidden; phone numbers, email addresses, ID numbers, IBANs and card numbers are masked; a Wi-Fi password is never sent), the text of abuse reports (without the reporter’s identity) and technical facts such as the account’s age, plan and verification status. We never send the code owner’s name, email address or workspace name, or any data about the people who scan the code. The AI’s score is never a decision on its own: our system requires further conditions before it pauses a code automatically, and an admin reviews every code paused this way. You can object to the result with the Appeal button on the code’s page in the dashboard or by writing to us; the text of your appeal is not sent to the AI.
• Domain registration lookups (RDAP): while the AI-assisted first review is on, only the domain name of a destination link (for example example.com) is sent to public RDAP registration lookup services (rdap.org and the registry the domain belongs to) to find out when it was registered.
• Error tracking: technical reports of errors in the app are processed by Sentry (Functional Software, Inc.) in its European Union data region, or by error tracking software running on our own servers. IP addresses, email addresses, cookies, form content and secret parameters in links are removed before a report is sent.
• Financial and legal advisers, e-invoicing provider: the billing information needed for our legal obligations.

The public threat lists and the IP geolocation database we use are only downloaded by us; no data is sent to these sources. The instant alerts our admins get through the team messaging service Slack (for example about a new abuse report) contain only things like a short link’s short name, internal IDs and a category; no names, email addresses, IP addresses or content are sent.

Beyond this, we may share your data only where the law requires it (for example on a court order or a request from a competent authority), or in corporate transactions such as a merger or acquisition, provided the protections in this policy are preserved. Transfers abroad are made in line with the safeguards in Article 9 of the KVKK; for details, see the KVKK Privacy Notice.

7.How long we keep information

Scan events are kept for no longer than 3 years regardless of the workspace’s plan, and are deleted automatically at the end of that period. The analytics history shown in the dashboard depends on your plan; during the free trial, the Pro plan’s history applies, and once the trial ends, the Starter plan’s history applies. Scan data is recorded the same way on every plan: on the Starter plan some analytics views (cities, the day × hour heatmap and rule performance) are locked, but the underlying data is still collected, and when you move to a paid plan, data within the retention period appears in those views too. When you delete a QR code, its scan data is deleted as well.

Records whose period has ended are deleted by daily automated jobs.

8.How we protect your data

• Encryption in transit: all connections to the site, the dashboard and short links are encrypted with TLS (HTTPS).
• Application-level encryption: the IP addresses, ports, browser and email information in connection records, and two-step verification keys and backup codes, are stored encrypted in the database. Backups are kept in private storage that only authorized people can access.
• Password security: passwords are stored with a salted, strong hashing algorithm.
• Pseudonymization: visitor identifiers, the IP fingerprints in abuse reports and the email fingerprints in trial records are generated with HMAC; the secret keys are kept separate from the database.
• Connection records: IP address, port, browser and email information are encrypted, and only keyed hashes (HMAC) are used for searching. Account activity and visitor connection records are stored so they can’t be changed and are checked with daily cryptographic seals. Server access logs are encrypted every hour so that only a key kept offline can open them. Access is limited to named, authorized staff.
• Workspace isolation: every query is scoped so it returns only data from workspaces you are authorized to access, and role-based permissions apply within teams.
• Least privilege: our staff and service providers access only the data they need for their tasks, and only as much as they need. Only authorized staff who have turned on two-step verification can enter our admin panel; every action there, and every view and export of connection records, is logged.
• Backups and monitoring: we take regular backups and monitor our systems for unusual activity.

No system is 100% secure. In the event of a data breach, we will notify the Personal Data Protection Board within 72 hours at the latest, as required by Article 12(5) of the KVKK and the Board’s decisions, and inform the people affected as soon as possible. To protect your account, we recommend using a strong, unique password and turning on two-step verification.

9.Your control over your data

• You can update details such as your name, email address and profile photo, and see and end your active sessions, under Settings → Profile in the dashboard.
• You can manage informational emails and your consent to commercial messages under Settings → Notifications.
• You can delete your QR codes; when you delete a QR code, its scan data is deleted too.
• On Pro and higher plans (including during the free trial), you can export your scan data as CSV.
• You can delete your account yourself under Settings → Profile → Delete account; workspaces where you are the only member are deleted along with their QR codes and scan data. If you are the only owner of a workspace with other members, you need to transfer ownership first, and a subscription that is still being billed must be cancelled first. You can also send a deletion request to destek@qrrota.com. Connection (traffic) records, invoice and payment records, records of consent to commercial messages, the email fingerprint of the trial record, and records about abuse and official orders are kept for the periods above.
• You can exercise all of your rights under Article 11 of the KVKK; how to apply is explained in the KVKK Privacy Notice.

10.Children’s privacy

QrRota is a service for businesses and professionals and is not designed for use by anyone under 18. We do not knowingly open accounts for people under 18. If you become aware that someone under 18 has provided us with personal data, please let us know at destek@qrrota.com and we will promptly delete the account and data concerned.

If your QR codes are presented to an audience of children, the QR code owner is responsible for informing that audience and obtaining any necessary consents.

11.Third-party sites

Your QR codes and short links send people to third-party websites that you choose. We are not responsible for the content or privacy practices of those sites; we recommend reminding your visitors to review the privacy policy of the site they are sent to. Likewise, “Sign in with Google”, “Sign in with Apple” and the iyzico payment form are subject to their own privacy policies.

12.Changes and contact

We may update this policy as our service or the law changes. The current version is always published on this page, and we announce significant changes by email or dashboard notification before they take effect.

For privacy questions, you can email destek@qrrota.com, write to QrRota Yazılım ve Teknoloji A.Ş., Maslak Mah. Büyükdere Cad. No:255, 34485 Sarıyer / İstanbul, or use our contact page. For information about how we use cookies, see our Cookie Policy.

This English version is provided for convenience only. In the event of any conflict or inconsistency between the English and Turkish versions of this policy, the Turkish version prevails.