Privacy policy

Aura UG (haftungsbeschränkt)
Ludwig-Erhard-Straße 18
20459 Hamburg
Germany
Email: [email protected]

We have not appointed a data protection officer; we are not required to under Art. 37 GDPR and § 38 BDSG.

• Static QR codes are created in your browser. What you type into the generator, and any logo you add, is not sent to our server.
• We do not use analytics, tracking, advertising or social media plugins, and we set no cookies.
• When you load a page, your browser connects to our hosting provider in the EU and to a content delivery network. They process your IP address to deliver the page.
• If you email us or use the contact form, we use your message to answer it.
• If an AI app creates a code through our MCP interface, the content passes through our server once to make the image and is not stored.

The generator runs as a program in your browser. It turns your input (for example a web address, Wi-Fi password, contact details or bank details) into a QR code, reads the code back to check it and creates the download files on your device. None of this reaches our server. A logo you add is read and resized in your browser and stays there.

Our pages tell your browser to connect only to our own domain (Content Security Policy, connect-src 'self'), and an automated browser test checks on every change to the site that no request carries the content of a code. Because we never receive this data, we cannot store, analyse or pass it on.

If you scan a code, your phone does what the code says, for example opening a web page. That page and its operator are outside our control.

Our website runs on servers of a hosting provider in the EU. Requests reach these servers through a content delivery network (CDN) that protects the site against attacks and delivers it. Both process the technical data your browser sends with every request: IP address, time, requested address, referrer and browser identification (user agent).

Purpose is delivering the website and keeping it secure. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a working and secure website. Our own web server does not keep access logs. Error messages of the server may be logged for troubleshooting; they do not contain the content of QR codes, because that content never reaches the server.

Both providers process the data on our behalf under a data processing agreement (Art. 28 GDPR).

We set no cookies. One value may be stored in your browser's local storage:

This storage is strictly necessary to provide the setting you asked for (§ 25(2) no. 2 TDDDG). It never leaves your device. Fonts are delivered from our own domain; there are no requests to font services.

If you write to [email protected], we process your address and your message to answer you. The legal basis is Art. 6(1)(b) GDPR if your message concerns a contract or its preparation, otherwise Art. 6(1)(f) GDPR (our interest in answering enquiries). Emails to this address are received by an email forwarding service (the provider of our content delivery network), which forwards them to our email provider; the email provider stores them on our behalf. Instead of an email you can also use the contact form.

The contact form asks for your email address, a topic and your message. We send them as an email to [email protected], with your address as the reply address, so they reach the same mailbox as an email you write yourself. An email delivery service sends this email on our behalf (see recipients). Like any email to this address, it passes through the email forwarding service, which records its metadata (sender, recipient, subject, message ID, time and delivery status) and shows it to us for 31 days. How long the service itself keeps this data follows its terms and our data processing agreement with it. We do not store the message on our server, and our logs only note that a message was sent, with its topic and length.

To stop automated spam, the server counts messages per IP address (for IPv6, per /64 network) and allows 5 in any hour. The counter is kept only in the memory of the server and is never written to disk. Its entry for your address is deleted at the latest one hour after your last message. Legal basis: Art. 6(1)(f) GDPR, our interest being to protect the form against abuse.

So that a message does not arrive twice, the server keeps a keyed hash of your email and IP address (for IPv6, the /64 network) in memory while your message is being sent, not the addresses themselves. If we cannot confirm that it was sent, the hash is kept for up to 10 minutes and blocks a second message from the same email address and connection during that time. Legal basis: Art. 6(1)(f) GDPR, our interest being to avoid duplicate messages.

The legal basis for your message is the same as for an email (see above). We delete the message from our mailbox once your request is handled, unless commercial or tax law requires us to keep it.

AI apps such as Claude or ChatGPT can create static QR codes through our MCP interface at https://pineqr.com/mcp. Here the content of the code does reach our server: the app sends it, the server builds the QR code in memory, checks that the finished image can be read back and returns it as SVG and PNG. The content is not stored and not logged; it is gone once the answer is sent. The app you use, and its provider, decide what they keep; that is outside our control.

Against abuse, the server counts requests per IP address (for IPv6, per /64 network) and per session, in memory only. A session is a random ID that the server gives the app when it connects; it contains nothing about you and is not stored. An entry is deleted at the latest one minute after the last request. Legal basis: Art. 6(1)(f) GDPR; our interest is to provide this interface and keep it available for everyone.

The content delivery network and the email forwarding service may process data in the USA; both are run by the same provider. Transfers rely on the adequacy decision of the European Commission for the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795 of 10 July 2023); the provider is certified under this framework. In addition, our data processing agreement with the provider contains the standard contractual clauses of the European Commission (Art. 46(2)(c) GDPR).

The email delivery service stores the emails it sends in the USA. Transfers rely on the standard contractual clauses of the European Commission (Implementing Decision (EU) 2021/914, module two, Art. 46(2)(c) GDPR), which are part of our data processing agreement with the provider.

Our email provider stores emails on servers in Switzerland, Germany or Norway. For Switzerland there is an adequacy decision of the European Commission (Art. 45 GDPR; Decision 2000/518/EC of 26 July 2000); Germany is in the EU and Norway in the EEA. We do not otherwise transfer personal data to countries outside the EU or EEA.

Technical data for delivering a page is held by the content delivery network only as long as needed for delivery and security. Emails we delete when the matter is settled, unless commercial or tax law requires us to keep them (up to 6 or 10 years under § 257 HGB and § 147 AO). The email forwarding service records the metadata of forwarded emails (sender, recipient, subject, message ID, time and delivery status) and shows it to us for 31 days. How long the service itself keeps this data follows its terms and our data processing agreement with it.

Under the GDPR you have the right to:

• access the data we hold about you (Art. 15)
• have incorrect data corrected (Art. 16)
• have your data deleted (Art. 17)
• have processing restricted (Art. 18)
• receive your data in a common machine-readable format (Art. 20)
• object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR (Art. 21)

To use these rights, write to [email protected] or use the contact form. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the one where you live or the one responsible for us:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Ludwig-Erhard-Straße 22
20459 Hamburg
datenschutz-hamburg.de

We do not use automated decision-making or profiling.

We update this policy when our services change, for example when dynamic QR codes and accounts become available. The date at the top shows the current version.