Privacy policy
Ultimo aggiornamento: 7 settembre 2026
Questo documento non è ancora disponibile in italiano: è mostrato in English.
Testo redatto in buona fede, senza consulenza legale, e non ancora verificato da un professionista.
This document describes what we process, why, for how long and with whom. It applies to visitors who scan a QR code as much as to customers who create one.
1. Data controller
Createur Digital - Fred Contat, Chemin de la Riettaz 4, 1442 Montagny-près-Yverdon, Suisse. For any question about your data: contact@createurdigital.ch.
2. When a QR code is scanned
We process, in order to choose the destination and measure audience: the country inferred from the IP address, device type, operating system and browser, browser language, timestamp and the rule that fired.
The IP address is never kept in clear text. It is turned at recording time into an irreversible salted hash, used only to tell a returning visitor from a new one. It cannot be reversed and does not identify you.
The country is resolved on our own servers, with no third-party call. No cookie is set and no advertising tracker is loaded during a redirect.
3. When a link page is opened
A link page hosted by us counts its opens, and counts clicks on each of its links. These counters are aggregate: they give a number, never who clicked.
A click passes through our server before reaching its destination, long enough to increment that counter. Nothing is stored on your device in the process.
The content of a page — name, introduction, links — is published by the customer who created it, and is their sole responsibility.
4. Account data
For customers: name, email address, password (kept as a hash, never in clear text), workspace name and creation date. Used to manage access and the service.
5. Billing data
When a subscription is taken out, a customer record is created at Stripe, our payment provider, with the workspace name and the subscriber’s email address.
Card details are entered directly at Stripe and held by Stripe: we never have access to them and do not store them. On our side we keep the customer record identifier, the plan, the subscription status and its dates. Invoices are issued and held by Stripe.
6. Legal basis
Scan and page-open data rest on the legitimate interest in operating the redirect and measuring its audience in aggregate, with an anonymised IP address. Account and billing data rest on performance of the contract, and on our accounting obligations as regards invoices.
7. Retention
Scan events: 24 months, then automatic deletion. The plan determines how far back the interface lets you look, but deletion happens at the same term for everyone.
Open and click counters: kept as long as the page exists.
Account data: as long as the account exists. Cancelling a subscription deletes neither the account nor the data — the service stops, the data remains, and you may ask for its erasure.
Billing data: for as long as accounting obligations require.
8. Recipients
No data is sold or handed over for advertising purposes.
Only two third parties are involved: Stripe, for payment processing, and Hetzner Online GmbH, for hosting. Geolocation is not among them: it is performed locally, on our own servers.
The servers are located in Finland, in the European Union. Your data therefore leaves Switzerland, but stays in a country recognised as offering an adequate level of protection, under the GDPR. Stripe, for its part, processes data in the United States under its contractual safeguards.
9. Operator access
Operations staff can view the list of accounts and workspaces, and sign in temporarily as a customer to understand a problem that customer describes poorly.
This is bounded: every such sign-in is logged with the address of the person doing it, the session expires by itself after thirty minutes, and a permanent banner announces it on screen. It gives no access to a password, which is never stored in clear text.
10. Cookies
No cookie is set when a QR code is scanned or a link page is viewed.
Inside the application, three strictly necessary cookies are used: the session cookie, which keeps you signed in; the language cookie, which remembers French or English; and a temporary cookie holding the plan picked on the marketing site, for the duration of sign-up. No analytics or advertising cookies.
11. Your rights
Under the GDPR and the Swiss FADP, you have the right to access, rectify, erase, restrict and object, as well as the right to data portability. Write to contact@createurdigital.ch; we answer within one month. You may also refer the matter to the competent supervisory authority.