Privacy Policy

This Privacy Policy explains how Mihail Hummel ("Trackero", "we", "us") processes personal data when you visit our website, use our application, scan a QR code or open a short link created with Trackero, view a client dashboard, or contact us. It is provided in accordance with Articles 13 and 14 of the EU General Data Protection Regulation (GDPR), the UK GDPR, the Swiss Federal Act on Data Protection (FADP), and applicable US state privacy laws, including the California Consumer Privacy Act as amended by the CPRA (CCPA).

1. Who is responsible

The controller for the processing described in this policy (except Section 4) is:
Mihail Hummel, Tsar Ivan Aleksandar 116, 9700, Shumen, Bulgaria
Email: privacy@trackero.co

We have not appointed a data protection officer because we are not legally required to do so. All privacy questions are handled by our privacy team at privacy@trackero.co. Our representative in the United Kingdom under Article 27 UK GDPR: -.

2. Our two roles

• As controller, we process data about our customers and website visitors: accounts, billing, support, security, and our website.
• As processor, we process Scan Data (what happens when someone scans a customer's QR code or opens their short link) on behalf of the customer who created that code. The customer is the controller of that data and decides why it is collected. Our obligations to customers are set out in our Data Processing Agreement. Section 4 explains this processing for the people who scan.

3. What we process, why, on what legal basis, and for how long

The legal bases referred to below are those of Article 6(1) GDPR: (b) performance of a contract or steps before entering into one; (c) compliance with a legal obligation; (f) our legitimate interests, which we name in each case; and (a) consent.

3.1 Visiting our website and app

When you open any of our pages, our hosting and network providers (Vercel and Cloudflare) automatically process technical data: IP address, date and time, requested URL, referrer, browser and operating system, and error information. Purpose: delivering the website, ensuring stability and security, and detecting attacks. Legal basis: Art. 6(1)(f), our legitimate interest in a secure, working website. Retention: server logs are deleted by our providers automatically, generally within 30 days, unless needed to investigate a specific security incident.

3.2 Your account

Data: email address; password (stored only as a salted hash by our authentication provider); email verification codes; for Google sign-in, your Google account ID, name, email address and profile picture URL as provided by Google; profile details you enter (name, business name, field of business, country); plan and usage counters; acceptance records of our Terms (document version and time). Purpose: creating and managing your account and providing the Service. Legal basis: Art. 6(1)(b); for acceptance records Art. 6(1)(c) and (f), our legitimate interest in being able to prove what was agreed. Retention: until you delete your account. Acceptance records are kept for up to 3 years after the contract ends, the period in which claims typically become time-barred and which some US laws require for proof of consent.

Providing this data is necessary to conclude the contract. Without an email address we cannot create an account. All profile details other than your email are optional.

3.3 Content you create

Data: client names and images you upload, QR code designs and logos, destination URLs, link titles, campaign names and UTM parameters, custom domains you connect (the domain name, its verification records and status, and the redirect address you choose), and any personal data that this content contains. Purpose: providing the Service. Legal basis: Art. 6(1)(b). Retention: until you delete the item or your account. If you include personal data of other people (for example a client contact's name), you are responsible for having a legal basis to do so.

3.4 Payments and billing

Data: name, email, billing address, VAT number (if provided), the plan purchased, amounts, dates, invoices, subscription status, and a Stripe customer reference. Card and other payment method details are entered directly on Stripe's checkout page and are never received or stored by us. Purpose: processing payments and subscriptions, invoicing, preventing fraud, and fulfilling tax and accounting duties. Legal basis: Art. 6(1)(b) and (c). Retention: invoices and accounting records are kept for the period required by tax and commercial law (generally up to 10 years); other billing data until the contract ends.

Stripe also processes some data as an independent controller, for example to meet its own anti-money-laundering, fraud-prevention and regulatory obligations. See the Stripe Privacy Policy.

3.5 Contacting us and support

Data: name, email address, the content of your message, support tickets and our replies, and, for cancellation, withdrawal or abuse reports, the details you submit. Purpose: answering your request, providing support, and handling contract and legal requests. Legal basis: Art. 6(1)(b) where your request relates to a contract; otherwise Art. 6(1)(f), our legitimate interest in responding to enquiries; Art. 6(1)(c) for legal requests (for example under the Digital Services Act). Retention: contact-form messages for 24 months after the last exchange; support tickets until you delete your account; cancellation, withdrawal and abuse records for 3 years.

3.6 Emails we send

We send emails that are necessary for the Service: verification codes, password resets, order confirmations, receipts, renewal reminders, cancellation confirmations, security alerts, and important notices about changes to the Service or our terms. Legal basis: Art. 6(1)(b) and (c). These are not marketing emails, and you cannot unsubscribe from them while you have an account.

We currently do not send marketing newsletters. If we start, we will only send them with your consent, or, where the law allows it, to existing customers about similar products of ours, in each case with a simple opt-out link in every email (Art. 6(1)(a) or (f) together with Art. 13 of the ePrivacy Directive).

3.7 Security and abuse prevention

Data: short-lived request counters for rate limiting, keyed by a one-way hash of the IP address (the IP address itself is not stored); Cloudflare Turnstile signals on sign-up, sign-in and forms; records of moderation decisions; and an audit log of actions taken by our staff in our internal admin tools. Purpose: protecting accounts, the Service and the public against fraud, phishing, spam and attacks, and complying with the Digital Services Act. Legal basis: Art. 6(1)(f), our and our users' legitimate interest in a secure service; Art. 6(1)(c) where the law requires it. Retention: rate-limiting counters expire after their time window and are purged automatically; audit and moderation records for 3 years.

3.8 Setting up a custom domain

When you look up a domain or check its DNS records on the Custom domains page, your browser asks two public DNS services for the domain's public DNS records: Google Public DNS (dns.google, Google LLC) and Cloudflare DNS (cloudflare-dns.com, Cloudflare, Inc.). It also loads the domain's icon from DuckDuckGo's icon service (icons.duckduckgo.com, Duck Duck Go, Inc.) or, if that has none, from the domain itself. These services receive your IP address, the domain name and the usual technical data of a web request. They are not our processors; their own privacy policies apply. To check your DNS records, our servers also query public DNS services, which only receive the domain name. Purpose: finding your DNS provider, showing you the right setup steps and checking that your records are correct. Legal basis: Art. 6(1)(b), because you asked us to connect the domain; for the icon, Art. 6(1)(f), our legitimate interest in showing you a recognisable result. The lookups only happen when you use this page.

To serve a connected domain securely, a certificate authority issues a TLS certificate for it through Cloudflare. Certificates are published in public Certificate Transparency logs, so the domain name becomes publicly visible. They contain no other information about you.

3.9 Cookies and similar technologies

We use strictly necessary storage (for example to keep you signed in). Details are in our Cookie Policy.

Website analytics. If you accept analytics cookies in our cookie banner, we use Google Analytics 4 (Google Ireland Limited / Google LLC) on our public marketing website to measure visits. Data: IP address (not stored by Google Analytics 4), pages viewed, referrer, approximate location, device and browser information, and a pseudonymous identifier in a cookie. Purpose: understanding how visitors find and use our website so we can improve it. Legal basis: your consent, Art. 6(1)(a) GDPR and section 25 TDDDG, which you can withdraw at any time via "Cookie settings" in the footer. Retention: Google Analytics event data is kept for 14 months at most. It is not used inside the app, the dashboard, public client dashboards or on sign-in pages. Google may transfer data to the USA under the EU–U.S. Data Privacy Framework and/or Standard Contractual Clauses.

4. Information for people who scan QR codes or open short links

Trackero customers (for example agencies and businesses) create QR codes and short links that point to our redirect domain shoort.link, or to a domain of the customer's own that is connected to Trackero (a "custom domain", for example go.theirbrand.com), before forwarding you to the customer's destination. When you scan such a code or open such a link, we process the following data on behalf of the customer who created it, who is the controller:

• Custom domains: a link on a custom domain is handled in exactly the same way. The request passes through Cloudflare, which serves custom domains for us, and then through our redirect service.
• No cookies, no fingerprinting for tracking, no profiles. We store nothing on your device, we do not identify you, and we do not combine this data across customers or with other data.
• Purpose: giving the customer statistics about how their campaign performs (number of scans, unique visitors, devices, locations and times), and protecting the redirect service against abuse.
• Legal basis: for the customer, usually their legitimate interest in measuring the reach of their campaign (Art. 6(1)(f) GDPR); for our own abuse prevention, our legitimate interest in a secure service.
• Recipients: the customer who created the code, anyone the customer shares a client dashboard with (which only shows aggregated statistics), and our processors listed in Section 6.
• Retention: as long as the code or link exists in the customer's account. It is deleted when the customer deletes the code, link or account.
• Your rights: please contact the organisation whose QR code or link you used, as it is the controller. If you contact us, we will forward your request to that customer. Because we cannot identify you from the stored data, we may be unable to locate your records without additional information (Art. 11 GDPR).
• Destination websites are operated by the customer or third parties. Their own privacy policies apply once you arrive there.

5. Client dashboards

Customers can share a read-only dashboard with their own clients through a Client ID or link. Anyone with the ID or link can view the aggregated statistics it contains without signing in. The dashboard shows client and campaign names and aggregated statistics, but no data that identifies the people who scanned. When you view a dashboard, we process the technical data described in Section 3.1.

6. Who receives your data

We do not sell your personal data, rent it, or share it for cross-context behavioural advertising. We disclose it only to:

• Processors (service providers) who process it on our behalf under a data processing agreement (Art. 28 GDPR) and only on our instructions:

• Independent controllers, where you choose to use them: Stripe (payments, see Section 3.4) and Google (if you choose "Sign in with Google", Google Ireland Limited / Google LLC processes your sign-in under its own privacy policy).
• Our staff, only where necessary for support, security or legal reasons, bound by confidentiality and with access recorded in an audit log.
• Professional advisers (lawyers, accountants, auditors) bound by confidentiality, where necessary.
• Authorities and courts, where we are legally required to disclose data, or where necessary to establish, exercise or defend legal claims. We check each request for legal validity.
• A buyer or successor, if all or part of our business is sold, merged or reorganised, subject to equivalent protection of your data. We will inform you in advance.

7. International data transfers

Some of our providers are located, or have group companies or sub-processors, outside the European Economic Area, in particular in the United States. Where personal data is transferred to a country without an adequacy decision of the European Commission, we protect it with appropriate safeguards under Articles 44 to 49 GDPR: the EU–U.S. Data Privacy Framework where the recipient is certified, and otherwise the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914, including the UK Addendum and the Swiss amendments where applicable), together with supplementary measures such as encryption in transit and at rest. You can request a copy of the relevant safeguards from privacy@trackero.co.

8. How we protect your data

We use appropriate technical and organisational measures, including: encryption in transit (TLS/HTTPS, HSTS) and at rest; row-level security so that each customer can only access their own data; strict separation of public and private data; hashing of IP addresses; minimal-privilege access for staff with an audit log; rate limiting and bot protection; secure payment handling by a PCI-DSS certified provider; and regular review of our security practices. No system is completely secure. If a personal data breach occurs that is likely to result in a risk to you, we will notify the competent authority and, where required, you, in accordance with Articles 33 and 34 GDPR.

9. Your rights

Under the GDPR (and similar laws) you have the right to:

• access your personal data and receive a copy of it (Art. 15);
• rectification of inaccurate or incomplete data (Art. 16);
• erasure of your data (Art. 17);
• restriction of processing (Art. 18);
• data portability: receive your data in a structured, commonly used, machine-readable format and have it transmitted to another controller (Art. 20);
• withdraw consent at any time, with effect for the future (Art. 7(3));
• not be subject to a decision based solely on automated processing that has legal or similarly significant effects (Art. 22). We do not make such decisions;
• lodge a complaint with a supervisory authority, in particular in the country where you live, work, or where the alleged infringement took place. The authority responsible for us is [Name of national data protection authority] ([https://link-to-the-authority]).

Do it yourself. In the app you can edit your profile, export all your data (Settings → Export my data) and delete your account (Settings → Delete account). For everything else, email privacy@trackero.co. We respond within one month. That can be extended by two further months for complex requests, in which case we tell you why. We may ask you to verify your identity, normally by replying from the email address of your account. Requests are free of charge unless they are manifestly unfounded or excessive.

10. Automated decision-making

We do not use automated decision-making or profiling that produces legal or similarly significant effects for you. Automated abuse checks (for example rate limits and bot protection) may block a specific request; you can always contact us to have it reviewed by a person.

11. Children

The Service is intended for businesses and is not directed at children. You must be at least 18 years old to create an account. We do not knowingly collect personal data from children under 16 (or under 13 in the United States). If you believe a child has provided us with personal data, contact privacy@trackero.co and we will delete it.

12. Additional information for residents of the United States

This section applies to residents of California and other US states with comprehensive privacy laws (including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia), to the extent those laws apply to us.

Notice at collection: categories of personal information. In the past 12 months we have collected: identifiers (name, email address, account ID, IP address); customer records (billing name and address); commercial information (plans purchased, transaction history); internet or network activity (usage of the Service, scan statistics); approximate geolocation (country and city derived from IP address); professional information (business name and field); and sensitive personal information limited to account login credentials. Sources, purposes and retention periods are described in Section 3. We use sensitive personal information only to provide and secure the Service, as permitted by law, and not to infer characteristics about you.

No sale, no sharing, no targeted advertising. We do not sell personal information, share it for cross-context behavioural advertising, use it for targeted advertising, or use it for profiling with legal or similarly significant effects, and we have not done so in the past 12 months. We do not knowingly sell or share personal information of consumers under 16.

Your rights. Depending on your state, you have the right to know and access the personal information we hold about you and how we use and disclose it; to correct it; to delete it; to obtain a portable copy; to opt out of sale, sharing, targeted advertising and profiling (which we do not do); and to limit the use of sensitive personal information. We will not discriminate against you for exercising any of these rights.

How to exercise them. Email privacy@trackero.co with the subject "US privacy request". We verify your request by matching the information you provide with what we hold, normally by email confirmation from your account address. An authorised agent may submit a request on your behalf with proof of your written authorisation, and we may ask you to verify your identity directly. We respond within 45 days (extendable once by 45 days where permitted).

Appeals. If we decline your request, you may appeal by replying to our decision or emailing privacy@trackero.co with the subject "Privacy appeal". We will respond within the period required by your state law (generally 45 or 60 days). If you are not satisfied, you may contact your state Attorney General.

Global Privacy Control. We honour GPC signals as described in our Cookie Policy. California "Shine the Light": we do not disclose personal information to third parties for their own direct marketing purposes.

13. Other countries

• United Kingdom: the UK GDPR and the Data Protection Act 2018 apply. You may complain to the Information Commissioner's Office (ico.org.uk).
• Switzerland: the FADP applies. You may complain to the Federal Data Protection and Information Commissioner (FDPIC).
• Canada: we process personal information in line with PIPEDA and applicable provincial laws. You may contact the Office of the Privacy Commissioner of Canada.
• Brazil: the legal bases in Section 3 correspond to those of Art. 7 of the LGPD (contract performance, legal obligation, legitimate interest and consent), and you have the rights under Art. 18 LGPD.
• Australia and New Zealand: we handle personal information in accordance with the Australian Privacy Principles and the New Zealand Privacy Act 2020 to the extent they apply to us.
• Everywhere else: we apply the protections of this policy to everyone, regardless of where they live. You can exercise the rights in Section 9 wherever you are, subject to applicable law.

14. Third-party websites

QR codes and short links created by our customers lead to websites we do not operate. We are not responsible for the privacy practices of those websites. Please read their privacy policies.

15. Changes to this policy

We update this policy when our processing changes or the law requires it. The date at the top shows the latest version. If changes are material, we inform account holders by email or in the app before they take effect.

16. Contact

Mihail Hummel, Tsar Ivan Aleksandar 116, 9700, Shumen, Bulgaria. Privacy questions and requests: privacy@trackero.co.