Privacy Policy

Privacy Policy

As of: March 2026

1. Controller

Miliienko Studio
Ober-Erler-Straße 34
53547 Kasbach-Ohlenberg, Germany
Email: info@qrova.io
Phone: +49 152 59194184

2. Overview of data processing

We process personal data only to the extent necessary and exclusively for the purpose of providing our services.

3. Hosting

Our website is hosted by Hostinger International Ltd. (Švitrigailos str. 34, Vilnius 03230, Lithuania).

Hostinger privacy policy | AVV/DPA

Legal basis: Art. 6(1)(f) GDPR (DSGVO) (legitimate interest).

4. QR code scan analysis

When a QR code is scanned, we collect:

• IP address — is hashed immediately (SHA-256) and not stored in plain text.
• Location data (country, city) — is determined locally on our server. There is no transfer of the IP address to external services (local DB-IP Lite database).
• Device type, operating system, browser — derived from the user agent.
• Referrer URL, UTM parameters — for campaign tracking.

Legal basis: Art. 6(1)(f) GDPR.

5. User account

When you register, we collect the email address, username and password (encrypted). Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

6. Payment processing (Stripe)

Stripe, Inc. (354 Oyster Point Blvd, South San Francisco, CA 94080, USA) processes payment data. Stripe is certified under the EU-U.S. Data Privacy Framework.

Privacy policy | AVV/DPA

Legal basis: Art. 6(1)(b) GDPR.

7. Cookies, local storage and consent

We store information on your terminal device (cookies, local storage, session storage) or read it from there insofar as this is strictly necessary for the service you have expressly requested (§ 25(2) no. 2 TDDDG – German Telecommunications and Digital Services Data Protection Act) or you have given your consent (§ 25(1) TDDDG). We manage consent with the “Complianz” cookie banner, which runs on our own server. You can withdraw your consent at any time with effect for the future via “Cookie settings” (footer or menu in the customer area). We state the legal basis for any associated processing of personal data for each entry.

Strictly necessary (without consent):

Only with your consent:

Source of the registration: When you register, we store with your account the route by which you came to us (e.g. “letter”, “search engine”, “invoice generator”). This information comes from the address called up (e.g. ?quelle=brief), which we pass on to the registration form without storing anything on your terminal device, or – only with your consent (category “Statistics”) – from the cookie qrova_quelle. The purpose is to evaluate which of our advertising measures are effective. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the economic management of our advertising. The information remains stored as long as your account exists. You can object to this at any time (Art. 21 GDPR), e.g. by email to info@qrova.io.

Partner programme: Partners who recommend QROVA receive a referral link with a code (?ref=…). If someone calls up this link, we count the click. So that the same visitor is not counted twice on the same day, we briefly store an irreversible, salted hash value of the IP address; it is automatically deleted after two days. If you then register, we store with your account which partner the registration is to be attributed to. The code reaches the registration form via the address without being stored on your terminal device or – only with your consent (category “Marketing”) – via the cookie dqm_ref. If you later take out a paid subscription, we calculate the partner's commission from it. The partner only sees the type, date, amount and status of the transactions, not your name or your email address. We do not use this information for advertising tracking. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in acquiring customers through recommendations and in the correct settlement of commissions. Storage period: The attribution remains stored as long as your account exists; we retain commission entries within the statutory periods (§ 147 AO – German Fiscal Code, Abgabenordnung; § 257 HGB – German Commercial Code, Handelsgesetzbuch; up to 10 years). You can object to the attribution at any time (Art. 21 GDPR), e.g. by email to info@qrova.io; we will then delete it unless a commission that has already arisen still has to be settled.

Language of the customer area: If you select a language other than German, we also store this selection with your account so that the customer area is displayed in this language and we can address you in this language in future (Art. 6(1)(b) GDPR). The German versions of our legal texts (legal notice (Impressum), privacy policy (Datenschutzerklärung), General Terms and Conditions (AGB), information on the right of withdrawal (Widerrufsbelehrung), data processing agreement (AVV – Auftragsverarbeitungsvertrag)) are binding.

8. SSL encryption

This site uses SSL encryption (HTTPS) for secure data transmission.

9. Your rights

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR) — via “Delete my data” in the dashboard
• Restriction (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection (Art. 21 GDPR)
• Withdrawal of consent (Art. 7(3) GDPR)
• Complaint (Art. 77 GDPR)

Supervisory authority: Der Landesbeauftragte für Datenschutz und Informationsfreiheit Rheinland-Pfalz (State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate), Hintere Bleiche 34, 55116 Mainz.

10. Storage period

Scan data: as long as your account is active. Upon deletion, all data is irrevocably removed. Invoice data: up to 10 years (§ 147 AO, § 257 HGB).

11. Processors

Reach measurement with Google Analytics 4

This website uses Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). The purpose is the statistical evaluation of website usage in order to improve content and offering.

Legal basis: Processing takes place exclusively on the basis of your consent under Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG. As long as you do not consent to the "Statistics" category in the cookie banner, Google Analytics is not loaded and no data is transmitted to Google.

Data processed: truncated IP address, device and browser information, pages visited, length of stay, referrer and an approximate location at country and city level.

IP anonymisation: The IP address is truncated before further processing (anonymize_ip).

Transfer to third countries: A transfer to Google LLC in the USA cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework; standard contractual clauses are in place in addition.

Withdrawal: You can withdraw your consent at any time with effect for the future via the cookie settings. Further information can be found in Google's privacy policy.

12. Changes

We reserve the right to amend this privacy policy. The version current at the time of your visit applies to your visit.

AI features (OpenAI – LISA chat & receipt OCR)

For the AI chat assistant “LISA” and for AI-supported receipt recognition (OCR), we use services of OpenAI (OpenAI Ireland Ltd.; processing possibly by OpenAI, L.L.C., USA). In doing so, the chat content you enter or the receipts you upload are transmitted to OpenAI for processing. We recommend not entering any sensitive personal data in the chat. The transfer to the USA takes place on the basis of the EU-U.S. Data Privacy Framework or the EU standard contractual clauses (Art. 45/46 GDPR). Legal basis: Art. 6(1)(b) and (f) GDPR (performance of a contract and legitimate interest in AI features).

Newsletter (MailerLite)

If you subscribe to our newsletter, we process your email address via MailerLite (UAB “MailerLite”, Lithuania, EU) on the basis of your consent (Art. 6(1)(a) GDPR). You can unsubscribe from the newsletter at any time.

Proof of contract conclusion, consents and withdrawal (preservation of evidence)

When a paid subscription is concluded and when the right of withdrawal (Widerrufsrecht) is exercised, we log the process for evidentiary purposes. The following is processed: time (date/time), selected plan/billing period, the confirmations given in the ordering process (e.g. acknowledgement of the information on the right of withdrawal, consumer/business (Verbraucher/Unternehmer) declaration), IP address and browser identifier (user agent). In addition, we store the contract confirmation (PDF) sent pursuant to § 312f BGB (German Civil Code) and the dispatch log and, where applicable, the retrieval log.

Purpose: fulfilment of the statutory information and verification obligations (§ 312f BGB, Art. 246a EGBGB – Introductory Act to the German Civil Code), proof of contract conclusion and of the commencement/observance of time limits, and protection against abusive claims. Legal basis: Art. 6(1)(c) GDPR (legal obligation) and Art. 6(1)(f) GDPR (legitimate interest in preserving evidence). Storage period: until expiry of the statutory retention and limitation periods (as a rule up to 10 years, § 147 AO / § 257 HGB; general limitation period § 195 BGB); thereafter the data will be deleted or restricted (blocked) for the duration of statutory retention obligations.

Processing on behalf in the customer relationship

Insofar as you, as a customer, process personal data of third parties with QROVA (e.g. contact, customer or receipt data of your own business partners), you are the controller for this under data protection law and we act as a processor pursuant to Art. 28 GDPR. The details are governed by our data processing agreement (Auftragsverarbeitungsvertrag, AVV) together with the annex on technical and organisational measures and the list of sub-processors.

Updated on 27.09.2026.