Privacy Policy

Who we are

sqr.art is operated by CAMINA (SASU), 11 Avenue Maurice Chevalier, 06150 Cannes, France. This policy describes how we process personal data in accordance with the EU General Data Protection Regulation (GDPR).

Data we collect

• Account data — name, email address and password (hashed) when you create an account.
• Content — images you upload, destination URLs, and the generated QR codes.
• Scan data — when a QR code is scanned we record the timestamp and the browser's user-agent string (categorized as mobile, tablet, desktop or bot). We do not store the scanner's IP address with scan records and we do not track scanners across sites.
• Billing data — subscriptions are processed by Stripe. We never see or store your card details; we keep only the Stripe customer and subscription identifiers.
• Technical logs — IP addresses appear in server logs and rate-limiting counters for security purposes.

Why we process it

We process this data to provide the service (contract performance, Art. 6(1)(b) GDPR), to secure and rate-limit the platform (legitimate interest, Art. 6(1)(f)), and to comply with legal obligations such as invoicing (Art. 6(1)(c)).

Cookies

sqr.art only uses essential cookies: the session cookie and the CSRF token required for the application to function. We run no advertising or analytics trackers, so no cookie banner is needed.

Sharing

Data is shared only with the processors required to run the service: our hosting provider (OVHcloud, France) and Stripe (payments). We never sell personal data. Data may be disclosed to authorities when legally required.

Retention

Account data and QR codes are kept while your account is active and deleted upon account deletion. Failed or abandoned anonymous generations are purged automatically. Technical logs are kept no longer than 13 months.

Your rights

You may access, correct, export or delete your data, and object to or restrict its processing. Write to privacy@sqr.art. You may also lodge a complaint with the CNIL (cnil.fr).