Privacy policy
Last updated: 22 October 2026
QR Code Manager is operated by Bouwman.io ("we", "us"), based in the Netherlands. This policy explains what data we collect through qr.bouwman.io and the QR Code Manager product, why we collect it, and what say you have over it.
If you're a QR Code Manager customer, your own end customers who scan your QR codes are covered separately: see "Scan data we process on behalf of our customers" below. If you run your own privacy policy for your customers, that policy governs your relationship with them; we act as a data processor for you there, not the controller.
Information we collect directly
Visiting qr.bouwman.io
When you fill in the contact form, we collect your name, email address, optional company name, and your message, and send it straight to our inbox (qr@bouwman.io) by email. We don't add you to a mailing list or share it anywhere else.
If you accept our cookie banner, Google Analytics starts measuring how visitors use the site (pages viewed, general location, device type). It stays off until you accept: see "Cookies and local storage" below for exactly what that turns on.
Creating an account
When you or your team signs up for QR Code Manager, we store the email address and (hashed, never in plain text) password for each user, their role, and your workspace's name and branding settings. Your login session is kept alive using a refresh token stored in your browser's local storage, not a cookie, tied to your workspace. QR codes you create (their content, destination, and style) are stored so you can find, edit, and reuse them.
Signing up yourself
If you create a workspace yourself from our signup page, we also record whether you told us it's for personal or business use, and the name you gave. For a business that name is stored as the company name we would put on an invoice; for a personal account it's just what we call your workspace. We ask for nothing else, and we never ask for payment details to start on the free plan. Your email address gets the activation link, which is how we know the address is really yours.
How we protect your data
Passwords are stored only as bcrypt hashes, never in a form we could read. Each workspace's data is separated at the database level using PostgreSQL row-level security, so one workspace's queries physically cannot return another's rows. Location lookups for scans run against a database we host ourselves, so no scan or IP data is sent to a third party to do them, and raw IP addresses are never shown in the product or included in exports. Login sessions can be revoked: signing out invalidates that session on our servers, and if the same session credential is ever used twice, we treat it as theft and end every active session on the account.
Scan and click data we process on behalf of our customers
QR Code Manager lets our customers create "tracked" QR codes and short links: codes and links that redirect through our servers so the customer can see how often, when, and from where they get used. When someone scans one of these codes or opens one of these links, whether or not they have an account or have ever visited qr.bouwman.io, we record:
- the date and time of the scan
- the scanning device's IP address
- an approximate location (country, region, city), looked up from that IP against an offline database we host ourselves; nothing is sent to a third party to do this lookup
- device, operating system, and browser type, read from standard technical request headers (that is also how we tell link previews and other bots apart from people)
- which domain the scan or click came in on
This data belongs to the tenant whose QR code or link it is. We process it on their behalf so their analytics dashboard works; we don't use it for our own purposes, and the raw IP address is never shown in the product or included in analytics exports (it's used internally only to count "unique" scans). If you have questions about a scan or click recorded against a specific QR code or link, contact the organization that created it. Not sure who that is? Reach out to qr@bouwman.io and we'll help.
Cookies and local storage
Nothing tracking-related is set until you actively accept the cookie banner on qr.bouwman.io. Here's exactly what exists at each stage.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| qr_consent_v2 | Local storage | Remembers your cookie choice | Until you clear it or change your choice |
| qr_refresh_token / qr_super_refresh_token | Local storage | Keeps you signed in to the product; not set on the public marketing site | 7 days, or until you sign out |
| Name | Type | Purpose | Duration |
|---|---|---|---|
| _ga | Cookie (Google Analytics) | Distinguishes visitors | 2 years |
| _ga_<container id> | Cookie (Google Analytics) | Remembers session state for Analytics | 2 years |
Clicking "No thanks", or later reopening "Cookie settings" in the footer and withdrawing consent, stops Google Analytics from loading or receiving anything new. If it had already been running, its cookies may remain in your browser until they expire or you clear them yourself; we can't reach into your browser to remove them.
Because QR Code Manager is open source, you're welcome to read exactly how this is implemented in our public repository. View the source
Who we share data with
We use a small number of providers to run the service. None of them see more than they need to do their job.
- Google (Analytics): Measures site usage, only once you have accepted cookies.
- Resend: Sends transactional email: invites, password resets, invoices, and contact form notifications.
- Render: Hosts the application and provisions TLS certificates for tenant custom domains.
- Neon: Hosts our Postgres database.
- MaxMind: Publishes the GeoLite2 database we use for location lookups. We download and query it ourselves; no scan or IP data is ever sent to MaxMind.
We don't sell personal data, and we don't share it with anyone for their own marketing purposes.
How long we keep data
- Scan and click data is kept for as long as the QR code or short link it belongs to exists. Deleting one deletes its history with it.
- Billing periods keep a snapshot of that period's scan, QR code and short link counts for our own financial records, even after the underlying codes and links are later deleted.
- Account data is kept while your account is active, and for a reasonable period after in case you want to reactivate it.
- Contact form submissions live in our email inbox for as long as any email does.
Your rights
Under the GDPR, you can ask us to:
- give you a copy of the personal data we hold about you
- correct it if it's wrong
- delete it
- restrict or object to how we use it
- give it to you in a portable format
To exercise any of these, email qr@bouwman.io. If you're not happy with how we've handled a request, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or your own country's supervisory authority.
You can withdraw analytics consent at any time using the "Cookie settings" link in the footer.
Children
QR Code Manager isn't directed at children, and we don't knowingly collect data from anyone under 16.
Changes to this policy
We'll update the date at the top of this page if anything meaningful changes. Significant changes will be called out on the site.
Contact
Questions about this policy or your data? Email qr@bouwman.io