Legal

Privacy Policy

Last updated: October 3, 2026

Who We Are

Qodie (“we”, “us”, “our”) is a QR code generator service operated by Ângelo Cunha. We are committed to protecting your privacy and processing your personal data in compliance with the General Data Protection Regulation (GDPR) and other applicable EU data protection laws.

Data Controller
Ângelo Cunha
Contact
hello@aesc.dev
Website
aesc.dev

Data We Collect

We only collect data that is necessary to provide and improve our service. We do not sell your personal data to third parties.

  • Account data: Email address and hashed password when you create an account.
  • Payment data: Billing information processed securely through Stripe. We do not store credit card numbers on our servers.
  • Saved QR codes: the content and design options of QR codes you save to your account, and how many times editable codes are scanned. QR codes you only generate and download stay in your browser and are never sent to us.
  • Usage statistics: counts of visits and of actions such as generating or downloading a QR code, collected without cookies. They never include the content of your QR codes or anything that identifies you.
  • Technical data: IP address, browser type, and device information collected automatically through server logs for security and debugging purposes.

Legal Basis for Processing

Under GDPR Article 6, we process your personal data on the following legal bases:

  • Contract performance (Art. 6(1)(b)): Processing your account and payment data is necessary to provide the service you signed up for.
  • Legitimate interest (Art. 6(1)(f)): Collecting technical data for security, fraud prevention, and service improvement.
  • Consent (Art. 6(1)(a)): Where required, such as for optional marketing communications. You can withdraw consent at any time.
  • Legal obligation (Art. 6(1)(c)): Retaining billing records as required by tax and accounting laws.

How We Use Your Data

  • To create and manage your account
  • To process payments and manage subscriptions
  • To generate QR codes based on your input
  • To provide customer support
  • To detect and prevent fraud or abuse
  • To comply with legal obligations (e.g., tax reporting)

Third-Party Services

We use the following third-party processors. Each operates under their own privacy policy and GDPR-compliant data processing agreements:

  • Supabase — Authentication and user data storage. Data may be processed in the EU or US under Standard Contractual Clauses.
  • Stripe — Payment processing. Stripe is a certified PCI Level 1 Service Provider and processes data under their privacy policy.
  • Google Ads — Measures whether our ads lead to sign-ups and purchases. Only active if you accept advertising cookies in the cookie banner.

Data Retention

  • Account data: Retained while your account is active. Deleted within 30 days of account deletion request.
  • Payment records: Retained for 7 years as required by EU tax regulations.
  • Server logs: Automatically deleted after 90 days.
  • Generated QR codes: Processed in memory and not permanently stored.

Your Rights Under GDPR

As a data subject in the European Union, you have the following rights. To exercise any of these rights, contact us at hello@aesc.dev. We will respond within 30 days.

  • Right of access (Art. 15): Request a copy of all personal data we hold about you.
  • Right to rectification (Art. 16): Request correction of inaccurate personal data.
  • Right to erasure (Art. 17): Request deletion of your personal data (“right to be forgotten”).
  • Right to restrict processing (Art. 18): Request that we limit how we use your data.
  • Right to data portability (Art. 20): Receive your data in a structured, machine-readable format.
  • Right to object (Art. 21): Object to processing based on legitimate interest.
  • Right to lodge a complaint: You may file a complaint with your local data protection authority (supervisory authority) if you believe your rights have been violated.

Cookies

  • Essential: two cookies keep you signed in — a secure session cookie, and one that remembers your account email so pages load without flicker. They are strictly necessary and need no consent.
  • Advertising: Google Ads cookies are only set if you choose “Accept” in the cookie banner; until then none are stored. Your choice is remembered in your browser, and clearing this site’s data lets you choose again.
  • Analytics: our usage statistics are collected without cookies or any other storage on your device, so they need no consent.

International Data Transfers

Some of our third-party processors may transfer data outside the European Economic Area (EEA). Where this occurs, appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, or the processor operates in a country with an EU adequacy decision.

Security

We implement appropriate technical and organizational measures to protect your personal data, including encrypted data transmission (TLS/HTTPS), hashed passwords, and access controls. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

Children’s Privacy

Our service is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

Changes to This Policy

We may update this privacy policy from time to time. Material changes will be communicated via email to registered users. The “last updated” date at the top of this page reflects the most recent revision.

Questions?

If you have any questions about this privacy policy or how we handle your data, reach out at hello@aesc.dev.