Privacy Policy

Last updated: September 8, 2026

This policy explains what personal data NimbleQR processes, why, and what rights you have. The data controller is Digitalt Håndverk (Org. no. 936 706 916), Norway. Contact: apps@digitalthandverk.no.

1. Data we process about account holders

• Account data — your email address and a hashed version of your password (we never store the password itself). Legal basis: performing our contract with you.
• Your content — the QR codes you create: titles and destination URLs. Legal basis: performing our contract.
• Billing data — if you subscribe, our payment provider Paddle (the merchant of record) processes your payment and billing details under its own privacy policy. We store only Paddle’s identifiers for your customer record and subscription, and the subscription status. We never receive your card details. Legal basis: performing our contract and legal obligations.
• Support correspondence — emails you send us. Legal basis: legitimate interest in supporting you.

2. Data we process when someone scans a code

When a visitor opens a NimbleQR short link, we redirect them to the code’s destination and record a scan event consisting of: a timestamp, the approximate country (derived from the IP address at the moment of the request), and a coarse device category (mobile, tablet, or desktop, derived from the browser’s user-agent string).

We do not store the visitor’s IP address or user-agent in our database, we set no cookies on redirects, and we do not build profiles of visitors. IP addresses may appear transiently in our hosting provider’s standard server logs. Legal basis: our and our customers’ legitimate interest in aggregate usage statistics.

3. Data we process when you visit our website

We measure how our own website and app are used with Pirsch Analytics, a privacy-friendly, cookieless analytics service operated in Germany, with the data stored on servers in Germany. It records page views and a small set of non-identifying details such as the referring site, the approximate country, and the browser and device type, plus a handful of product events (for example a signup or a QR download).

Pirsch sets no cookies, stores no IP address, and cannot track you across other websites. To count returning visits within a single day it derives a one-way hash from the IP address, user-agent, date, and a rotating salt; that hash cannot be reversed and stops matching you after 24 hours. Legal basis: our legitimate interest in aggregate statistics about our own website.

4. Processors and transfers

We use these processors to operate the Service:

• Vercel — application hosting and content delivery (servers may be located outside the EEA; transfers are safeguarded by EU standard contractual clauses and, where applicable, the EU–US Data Privacy Framework).
• Neon — database hosting.
• Paddle — payments, as an independent controller / merchant of record for checkout and billing data.
• Pirsch Analytics (Emvi Software GmbH, Germany) — cookieless website analytics, processed and stored within the EU.

We do not sell personal data or share it with advertisers.

5. Cookies

The app sets a single, strictly necessary session cookie to keep you logged in. Our analytics are cookieless and we use no advertising cookies, so we show no consent banner. During checkout, Paddle may set cookies needed to process the purchase.

6. Retention

• Account data and content: kept until you delete them or your account.
• Scan events: kept while the related code exists.
• Website analytics: retained in aggregate by Pirsch; no personal data is stored.
• Billing records: kept by Paddle and by us as required by bookkeeping and tax law.

You can delete individual codes (including their scan history) and your entire account from the app at any time — account deletion cancels any subscription and removes your data immediately.

7. Your rights

Under the GDPR you have the right to access, correct, delete, and receive a copy of your personal data, to object to or restrict certain processing, and to withdraw consent where processing is based on it. Contact apps@digitalthandverk.no to exercise these rights.

8. Changes

We will update this policy as the Service evolves and note the date above. For material changes we will notify account holders. See also our Terms of Service.