← Back to QR Pelle

Terms of Service

Last updated · 4 May 2026

These terms cover your use of QR Pelle. They're short on purpose. By creating an account or using the service, you agree to them.

What QR Pelle is

QR Pelle is a service for creating, branding, and tracking QR codes and short links. We run it from Sweden.

Your account

  • You're responsible for keeping your password secure.
  • One human, one account. Don't share logins.
  • You must be at least 16 years old to sign up.
  • You can delete your account any time by emailing pelle@3dpelle.se. We'll remove your data within 30 days.

Acceptable use

Don't use QR Pelle to:

  • Send people to malware, phishing, or illegal content.
  • Harass, defraud, or impersonate anyone.
  • Bypass our limits, scrape the service, or otherwise abuse it.
  • Break any law that applies to you, your customers, or your country.

We can suspend or terminate accounts that do any of the above. We'll tell you why if we do.

Plans & payment

  • Free is free, forever, and capped at one QR code in draft mode. No analytics on Free.
  • Pro unlocks unlimited codes, live publishing, and analytics.
  • You can upgrade or downgrade any time. If you cancel, you keep Pro until the end of your billing period and then drop back to Free. Your codes stay; their scan history stays.
  • Prices on the pricing page are in SEK and exclude VAT where required.

Your content

You own the destinations, labels and logos you put into QR Pelle. You give us a limited license to host them so we can run the service. We don't use your content to train models or sell it.

The service is provided "as is"

We try our best, but we can't guarantee QR Pelle will be uptime-perfect or fit every purpose. To the extent allowed by law, we're not liable for indirect damages, lost profits, or third-party scans you didn't expect.

Changes

If we change these terms in any meaningful way, we'll let you know by email and update the "last updated" date at the top.

Data processing addendum (DPA)

When you use QR Pelle to track scans of QR codes, you act as the data controllerfor your visitors' data. QR Pelle acts as your data processor. This section forms our standard DPA — it applies automatically to every paying and free account; no extra signature needed. If you need it as a signed PDF for procurement, email pelle@3dpelle.se.

Scope and roles

  • You (Customer) decide why and how visitor data is collected — for example, by publishing a QR code in a public place. You are the controller under GDPR.
  • QR Pelle (3D Pelle AB) processes that data on your instructions to deliver the service: storing scan events, redirecting QR codes, and producing your analytics dashboards. We are the processor.
  • We process the categories of data described in our Privacy Policy: account data, link configuration, and per-scan data (hashed IPs plus geo and device fields derived from request headers).

Subprocessors

We use the following subprocessors to run QR Pelle. They're bound by their own DPAs with us, and we treat their compliance as ours.

  • Vercel Inc. — application hosting, edge CDN, DNS for the apex domain. Requests are served from European edge regions where available. Vercel acts as a processor under their DPA.
  • Supabase — managed PostgreSQL database. Our project is provisioned in eu-north-1(Stockholm), so account data, link configuration, and scan events stay inside the EU. Bound by Supabase's DPA.
  • Resend — outbound transactional email (verification, password reset, billing notices). The Resend region we use is eu-west-1(Ireland). Bound by Resend's DPA.
  • Google LLC— only relevant if a user chooses "Sign in with Google". In that flow Google identifies the user and returns the email + a verified flag. We do not send Google any visitor scan data.

We'll email you in advance if we add or replace a subprocessor that processes personal data; you can object by terminating your account before the change takes effect.

International transfers

All primary processing happens inside the EU (Sweden + Ireland). Vercel may serve cached static assets from edge regions outside the EU, but no personal data is stored there. Where a transfer outside the EEA is required (e.g. our subprocessors' admin consoles), it relies on the European Commission's standard contractual clauses.

Technical and organisational measures (TOMs)

These are the safeguards we apply. They apply to every plan, including Free.

  • Transport encryption — TLS 1.2+ on every customer-facing endpoint and between the app and the database.
  • Storage encryption — Supabase encrypts data at rest with AES-256.
  • Authentication — passwords hashed with bcrypt (cost 12). Sessions are HMAC-SHA256-signed cookies with a 24-hour TTL, marked HTTP-only and SameSite=Lax. Google sign-in uses ID-token verification before account linking.
  • IP anonymisation — visitor IP addresses are never stored. Each scan stores only sha256(salt + ip); the salt is a server-side secret distinct from the session-signing key.
  • Access control — admin endpoints require anadminrole check on every request. Database credentials and signing secrets live only in Vercel's encrypted environment variables and Supabase's vault; they're rotatable on demand.
  • Abuse prevention — every URL destination is checked against Google Safe Browsing on create and edit. Destinations are rate-limited per user (5 changes / 24h) and a public report endpoint auto-archives a code after three credible reports.
  • Logging and monitoring— Vercel Analytics (cookie-less, aggregated) and request logs. We don't log request bodies or query params that contain user data.
  • Backups — daily automated backups via Supabase, retained for 7 days. Restores are tested ad hoc; we do not promise a specific RPO/RTO outside written enterprise agreements.
  • Vendor management — only the subprocessors listed above touch personal data.

Subject rights and data return

We help you respond to data subject requests (access, rectification, erasure, portability) without undue delay. If you delete a link or your account, the related scan events are deleted from the live database immediately and removed from backups within the 7-day backup retention window.

Breach notification

If we become aware of a personal-data breach affecting your account, we'll notify you by email within 72 hours, with the nature of the breach, the categories of data affected, and the steps we're taking. You remain responsible for any downstream notifications you owe to your end users.

Audit

On reasonable written request — and not more than once per year — we'll respond to a security questionnaire and share our subprocessors' SOC 2 / ISO 27001 reports where they exist. On-site audits aren't practical at our scale.

Governing law

Swedish law. Disputes go to Linköpings tingsrätt unless a consumer law in your country gives you a different forum.

Contact

Questions? Email pelle@3dpelle.se. A real human reads every message.