PRIVACY POLICY

Last revised on 31.10.2025

At qCard, your privacy is our top priority. We have specifically designed qCard around the principle of Data Minimization and Local Storage.

That means, qCard performs its core functionality (creating and scanning QR codes from your contact data) exclusively on your device. Your contact information is principally stored locally and not transferred to our servers.

We process and protect data strictly in compliance with applicable legal regulations, including the EU General Data Protection Regulation (GDPR), and according to the following privacy policy:

1. Data We Collect and Process

The types of information we process depend on how you use our qCard application (the “Service”). Given our commitment to local storage, the scope of personal data we process on our servers is highly limited.

A. Data Stored Locally on Your Device

Contact Information: All details you enter or import into the qCard application (names, phone numbers, email addresses, etc.) are stored only on your device. We do not have access to this data, nor do we store it on our servers.
Scanned Data: Information from scanned QR codes is also stored only on your device.

Hence, this data is principally not transferred to or processed by us.

B. Data We Collect and Process on Our Servers

We must process some basic operational and transactional data to operate, provide, improve, and support our Services.

Category of Data	Examples	When Collected/Processed
Operational & Device Data	Device model, operating system, app version, language setting, time zone, anonymized usage and log information, IP address.	When you install or use the Service or contact us (for technical support and stability).
Communication Data	Your name, email address, and the content/time of your request.	When you contact us.
Transactional Data	Name, address, payment data (e.g., credit card number, bank account details - usually handled by the payment provider).	When you make an in-app purchase.

2. Our Legal Bases for Processing

We process your data only when we have a valid legal basis to do so, as defined by GDPR.

Category of Data	Purpose of Processing	Legal Basis (Art. 6 GDPR)
Operational & Device Data	To ensure the stability and security of our Service, fix bugs, and analyze technical issues.	Legitimate Interests (Art. 6(1) lit. f): Our interest in providing a functional and secure application.
Communication Data	To respond to your inquiries and provide customer support.	Consent (Art. 6(1) lit. a): When you contact us.
Transactional Data	To process your in-app purchase payments and manage billing.	Contract Fulfillment (Art. 6(1) lit. b): Necessary for executing the purchase contract. Legal Obligation (Art. 6(1) lit. c): To comply with tax and accounting laws.
General Purposes	To investigate violations of our Terms or prevent illegal activity (e.g., fraud).	Legal Obligation (Art. 6(1) lit. c) or Legitimate Interests (Art. 6(1) lit. f): Our interest in protecting our rights and the safety of our users.

3. Sharing Your Information

We do not share the minimal data we collect with any third party, except in the following necessary cases:

Payment Services: We share necessary transactional data with payment providers (e.g., Google Play, Apple App Store, or a direct payment processor) to process your purchases.
Legal Obligations: Where we are legally obliged to do so (e.g., in response to a valid law enforcement or government request).
Consent: If you explicitly allow us to do so (e.g., for optional services).

We currently do not use third-party advertising or analytics services that track you across apps or websites.

4. Data Retention

We store your personal information only for as long as is necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law (e.g., for accounting or tax purposes).

Customer Support Data: Generally retained for up to 6 months after the resolution of an issue, or as long as necessary for documentation purposes.
Transactional Data: Retained according to mandatory German commercial and tax laws (typically six to ten years).

Upon request for account deletion, all data not subject to mandatory retention periods will be erased or anonymized.

5. Your Rights

You have the following rights regarding the personal data we process about you:

Right of Access (Art. 15 GDPR): The right to request copies of your personal data.
Right to Rectification (Art. 16 GDPR): The right to request that we correct any information you believe is inaccurate or incomplete.
Right to Erasure ('Right to be Forgotten') (Art. 17 GDPR): The right to request that we erase your personal data under certain conditions.
Right to Restriction of Processing (Art. 18 GDPR): The right to request that we restrict the processing of your personal data under certain conditions.
Right to Data Portability (Art. 20 GDPR): The right to request that we transfer the data we have collected to another organization, or directly to you, under certain conditions.
Right to Object (Art. 21 GDPR): The right to object to our processing of your personal data, particularly where the processing is based on our legitimate interests.
Right to Withdraw Consent (Art. 7 GDPR): If we process your data based on your consent, you have the right to withdraw that consent at any time.

Furthermore, as a data subject under the California Consumer Privacy Act (CCPA/CPRA), you have the right to request that we do not sell or share your personal information. If we sell or share your personal information as defined under the CCPA, we will provide a clear and accessible method (e.g. link or in-app setting) to opt out.

To exercise any of these rights, please contact us using the details provided below.

6. Data Protection Contact

You can contact our responsible Data Controller contact person regarding any data protection matters:

Phil Hackemann
Malsenstr. 61
80638 München
Germany
Email: Please enable JavaScript to see the email address.

7. Right to Lodge a Complaint

You have the right to lodge a complaint (Art. 77 GDPR) with our lead supervisory authority:

Bayerischer Landesbeauftragter für den Datenschutz (BayLDA)
Postfach 22 12 19
80502 München
Germany

Alternatively, you may lodge a complaint with your local supervisory authority.

8. Updates to Our Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes and give you the opportunity to review the revised policy before you choose to continue using our Services. For more, please also see our Terms of Use.