1. What this policy covers
This policy describes how Linkray handles the data inside the service: customer accounts, QR codes and the scans they record. It sits alongside our Privacy Policy, which explains your rights and our legal bases.
2. Who is responsible for what
- Account and billing data: Studio74 decides how this is used and is the data controller.
- Scan data: the customer who created a QR code decides why scans are measured, so the customer is the data controller and Studio74 is the data processor. We process scan data only to show it back to that customer, and never use it for anything else.
If you print Linkray codes, you’re responsible for having a lawful reason to measure scans and for telling the people who scan them, for example in the privacy notice on the page your code points to.
3. What a scan records
| Field | Example | Why |
|---|---|---|
| Time | 1 Oct 2026, 12:04 | Scans per day and busiest days |
| Code | Table menu | Which code was scanned |
| Location | Denmark, Capital Region, Copenhagen | Where codes are scanned. Taken from the IP address, which isn’t stored |
| Device | Mobile, iOS, Safari | What people scan with |
| Referrer | instagram.com | Where a visit came from, if there is a referring site |
| Daily visitor code | A random-looking 32-character string | Counting unique visitors per day |
The daily visitor code is made by scrambling the IP address and browser details together with the date and a secret value. It changes every day and can’t be reversed, so it can’t be used to identify anyone or follow them from one day to the next.
Never recorded: IP addresses, precise location, names, contact details, cookies or any identifier that follows a person across days or websites.
4. Where data is stored
All Linkray data is stored in a Supabase Postgres database in the EU (Ireland). The app runs on Vercel’s servers in Dublin, Ireland. Requests from around the world pass through Vercel’s global network to get there. Payments are handled by Stripe and emails are delivered by Resend; see section 7.
5. How long we keep data
| Data | Kept for |
|---|---|
| Account details | Until you delete your account. Deletion is immediate. |
| QR codes, link history and scans | As long as the code exists. Deleting a code deletes its scans and history; deleting your account deletes all of them. |
| Scan history beyond your plan’s limit | Still stored, but hidden until you upgrade. It’s deleted with the code or account. |
| Daily visitor code | Stored with each scan, but changes every day so it can’t link visits over time. |
| Invoices and payment records | Five years, as required by the Danish Bookkeeping Act, kept by Stripe. |
| Hosting, sign-in and email delivery logs | A short period, kept by our providers to run the service and investigate problems. |
| Database backups | A short period, after which they’re overwritten. Deleted data disappears from backups when they roll over. |
6. How data is protected
- All traffic to Linkray is encrypted with HTTPS, and stored data is encrypted at rest.
- Passwords are stored only as one-way hashes. Nobody at Linkray can read them.
- Card details are handled entirely by Stripe and never touch our servers.
- Row-level security in the database means a signed-in customer can only ever read their own codes and scans.
- Access to production data is limited to the people at Studio74 who need it to run the service.
- Password and email changes trigger a security notice to the account’s address.
7. Sub-processors
| Provider | Purpose | Location |
|---|---|---|
| Supabase Inc. | Database and authentication | EU (Ireland) |
| Vercel Inc. | Hosting and running the app | EU (Ireland), global network |
| Stripe Payments Europe Ltd. | Payments, subscriptions and invoices | EU and USA |
| Resend Inc. | Delivering all Linkray emails | USA |
Transfers to the USA are covered by the EU–US Data Privacy Framework or Standard Contractual Clauses. We’ll update this list before adding a new sub-processor.
8. Your controls
- Pause a QR code to stop it redirecting and recording scans, without deleting it.
- Delete a QR code to remove it with all its scans and history.
- Delete your account under Profile to remove everything at once and cancel any subscription.
- Email hey@linkray.io for a copy of your data. We reply within one month.
9. If something goes wrong
If a security breach affects personal data, we notify the customers affected without undue delay, and the Danish Data Protection Agency within 72 hours where the law requires it. We tell you what happened, what data was involved and what we’re doing about it.
10. Contact
Linkray is a product by Studio74, CVR DK46432142, Denmark. Questions about this policy or your data go to hey@linkray.io.