1. Who we are
Linkray is a product by Studio74, CVR DK46432142, Denmark. Studio74 is the data controller for the personal data described in this policy, unless a section says otherwise.
Questions about privacy, or requests about your data, go to hey@linkray.io.
2. What we collect about customers
When you create an account and use Linkray, we process:
- Account details: your name, email address and password. Your password is stored only as a one-way hash by our authentication provider, so we can never see it.
- Billing details: your plan, subscription status, renewal date and a Stripe customer reference. Card details are entered directly with Stripe and never reach our servers.
- Your content: the names, destination links and colors of your QR codes, and a history of every change to where a code points.
- Sign-in and security data: session cookies that keep you logged in, and technical logs (including IP addresses) that our hosting and authentication providers keep for a short time to run the service and prevent abuse.
- Emails we send you: account emails such as sign-up confirmation, password resets, confirmations of plan changes and security notices. We don’t send marketing email.
3. People who scan a Linkray code
When someone scans a Linkray QR code, they pass through a Linkray link that sends them on to the destination. To give the code’s owner scan statistics, we record:
- the time of the scan, and which code was scanned
- the approximate location (country, region and city), worked out from the IP address at the moment of the scan
- the device type, operating system and browser
- the domain of the referring website, if there is one
- a code that changes every day, made by scrambling the IP address and browser details with a secret value. It lets us count unique visitors per day and can’t be turned back into an IP address or linked across days
We don’t store IP addresses, don’t set cookies when a code is scanned, and don’t track people across websites. Scans from known bots and link-preview services aren’t recorded.
For this scan data, the customer who created the code decides why it’s collected and is the data controller. Linkray processes it on their behalf. Our Data Policy describes this in detail.
4. Why we use your data
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Provide your account and QR codes | Account details, your content | Contract, Art. 6(1)(b) |
| Take payment and manage your plan | Billing details | Contract, Art. 6(1)(b) |
| Keep accounts and the service secure | Sign-in and security data | Legitimate interest, Art. 6(1)(f) |
| Send account and billing emails | Name, email address, plan | Contract, Art. 6(1)(b) |
| Scan statistics for code owners | Scan data (see section 3) | Legitimate interest, Art. 6(1)(f) |
| Keep accounting records | Invoices and payments | Legal obligation, Art. 6(1)(c) |
7. Transfers outside the EU
Your data is stored in the EU. Stripe, Vercel and Resend are US companies, so some data may be processed in the USA. Those transfers are covered by the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.
8. How long we keep data
We keep your account and content until you delete them. Deleting a QR code removes its scans and history, and deleting your account removes everything at once. Accounting records are kept for five years, as Danish bookkeeping law requires. The Data Policy lists every retention period.
9. Your rights
Under the GDPR you have the right to:
- get a copy of the personal data we hold about you
- have incorrect data corrected. You can change your name and email under Profile
- have your data deleted. You can delete your account yourself under Profile
- restrict or object to processing based on our legitimate interests
- receive your data in a portable format
Email hey@linkray.io to use any of these rights. We reply within one month. If you’re not happy with how we handle your data, you can complain to the Danish Data Protection Agency, Datatilsynet.
10. Children
Linkray is a tool for businesses and isn’t meant for children. We don’t knowingly collect data from anyone under 13. If you believe a child has created an account, contact us and we’ll delete it.
11. Changes to this policy
When we change this policy, we update the date at the top. If a change affects how we use your data in a meaningful way, we’ll email account holders before it takes effect.