Privacy policy

Draft for legal review. This page is not yet in force and may change before VCTR launches. Text in [brackets] is still to be completed.

This policy explains what personal data VCTR (vctr.io) processes, why, and for how long. VCTR is run by Crobox Services B.V., trading as Crobox, Kloveniersburgwal 131H, 1011 KD Amsterdam, the Netherlands, registered with the Dutch Chamber of Commerce under number 80401120.

It covers two groups of people: visitors, who follow a VCTR Link or scan a VCTR QR Code, and account holders, who use the VCTR app, API or website.

People who follow a Link or scan a QR Code

When you scan a QR Code or click a Link, VCTR redirects you to the Destination the Link's owner chose and records the visit as a Hit. Our customer, the Workspace that owns the Link, decides to measure these Hits; for this data we process on their behalf, under our data processing agreement [legal to confirm the controller and processor roles].

No cookies

The redirect sets no cookies and uses no other technique to store or read anything on your device. We do not recognise you from one day to the next.

What your browser sends

Like any web request, following a Link sends us your IP address, your browser's user agent (browser, operating system and device), your preferred languages, the page you came from (referrer, if your browser sends it) and the time.

What happens to your IP address

• We use it once, to look up an approximate location: country, region, city and time zone.
• We use it once more, with your user agent, to compute a daily visitor hash (below).
• Then it is dropped. The IP address is never written to our analytics storage and is never shown or exported to the Link's owner.
• Between the redirect and that lookup, the Hit waits in an internal processing queue, which keeps messages for at most 7 days. Lookups normally happen within seconds.

The daily visitor hash

To count Daily unique visitors without cookies, we compute a hash of your IP address and user agent, mixed with a salt that changes every day (UTC). The salt is derived from a secret and the date, so a hash from one day cannot be matched to the next, and without that secret the hash cannot be turned back into your IP address. We keep the first 8 bytes of a SHA-256 hash.

What we keep about a Hit

• the time, the Link and the Destination you were sent to;
• country, region, city and time zone, with coordinates rounded to about one kilometre;
• device type, operating system and browser, and whether the request came from a known bot;
• your primary language, such as nl;
• the referring website's host name and the channel it implies, such as search or social;
• the daily visitor hash.

Hits are kept for up to 3 years. The Link's owner sees them according to their plan (6 months on Free, 3 years on paid plans) and can export them. Hits beyond a Workspace's monthly quota are only counted per Link and hour, without any detail.

To find the location, device and referrer, we use services run by Crobox inside our own infrastructure; no third party receives your IP address for this.

Links with Rules or a password

• If a Link sends visitors to different pages by country or device, we look up your location and device while redirecting you. To answer the next request quickly, the location is kept in memory with your IP address for at most 10 minutes, and the device with your user agent for at most an hour; neither is ever written to storage.
• If a Link is password-protected, failed attempts are counted to stop guessing, keyed by a hash of your IP address. A correct password gives you a link that works for 5 minutes; no cookie is set.

Pages on the way

If you open a Link's preview (by adding + to it), or a Link leads to a warning page or a contact page, those pages are served the same way and set no cookies.

Account holders

What we keep

• Your account: name, email address, a hash of your password (never the password), or, if you sign in with Google, your Google account identifier and the sign-in tokens Google issues.
• Sessions: when you sign in, we set a session cookie that keeps you signed in. It is needed for the app to work; we use no advertising or analytics cookies. Each session record holds the IP address and user agent it was created from, so you and we can spot unusual sign-ins. Sessions end when you sign out or after 7 days without use.
• Your Workspaces: Links, Destinations and their history, QR Code designs and logos, contacts on vCard QR Codes, members and invitations, and API keys (stored as hashes).
• Billing: paid plans are paid through Mollie, which holds your payment details (card or bank account) and the mandate that lets us charge renewals. We keep the billing details you enter for your invoices (name or organisation, address, country, email and VAT number), the result of the VAT number check with the EU's VIES service, your invoices and their amounts, the Mollie customer, payment and mandate identifiers, how your payment method shows (such as the last four digits of a card), the state of your subscription and your plan.
• Email: we send account emails, such as address verification, invitations and data export links, through Resend.
• Abuse reports: if you report a Link, we keep the report and, if you give it, your email address, to follow up.

The website

The vctr.io marketing pages and the free QR code generator use no cookies, no analytics and no third-party scripts. QR codes made in the free generator are rendered in your browser and never sent to us.

Security and operations

• Our servers keep request logs for security and troubleshooting, for 30 days. They record which page or Link was requested, not your IP address, browser details or the query string.
• Rate limits count requests per API key, account and IP address in short-lived counters. The API's per-IP counter holds the IP address and expires within a minute; the limits on sign-ups, new Links and abuse reports hold only a keyed hash of the address and expire within the hour.
• Destinations are checked against threat lists (Google Web Risk and URLhaus). Only the Destination URL is sent, not any visitor's data.

Why we process it

• To provide the service you or our customer signed up for: redirects, analytics, the app and the API (GDPR article 6(1)(b): performance of a contract).
• To keep VCTR safe from phishing, malware and abuse, and to keep it running (GDPR article 6(1)(f): legitimate interests).
• To meet bookkeeping and tax obligations for paid plans (GDPR article 6(1)(c): legal obligation).

Who else processes data

• Hetzner Online GmbH, in its Falkenstein data centre in Germany, where VCTR runs.
• Mollie, for payments and invoices.
• The European Commission's VIES service, to check business VAT numbers.
• Moneybird, for our bookkeeping of those invoices and payments.
• Resend, for account email.
• Google, only if you choose to sign in with Google.

We do not sell personal data, and we do not share it for advertising.

How long we keep it

• Hits: up to 3 years.
• Account and Workspace data: while your account exists. A deleted Workspace's Links stop after 30 days; their Codes are kept, so they are never reused, [and personal data in them is removed].
• Data exports you request: 7 days.
• Billing records: 7 years, as Dutch tax law requires.

Your rights

You can ask for access to, correction or deletion of your personal data, object to its processing, or ask for a copy. Account holders can export their Workspace's data in the app at any time. Because we never store visitors' IP addresses or recognise visitors across days, we usually cannot find the Hits that belong to one particular visitor.

Contact us at [privacy contact address]. You can also complain to your data protection authority; ours is the Autoriteit Persoonsgegevens, the Dutch Data Protection Authority.

Changes

We will post changes on this page and tell account holders about important ones by email.