Krealo QR privacy policy

Krealo QR is a service provided by Krealo Média inc. in Québec, Canada. The person in charge of personal-information protection is Keneth Walters, reachable at info@krealomedia.com.

We collect only what is needed to run the service:

• Account: your email address and the identifier provided by Google or Apple if you sign in with either.
• Links and QR codes: the destination addresses, slugs and settings you create.
• Clicks: for each visit to a short link, the date and time, the country (from Google’s network header), the device type (mobile, tablet or desktop), the operating system and browser, the browser language, the referrer domain and whether the visit came from the QR code or the link. No IP address is stored. To count unique visitors we compute a one-way fingerprint (SHA-256) of the IP address and browser with a salt that changes every day and is erased after 48 hours: only the fingerprint is kept, for 2 days, and it can neither recover the address nor link two days together.
• Billing: the status of your subscription. Payment details are handled by PayPal.

This information lets you sign in, redirects visitors to your destination, counts clicks, shows you your statistics, manages your subscription, keeps the service secure and lets us reply to you.

The Krealo QR extension for Chrome uses three permissions: activeTab (to read the address and title of the open tab, only when you click the extension button or its context-menu item), contextMenus (to add the “Shorten this link with Krealo QR” item to the right-click menu) and storage (to keep your personal API token in your browser and, briefly, the last link created from the menu).

Your token stays in your browser and is not synced. The extension only talks to qr.krealomedia.com: it sends your token and the address and title of the page you choose to shorten, when you ask, to create the short link and its QR code. It does not read other tabs or your history, sends nothing to third parties and contains no ads or analytics.

Data is hosted on Google Cloud and Firebase. The database, functions and the files you upload (logos, PDFs, photos), including their review, are in Montréal (northamerica-northeast1). Sign-in is handled by Firebase Authentication, a global Google service with no selectable region.

Part of the data is therefore processed outside Québec and Canada and may be subject to the laws of another country, including access by its authorities. Krealo QR sends no data to any artificial intelligence provider.

• Click events are kept for one year.
• Technical logs are kept for 30 days.
• Your account data, links and QR codes are kept as long as your account exists. On request, deleting your account removes your links and click events.

We don’t sell your information. It is processed by our technical providers: Google Cloud and Firebase for hosting and authentication, and PayPal for payments. Krealo QR never sees your card number.

Google Analytics 4 loads only after you accept the cookie banner. If you decline, the site works the same way, with no consequence for you.

Law 25 gives you rights over your personal information: access, rectification, deletion, portability and withdrawal of consent. To exercise any of them, write to info@krealomedia.com. We answer within 30 days.

For any question, write to info@krealomedia.com. If our answer doesn’t satisfy you, you can file a complaint with the Commission d’accès à l’information du Québec.