Privacy policy

1. Controller and contact

The controller is Veltessa. For any privacy question or request, write to info@veltessa.com or use the contact form.

2. Our two roles

As a controller we process data about visitors to this site, people who write to us through the contact form, and the sign-in and security data of panel accounts.

As a processor we process the content our customers enter in their workspaces (QR codes, their destinations, business card details, logos) and the scan statistics of their codes, on that customer's instructions and only to provide the service. The customer is the controller of this data; the terms are set out in the data processing agreement. If you send us a request about such data, we forward it to the customer concerned.

3. What data we process

• People who scan a QR code: When a dynamic code is scanned, we record only the time, the country, the device type (mobile, tablet, desktop, other) and the operating system. Cloudflare determines the country from the connection; device type and operating system are derived from the identification string the browser sends (user agent). Neither the IP address nor the user agent itself is stored; these records do not identify anyone. At most one scan per minute is counted for the same code from the same network; this limit is kept in Cloudflare's rate limiter and is not written to the database. If a code is protected with a password or PIN, attempts are likewise limited per network and code (the network is only used as a one-way key and is not stored), and a correct entry sets a cookie that keeps only that code open (see the cookie policy); the password or PIN itself is stored only as a salted, slow hash.
• Where a scan leads: Website codes send the person who scans them to the address the customer chose, location codes to Google Maps (Google LLC). The browser then connects to that site directly, and the site processes connection data such as the IP address under its own privacy policy. We send these sites no data and do not pass on the page the visitor came from (referrer).
• People who answer a feedback form: When a customer's feedback code is answered, we store the answer — the rating, the chosen answers and, if the visitor writes one, the comment — with the time, the country and the device type, like a scan. The comment is free text that the visitor writes, so it holds whatever they choose to share; the form asks for no personal details. The IP address is not stored. Answers are limited per network and code in the same way as password attempts (the network is only used as a one-way key and is not stored). The customer who owns the code sees the answers.
• Panel users: username, display name, an irreversible hash of the password (never the password itself), workspace memberships and roles, time of the last sign-in; sessions (start, last activity and expiry) and trusted devices. We do not ask for a phone number. An email address is optional: users may add one in their profile to receive notifications by email. It is used only once its owner confirms it through the link we send to it, and only for these notifications and that confirmation (never for marketing). These emails are sent through our email delivery provider.
• Activity log: who did what and when in a workspace (e.g. creating or editing a code, adding a user), the acting user's display name at the time and the name of the record concerned at the time. Some entries also hold usernames and former display names (e.g. adding, deleting or renaming a user). These names remain in the activity log until the entry's retention period ends, even if the user or record is deleted. Sign-in and sign-out events also record a shortened IP address (the last part of an IPv4 address set to zero; only the /48 prefix of an IPv6 address) and the country; failed sign-ins also record the username typed (only if that account exists).
• Sign-in attempt counters: short-lived counters per username (including names that do not exist), network (IPv4 address or IPv6 /64 prefix; only a keyed hash is stored, never the address itself) or device that limit password guessing; kept for about 24 hours at most.
• Link previews: When you open the phone preview of a website code in the panel, our server fetches the target page and its preview image itself; your browser does not connect to that site. The page's title, description and image are kept in Cloudflare's cache for at most an hour.
• Workspace content: QR codes and their destinations, content written into codes (e.g. the name, phone number and email on a business card), folders, projects, logos and brand colours. Our customers enter these.
• Contact form: name, email address, optional company name, topic and message. The message is delivered to us by email and is not stored on the site. To prevent abuse your IP address is used briefly by Cloudflare's rate limiter and the Cloudflare Turnstile check; we do not store it.
• Site visitors: We use no analytics, advertising or tracking tools. Cloudflare processes connection data (e.g. IP address, requested address) to deliver and protect the site. Our server logs (Cloudflare Workers Logs) keep only the error and maintenance messages the application writes; automatic per-request logs (including IP address and browser details) are switched off. Cloudflare sets how long these messages are kept (a few days). What the site and the panel keep in your browser, and what of it needs your consent, is in the cookie policy.

We collect data electronically, automatically or as you enter it, while you use the site, the panel, short links and the contact form.

4. Purposes and legal bases

We do not sell your data, use it for advertising or build profiles.

5. Retention

The periods are defined in the code and enforced by an automatic clean-up that runs every day:

• Scans: 366 days, then deleted. A code's total scan count and last scan time remain while the code exists.
• Feedback answers: 366 days like scans, then deleted; earlier when the code or the workspace is deleted.
• Activity log: 365 days; sign-in, sign-out, failed and blocked sign-in entries (with their shortened IP address) 90 days. Names of deleted users and records remain in the activity log until these periods end.
• Sign-in attempt counters: deleted after 24 hours without use.
• Sessions: end when the browser is closed, after 12 hours at most; with "remember me" after 30 days at most. A session unused for 7 days ends.
• Trusted devices: forgotten when not used to sign in for 365 days.
• Unused logos: deleted after 24 hours.
• Accounts and workspace content: for as long as the service is used; deleted when the customer deletes them or the workspace is deleted.
• Deleted QR codes: kept under “Deleted” in the workspace, where they can be restored, for 30 days by default (adjustable by the workspace admin, 7–90 days), then deleted for good with their scans.
• Workspace backups: backups of a workspace's content (QR codes, folders, templates, page themes and logos; no scans, no feedback answers and no user data except the name of who took the backup) that its admin takes, or that are taken automatically on the schedule the admin sets, are stored in Cloudflare R2 in the European Union jurisdiction. Only the newest ones the plan allows are kept; the admin can delete them at any time, and they are deleted with the workspace.
• Notification email address: until the user removes it or the account is deleted. A confirmation link works for 24 hours. Copies of the emails we send (recipient, subject, text) are kept for 14 days for troubleshooting, then deleted.
• Feedback sent from the panel: the kind and text of the message, if you choose the name of the panel page open at the time, the app version and the time; no IP address. Only our service team reads it; it is not part of the workspace export. Kept for a period chosen by the service operator (1 week to 3 years), never longer than 1095 days, deleted at once when the account or the workspace is deleted.
• Contact messages: kept in our mailbox as long as the conversation needs, then deleted.
• Backups: the database is backed up automatically every night. Each backup is encrypted with AES-256 under a key only the operator holds (the service itself cannot read the backups) and stored in Cloudflare R2 in the European Union jurisdiction; only the newest 14 are kept, and each new one deletes the oldest. Uploaded files and logo images, which the database backup does not contain, are copied once a week to the same storage, encrypted the same way; only the newest 4 weekly copies are kept. In addition, Cloudflare D1's point-in-time recovery (Time Travel) keeps earlier states of the database for the period Cloudflare sets for the account's plan (at most 7 days). Deleted data may remain in the backups for up to 14 days (uploaded files for up to 35 days) and in Time Travel for up to 7 days.

6. Where data is held and transfers

The service runs on the infrastructure of Cloudflare, Inc. (USA). The database is held in Cloudflare D1 with a Western Europe location hint. Requests are handled at the Cloudflare data centre nearest to you, so data may also be processed outside the European Economic Area and Turkey. Contact form messages arrive in the operator's Google (Gmail) mailbox. Notification and confirmation emails to users are sent through our email delivery provider, which is listed on the sub-processors page once email delivery is switched on. Encrypted database backups are stored in Cloudflare R2 in the European Union jurisdiction.

Transfers abroad rely on the safeguards of Chapter V GDPR and Art. 9 KVKK (e.g. standard contractual clauses and our providers' data processing agreements). Our providers are listed on the sub-processors page. We share data with authorities only where the law requires it.

7. Security

• Connections are made over HTTPS only.
• Passwords are stored as a salted, deliberately slow hash (PBKDF2); password guessing is limited per username, network and device.
• Session cookies cannot be read by scripts and are sent to this site only.
• Signing in to the panel is protected against bots with Cloudflare Turnstile.
• Roles and per-project access let every user see only the data they are allowed to; Wi-Fi passwords are shown only to roles that may edit codes. Important actions are written to the activity log.
• Pages are served with a strict content security policy; the site and the panel load no scripts from elsewhere (except Cloudflare Turnstile on the contact page and the panel sign-in). The panel loads no images from other sites either; our server fetches link preview images.
• The database is held on Cloudflare's infrastructure; its nightly backups are encrypted with a key only the operator holds, so the service itself cannot read them. The operator panel does not show workspace content. The operator exports a workspace's data only to answer a data request (at the customer's request or when the service ends); every such export is recorded in the operator's own activity log (it does not appear in the customer's). Direct database access is used only for maintenance, backups and support, and only as far as needed.

8. Your rights

Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to its processing and to data portability. Under Art. 11 KVKK you may also learn whether and how your data is processed, to whom it was transferred, have corrections and erasures notified to recipients, object to an adverse result of solely automated analysis and claim compensation for unlawful processing.

Send requests to info@veltessa.com; we answer free of charge within 30 days. We may ask for information to verify your identity. You may also complain to the supervisory authority of your country (in Hungary the NAIH) or to the Turkish Personal Data Protection Authority.

9. California residents (CCPA/CPRA)

We do not sell personal information, share it for cross-context behavioural advertising or use sensitive personal information to infer characteristics. The categories we collect and why are described above: identifiers (username; optional notification email address; name and email in the contact form; shortened IP address of sign-in events), internet activity (scan statistics that identify no one, the activity log) and what you write in the form.

You have the right to know, correct and delete your information and will not be discriminated against for exercising it. Write to info@veltessa.com with your request.

10. Children

Veltessa is a service for businesses and is not directed at children under 16. We do not knowingly collect data from children.

11. Changes

We update this page as the service changes; the current date is shown at the top. We announce important changes on this page and try to tell workspace administrators as well, through the contact address they gave us. For cookies, see the cookie policy.