Privacy policy

Last updated: July 2026

Data controller

Trazio is the controller of the personal data collected through the platform. For any privacy question you can reach us at the support email.

What data we collect

Account data (email and name), the content you create (items and pages), and the data visitors voluntarily submit through your forms (contacts). Scan analytics are collected in aggregate, without cookies and without storing visitors' IP addresses.

How we use it

To provide the service (create and manage QR codes, pages and contacts), manage your subscription and payment, and send service-related communications.

Legal basis and consent

Leads are only stored with the explicit consent of the person, collected in the form itself. Account data is processed on the basis of performing the service contract.

Processors and international transfers

We share data only with providers acting as processors under contract (Art. 28 GDPR): Supabase (hosting, database and authentication), Vercel (application hosting), Stripe (payments) Resend (email delivery) and Google Ireland Limited / Google LLC (analytics and campaign measurement via Google Analytics 4, subject to consent). Some may process data outside the European Economic Area (e.g. the USA); in that case transfers rely on appropriate safeguards: Standard Contractual Clauses (SCC) and/or the EU-U.S. Data Privacy Framework. You may request a copy of the safeguards at the support email.

Controller and processor (contacts)

Account data (email, name) is processed by us as controller. Data that visitors submit on our customers' pages (contacts) belongs to the customer, who is the controller; Trazio acts as a processor on that customer's behalf. If your data was submitted through a customer's page, contact that customer to exercise your rights; we will help route the request.

Your rights

You can exercise the rights of access, rectification, erasure, objection, restriction and portability, and withdraw consent at any time, by writing to the support email. We respond within one month. If you believe your request was not properly handled, you may lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.

Retention

Account data is kept while the account is active and up to 30 days after closure. Billing data is kept for the periods required by tax and commercial law. Leads are kept per the controlling customer's instructions. Detailed analytics are purged periodically; aggregated, anonymous summaries are retained. Support tickets and their attachments are treated as account data and follow the same period.

Cookies

Trazio distinguishes two kinds of cookies. First-party technical cookies (necessary or functional). They are exempt from the prior-consent requirement (Art. 22.2 LSSI-CE and Art. 5(3) of the ePrivacy Directive) and are always used: • Login session (Supabase): keeps you signed in and secures your account; it is required to access the dashboard. First-party; expires on logout or when the session expires. • Language preference (NEXT_LOCALE): remembers the language you chose so the platform is shown in the selected language. First-party, functional; kept for up to 12 months. • Consent preference (trazio_consent): remembers your cookie choice so we do not ask again. First-party, functional; kept for up to 6 months. The scan analytics on the public QR pages use no cookies and store no visitor IP address. Third-party cookies subject to consent (Google Analytics 4). On the site (not on the public scan pages) we use Google Analytics 4 for usage analytics and advertising-campaign measurement. These cookies are set only if you accept them in the cookie notice; by default they are off (Google Consent Mode v2: all signals denied except the strictly necessary ones). Provider: Google Ireland Limited (and Google LLC in the USA). Their use may involve transfers outside the European Economic Area, covered by Standard Contractual Clauses (SCC) and/or the EU-U.S. Data Privacy Framework. Approximate retention: user- and event-level data is kept for up to 14 months; aggregated reports are kept longer. Consent is voluntary and can be withdrawn or changed at any time from «Cookie preferences», a link available in the footer. These cookies can also be managed or deleted from your browser settings; blocking the technical ones may prevent login or reset your language preference.

Minors

The service is aimed at professionals and is not intended for children under 14. We do not knowingly collect data from minors; if you believe a minor has provided data, contact the support email for deletion.