Privacy policy
Last updated: July 2026
Draft pending legal review. This is not legal advice.
Data controller
Trazio is the controller of the personal data collected through the platform. For any privacy question you can reach us at the support email.
What data we collect
Account data (email and name), the content you create (items and pages), and the data visitors voluntarily submit through your forms (contacts). Scan analytics are collected in aggregate, without cookies and without storing visitors' IP addresses.
How we use it
To provide the service (create and manage QR codes, pages and contacts), manage your subscription and payment, and send service-related communications.
Legal basis and consent
Leads are only stored with the explicit consent of the person, collected in the form itself. Account data is processed on the basis of performing the service contract.
Processors and international transfers
We share data only with providers acting as processors under contract (Art. 28 GDPR): Supabase (hosting, database and authentication), Vercel (application hosting), Stripe (payments) and Resend (email delivery). Some may process data outside the European Economic Area (e.g. the USA); in that case transfers rely on appropriate safeguards: Standard Contractual Clauses (SCC) and/or the EU-U.S. Data Privacy Framework. You may request a copy of the safeguards at the support email.
Controller and processor (contacts)
Account data (email, name) is processed by us as controller. Data that visitors submit on our customers' pages (contacts) belongs to the customer, who is the controller; Trazio acts as a processor on that customer's behalf. If your data was submitted through a customer's page, contact that customer to exercise your rights; we will help route the request.
Your rights
You can exercise the rights of access, rectification, erasure, objection, restriction and portability, and withdraw consent at any time, by writing to the support email. We respond within one month. If you believe your request was not properly handled, you may lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.
Retention
Account data is kept while the account is active and up to [X] after closure. Billing data is kept for the periods required by tax and commercial law. Leads are kept per the controlling customer's instructions. Detailed analytics are purged periodically; aggregated, anonymous summaries are retained.
Cookies
Trazio uses only first-party technical cookies that are strictly necessary or functional, exempt from the prior-consent requirement (Art. 22.2 LSSI-CE and Art. 5(3) of the ePrivacy Directive). We use no analytics, tracking, advertising or third-party cookies, and scan analytics store nothing on the visitor's device. Cookies we use: • Login session (Supabase): keeps you signed in and secures your account; it is required to access the dashboard. First-party; expires on logout or when the session expires. • Language preference (NEXT_LOCALE): remembers the language you chose so the platform is shown in the chosen language. First-party, functional; kept for up to 12 months. You can change it anytime from the language selector. These cookies can be managed or deleted from your browser settings; blocking them may prevent login or reset your language preference.
Minors
The service is aimed at professionals and is not intended for children under 14. We do not knowingly collect data from minors; if you believe a minor has provided data, contact the support email for deletion.