Privacy & cookies

Data controller

WISHMAKERS, Paris Trade Register no. 904 719 556, registered office: 66 avenue des Champs-Élysées, 75008 Paris, France — contact: hello@ever-qr.com.

What we collect — and what we don't

The service is built on data minimisation: your QR code is generated locally in your browser. Your creation only reaches our systems at payment time, to enable order recovery.

Data processed when you purchase: email address (recovery link, matching your Stripe payment); your QR configuration (destination, colours, style, logo) — contained in the recovery link, stored for 90 days in Cloudflare KV, then automatically deleted; billing details (name, billing address and optional business tax ID) — collected by Stripe to issue and deliver paid invoices, not stored directly by Ever-QR; payment data — processed exclusively by Stripe; we never see or store card numbers; limited acquisition source — when you start payment, we may attach the referring domain (for example google.com), first landing path and any UTM campaign tags to the order. We do not transmit a full referring URL or build a browsing history.

We do not collect: user accounts, detailed browsing histories, advertising identifiers or cross-site profiles. No newsletter. Acquisition attribution is limited to the order and is used only to understand how customers discover the service.

Legal basis and retention

Processing required to deliver your order is based on contract performance (art. 6(1)(b) GDPR). Limited acquisition measurement is based on our legitimate interest (art. 6(1)(f) GDPR) in understanding which channels make the service discoverable, without advertising tracking or profiling. Retention: QR configuration and recovery link — 90 days; email dispatch markers — 180 days; order data and related metadata at Stripe — the legal and operational retention periods applicable to payments.

Recipients and transfers

Three technical processors acting on instruction: Cloudflare (hosting, recovery-link storage), Stripe (payments), Resend (recovery emails). These providers are US-based and participate in the EU-U.S. Data Privacy Framework or provide equivalent contractual safeguards (standard contractual clauses).

Your rights

You have the rights of access, rectification, erasure, restriction, portability and objection (art. 15–21 GDPR). To exercise them: hello@ever-qr.com, attaching your Stripe receipt so we can locate the order. You may lodge a complaint with the CNIL (cnil.fr) or your local supervisory authority.

Cookies

This site sets no tracking, analytics or advertising cookies. That is why there is no consent banner: there is nothing to consent to.

Three points of technical honesty: your browser keeps your latest QR configuration locally (localStorage), on your device only, for strictly functional purposes. A very limited first-party attribution record (source, medium, first landing path, referring domain and UTM tags) may be kept in sessionStorage for the current tab and sent to Stripe only if you start a payment. No analytics cookie is set. Our host Cloudflare may set strictly necessary security cookies (bot protection), which are exempt from consent. The payment page is operated by Stripe on its own domain, where Stripe's cookie policy applies (stripe.com/privacy).