Privacy policy

Last updated 2026-08-26. This policy is published by [Company name to complete], the publisher of Stelyo ("we", "us"), available at [address to complete]. Contact for any data protection question: [contact email to complete].

Two kinds of people, two kinds of data

Account holders — the people who sign up and manage QR codes — give us an email address and password (handled entirely by our authentication provider, Supabase Auth). Scan visitors — the people who scan a code someone else created — never create an account and never see this app directly; the data we hold about them is limited to what a redirect naturally involves.

What we collect when a code is scanned

• Country, derived from the request's IP address at our hosting provider's edge
• Browser user agent and referring page, if any
• Timestamp of the scan
• A one-way visitor hash — SHA-256 of the visitor's IP address, the code's id, the calendar date, and a server-side secret — used only to tell "unique" from "repeat" scans in analytics

We never store the raw IP address. The visitor hash rotates every calendar day, so it cannot be used to recognize the same visitor across two different days, on this service or any other. We do not set cookies and do not use any client-side tracking script on the pages a scan visitor lands on, which is why this service does not show a cookie consent banner: nothing is stored in the visitor's browser, and the only server-side signal (the daily-rotating hash) is not a persistent identifier under applicable ePrivacy guidance.

Where data is hosted

Our database and file storage run on Supabase, in its eu-west-1 (Ireland, European Union) region. The web application runs on Vercel, pinned to the dub1 (Dublin, European Union) region — the same metro area as the database. Neither provider is used for advertising or analytics purposes of their own on this data.

How long we keep it

Scan and account data is kept for as long as the corresponding QR code, or account, exists. Deleting a QR code or a folder deletes its associated scan history. There is currently no separate automatic time-based deletion policy beyond that — if you need one for compliance reasons, contact us.

Sub-processors

• Supabase (database, authentication, file storage, edge functions) — EU (Ireland)
• Vercel (web application hosting)

Your rights

If applicable data protection law gives you rights over your data — access, correction, deletion, portability, or objection — write to [contact email to complete] and we will act on it. Account holders can already export or delete most of their own data directly from the dashboard.

Data processing agreement

Business customers who need a signed Data Processing Agreement can find our standard template at /legal/dpa — no sales call required to get a copy.