Skip to main content
QRfarm

Privacy Policy

Learn how QRfarm handles technical information and protects your privacy.

Last updated: September 30, 2026

This Privacy Policy explains how QRfarm collects, uses, stores and protects information when you visit qrfarm.io, use its QR code tools or contact us.

1. Who We Are

QRfarm provides browser-based tools for creating, customizing and downloading static QR codes.

For the purposes of applicable data protection law, the operator and data controller responsible for personal data processed through QRfarm is:

  • Data controller: Sadık Akbulut
  • Contact address: Mahsen Mahallesi, No: 5, Amasya, 05300, Türkiye
  • Privacy email: [email protected]

Questions or requests concerning personal data, privacy rights or this Privacy Policy may be sent to the privacy email address above.

2. QR Code Content

QRfarm is designed to generate and customize QR codes directly in your browser.

Content entered into the QR code generator—such as URLs, text, email addresses, Wi-Fi credentials, phone numbers, contact details and geographic coordinates—does not need to be sent to our server to generate the QR code.

Uploaded logos and selected customization settings are also intended to be processed within your browser during the QR code creation and export process.

Unless you separately submit information through the contact form or another server-based feature, QRfarm does not intentionally store the content encoded in your QR codes.

You are responsible for deciding what information to place inside a QR code. Do not encode passwords, confidential information or sensitive personal data unless you understand that anyone who scans the QR code may be able to access it.

3. Information We May Process

3.1 Technical and Server Information

When you visit QRfarm, our server and hosting infrastructure may automatically process technical information needed to deliver and protect the website, including:

  • Your Internet Protocol address
  • Browser and device type
  • Operating system
  • Requested pages and files
  • Date and time of requests
  • Referring page, when supplied by your browser
  • HTTP status and diagnostic information
  • Security and error logs

This information is used to operate the website, diagnose technical problems, prevent abuse and maintain security.

3.2 Contact Form Information

If you use the QRfarm contact form, we collect the information you provide, including:

  • Your name
  • Email address
  • Message subject
  • Message content
  • Submission date and time
  • Browser user-agent information
  • Message read or unread status

To limit spam and repeated submissions, QRfarm also stores a pseudonymous one-way hash derived from the submitting IP address. The message database does not intentionally store the raw IP address in this field.

The technical web server or hosting provider may still process the original IP address as part of ordinary request and security logging.

Please do not include passwords, private Wi-Fi credentials, payment information, confidential documents or unnecessary sensitive personal information in your message.

3.3 Cookies and Session Data

QRfarm may use strictly necessary session cookies to:

  • Protect forms against cross-site request forgery
  • Maintain temporary form status
  • Display success or error messages
  • Protect administrative access
  • Support essential website security

These cookies are used for functional and security purposes. They are not intended for behavioral advertising.

Temporary form values may be stored in the active session when a submission fails validation so that you do not need to re-enter the entire message.

3.4 Browser Storage

QRfarm stores your analytics consent choice in your browser's local storage so that it can remember whether you accepted or rejected optional analytics.

This preference persists across page visits and browser restarts. QRfarm does not currently assign an automatic expiry to this stored choice. It remains until you change it, clear the website's browser data, or your browser removes it. Private browsing or browser restrictions may limit its persistence.

You can review or change your choice using the Analytics preferences link in the footer. Clearing the website's local storage removes the saved choice, so you may be asked again on a later visit.

This consent-preference entry records your analytics choice, not the content entered into the QR generator or an uploaded logo. Browser local storage is separate from the session cookies described above.

3.5 Optional Analytics and Consent Preferences

QRfarm uses Google Tag Manager to load Google Analytics 4 and understand how visitors use the website. Google Tag Manager, Google Analytics 4 and analytics cookies are optional and are loaded only after you select Accept analytics.

Before you make a choice, or when analytics is rejected, Google Tag Manager and Google Analytics scripts are not loaded. QRfarm does not intentionally send Google Analytics measurement events or cookieless analytics pings before consent. Your consent preference is stored locally in your browser so that the website can remember your choice.

When analytics is accepted, Google Analytics may process information such as:

  • Pages viewed and approximate visit time
  • Browser, device and operating-system information
  • Referring source or campaign information
  • General interaction and performance information
  • Approximate geographic information derived from technical request data

Google Analytics uses first-party cookies such as _ga and _ga_<container-id> to distinguish visitors and maintain session state. More information appears in our Cookie Policy.

QRfarm also uses Cloudflare Web Analytics and related performance services. Cloudflare Web Analytics is designed to provide privacy-focused, cookie-free website performance and usage measurements. Cloudflare may separately process technical request and security information when delivering or protecting the website.

Your analytics choice is stored in your browser under qrfarm_analytics_consent_v1. You can change the choice at any time by selecting Analytics preferences in the footer. Withdrawing consent does not affect processing that lawfully occurred before withdrawal.

4. How We Use Information

Information processed through QRfarm may be used to:

  • Provide and operate the website
  • Generate and display requested pages
  • Respond to contact messages
  • Investigate technical problems
  • Prevent spam, fraud and abuse
  • Protect the security and availability of the service
  • Maintain administrative records
  • Comply with legal obligations
  • Establish, exercise or defend legal claims

QRfarm does not use the content entered into the browser-based QR generator to create advertising profiles.

5. Legal Bases for Processing

Where the General Data Protection Regulation or similar law applies, personal data may be processed on the following legal bases:

Performance of a Request

We process information you submit when it is necessary to provide a feature you requested or respond to your enquiry.

Legitimate Interests

We may process limited technical and security information where necessary for our legitimate interests in:

  • Operating and securing QRfarm
  • Preventing spam and abuse
  • Diagnosing errors
  • Improving reliability
  • Responding to communications

We consider the nature and impact of this processing before relying on legitimate interests.

Legal Obligations

We may process or retain information when required to comply with applicable law, court orders or lawful requests from public authorities.

Consent

Where processing legally requires consent, we will request it before carrying out that processing. You may withdraw consent at any time, without affecting processing that lawfully occurred before withdrawal.

6. Sharing of Information

We do not sell contact form information or QR code content.

Information may be shared only when reasonably necessary with:

  • Hosting and infrastructure providers
  • Security, maintenance and technical service providers
  • Professional advisers where necessary
  • Public authorities when disclosure is legally required
  • A successor operator in connection with a legitimate business transfer

Service providers may process information only as necessary to provide their services and must handle it according to applicable contractual and legal requirements.

7. Third-Party Resources and Service Providers

QRfarm uses selected third-party providers to deliver, protect, measure and improve the website. Depending on the feature and your consent choice, these providers may receive technical information such as your IP address, browser details, requested resource, referring information and request time.

  • Google Tag Manager is used to manage the delivery of the Google Analytics tag.
  • Google Analytics 4 is used for optional audience and website-usage measurement based on your analytics preference.
  • Google Fonts may provide font resources used by certain pages.
  • Cloudflare provides delivery, security and cookie-free website performance measurement services.

Google and Cloudflare process information under their own privacy terms and may process data in countries outside Türkiye. Where required, QRfarm relies on applicable transfer mechanisms and provider safeguards.

QRfarm may replace, remove or self-host third-party resources as the website develops. Material changes will be reflected in this Privacy Policy or the Cookie Policy where appropriate.

8. External Links and QR Destinations

QR codes created with QRfarm may point to websites, applications, maps, social platforms or other services operated by third parties.

QRfarm does not control those third parties and is not responsible for their privacy or security practices. You should review the privacy policy of any external service before providing personal information.

9. International Data Transfers

Some hosting or technical service providers may process information in countries outside your country of residence.

Where required by applicable law, international transfers will be protected using an appropriate legal mechanism, such as:

  • An adequacy decision
  • Standard contractual clauses
  • Another legally recognized safeguard

You may contact us for more information about safeguards relevant to your personal data.

10. Data Retention

We retain information only for as long as reasonably necessary for the purpose for which it was collected.

In general:

  • QR code content processed only in your browser is not intentionally retained by QRfarm
  • Contact messages are retained while needed to respond, manage follow-up communication, prevent abuse or meet legal requirements
  • Pseudonymous submission identifiers may be retained with contact records for security and abuse prevention
  • Session data is temporary and normally expires when the session ends or is otherwise cleared
  • Technical and security logs are retained according to operational, security and hosting requirements

Information may be retained for a longer period where necessary to comply with law, resolve disputes or establish, exercise or defend legal claims.

When information is no longer required, it may be deleted, anonymized or securely overwritten in accordance with operational procedures.

11. Data Security

We use reasonable technical and organizational measures intended to protect personal information, including:

  • Restricted administrative access
  • Authentication and session protections
  • Form validation
  • Cross-site request forgery protection
  • Spam and rate-limit controls
  • Secure HTTPS connections
  • Access-controlled storage
  • Software and infrastructure maintenance

No internet service or storage system can guarantee absolute security. You should avoid sending information that is not necessary for your enquiry.

12. Your Privacy Rights

Your rights depend on the law applicable to the processing and may be subject to legal conditions and exceptions.

12.1 Rights under the GDPR

Where the General Data Protection Regulation applies, your rights include:

  • Access: Ask whether we process your personal data and request a copy and information about its use.
  • Rectification: Request correction of inaccurate data or completion of incomplete data.
  • Erasure: Request deletion where the legal conditions are met.
  • Restriction: Request that processing be limited in the circumstances specified by law.
  • Object to processing: Object on grounds relating to your situation where processing relies on legitimate interests or a public-interest task. You may object to direct marketing at any time.
  • Data portability: Where processing is automated and based on consent or a contract, receive data you provided in a structured, commonly used, machine-readable format and request transmission to another controller where technically feasible.
  • Withdraw consent: Withdraw consent at any time without affecting the lawfulness of earlier processing.
  • Automated decisions: Benefit from safeguards concerning solely automated decisions with legal or similarly significant effects, including human intervention and contesting a decision where applicable.

12.2 Rights under Turkish Law No. 6698 (KVKK)

Where KVKK applies, Article 11 gives you the right to:

  • Learn whether your personal data is processed and request information about that processing.
  • Learn the purposes of processing and whether your data is used consistently with those purposes.
  • Know the third parties to whom your data is transferred in Türkiye or abroad.
  • Request correction of incomplete or inaccurate data.
  • Request deletion or destruction under the conditions in Article 7.
  • Request notification of correction, deletion or destruction to third parties that received the data.
  • Object to a result against you arising from analysis exclusively through automated systems.
  • Seek compensation for damage caused by unlawful processing.

12.3 How to Contact Us and Exercise Your Rights

Send your request to [email protected]. Describe the right you wish to exercise and provide enough information to locate the relevant records. We may request proportionate additional information when needed to verify your identity. Please do not send identity documents or sensitive information unless requested through an appropriate channel.

For formal KVKK applications, applicable submission and identification requirements also apply. These include use of an email address previously supplied to and registered with the controller where that email submission method is used. Contact us if you need assistance with the applicable procedure.

Where GDPR applies, we respond without undue delay and normally within one month of receiving a request. When legally permitted because of complexity or the number of requests, this may be extended by up to two further months; we will explain the extension within the first month. KVKK applications are answered as soon as possible and within 30 days.

Requests are generally free. Any fee or refusal will be limited to circumstances permitted by the applicable law, and we will explain the reason and available remedies.

12.4 Complaints and Supervisory Authorities

Where GDPR applies, you may lodge a complaint with a competent data protection supervisory authority, particularly in the EU Member State where you habitually reside, work or believe an infringement occurred. Contacting us first is not a prerequisite for that right.

Under KVKK, you must first apply to the data controller. If your request is rejected or the response is insufficient, you may complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) within 30 days of learning of the response and, in any event, within 60 days of your application. If no response arrives within 30 days, you may complain during the remaining period up to the 60-day deadline; a late response does not restart that deadline.

Official guidance is available from the Turkish Personal Data Protection Authority. These procedures do not remove any judicial remedies available under applicable law.