Average Joe Technology OÜ

Privacy policy

Last updated 20 October 2026

This policy explains how Average Joe Technology OÜ (“we”) processes personal data when you use qrpl. qrpl is a product of Average Joe Technology. Creating an account also enters the processor terms in section 11.

1. Who we are

Average Joe Technology OÜ, registry code 17309776, VAT EE102895812, Narva mnt 5, 10117 Tallinn, Harju County, Estonia. Email: [email protected].

2. Scope

This policy covers qrpl.io, www.qrpl.io, the signed-in library, and dynamic-link redirects on qrpl.io and on a custom domain an organisation has attached. A destination site you redirect to is outside this policy.

3. Roles

We are the controller for accounts, contact-form messages, abuse reports, and sign-in security records. We decide why that data is processed.

The organisation is the controller of the links it creates: names, destinations, logos, and the scan statistics of people who open those links. We are the processor for that data. We store and serve it on the organisation’s instructions, which are these terms, the product, and section 11.

4. What we process

Account data, as controller:

• Name, email address, and a hash of the password.
• Organisation membership and role (owner or member).
• A sign-in session. The session row may include the IP address and user agent of the browser that signed in. The session cookie is described on the Cookies page.

Messages, as controller:

• Contact form: name, email, organisation, and message. We post a copy to an operator chat we run, so we can reply. We do not store an IP address with the message.
• Abuse report: the link slug, a short message, and the time. We do not store an IP address or user agent with the report.

Link data, as processor for the organisation:

• Link name, kind, slug, destination, and hostname.
• A logo image, if the organisation uploads one, used only on exports.
• A scan row when someone opens a dynamic link: time, country, and device class (mobile, tablet, desktop, or other). We read the IP address and user agent only long enough to derive the country and the device class. The scan row does not store the IP address or the user-agent string.

5. Lawful bases

• Contract, and steps before a contract — to create the account, run the links, answer a pricing enquiry, and perform a paid agreement.
• Legitimate interests — to keep accounts secure, rate-limit the contact form, and review abuse reports. The session IP and user agent exist for that security interest.
• Legal obligation — invoices and tax records where a paid agreement exists, including VAT EE102895812.

Scan statistics are processed on the organisation’s instructions. The organisation is responsible for its own lawful basis toward people who open its links.

6. How we use data

To run the library, serve redirects, draw exports, show scan counts to the organisation, export a CSV the owner requests, and reply to enquiries. We do not sell personal data. We do not use link content or scan statistics to train a public model. The marketing pages do not run third-party analytics.

7. Where the data sits

The application and the database run on a Kubernetes cluster in the European Union, hosted by Hetzner Online GmbH. Public traffic may pass through Cloudflare, Inc. for DNS and to absorb abusive traffic. Cloudflare may set a security cookie when that protection is on. We do not use Cloudflare for analytics.

The operator chat that receives a contact-form copy runs on the same infrastructure. A destination you configure may be outside the EU; that site receives the browser when we redirect, under its own terms.

8. Retention

• Accounts and link rows: until the organisation is deleted, or until an owner deletes a single link. Closing an organisation stops dynamic redirects after 30 days and does not by itself delete the rows.
• Scan rows: for the organisation’s scan-retention window, then deleted. Starter is 30 days. A paid agreement may set a different number of days.
• Sign-in sessions: until you sign out or the session expires (about seven days).
• Contact messages and abuse reports: until we have finished with them, or sooner if you ask us to delete a message that is about you.
• Invoices and tax records: as long as Estonian bookkeeping law requires.
• Database backups follow the cluster backup schedule and then age out. Deleting a row in the live database does not erase a backup that still holds it.

9. Your rights

Under the GDPR you may ask for access, rectification, erasure, restriction, or portability, and you may object to processing that is based on legitimate interests. Write to [email protected].

If you opened someone else’s qrpl link, ask that organisation first. They are the controller of that scan statistic. If the organisation is gone, write to us and we will help as the processor.

You may complain to the Estonian Data Protection Inspectorate (AKI): https://www.aki.ee/en.

10. Cookies

The public pages do not set a first-party cookie. After sign-in, the library sets one necessary session cookie. The inventory is on the Cookies page. There is no advertising cookie and no consent banner, because there is nothing optional to accept or reject.

11. Processor terms

This section is the Article 28 agreement between the organisation (controller) and Average Joe Technology OÜ (processor) for link content and scan statistics. Creating an account accepts it.

• Subject. Hosting names, destinations, logos, and scan statistics so the organisation can run its links and exports.
• Duration. For as long as the organisation uses qrpl, and afterwards until deletion or the retention windows in section 8.
• Nature. Storage, redirect, export, and deletion on the organisation’s instructions.
• Data. Section 4, link data. Data subjects are the people who open the organisation’s dynamic links, and anyone identifiable in a destination or a logo the organisation uploaded.
• Instructions. We process only as the product and these terms provide, or as EU or Estonian law requires. The organisation is responsible for a lawful basis toward people who open its links.
• Security. Transport is encrypted. Access to the library is limited to members of that organisation. Scan rows do not keep the raw IP address or user agent.
• Subprocessors. Section 7. If we add a subprocessor that handles link content or scan statistics, we will name it here. You may object by closing the organisation.
• Assistance. Owners can export links and delete a link in the product. We will help with a reasonable request from a supervisory authority.
• Breach. We will tell the organisation without undue delay after we become aware of a personal-data breach that affects its link data.
• Deletion. Deleting a link removes that link. Erasure of an account follows a written request, leaving backups to age out and tax records where the law requires them.
• Audits. On written request we will describe the security measures that are reasonable for this clause. We do not grant live access to production in a way that would expose another organisation.

12. Children

qrpl is not directed at children under 16. Do not create an account if you are under 16. If we learn we hold an account for a child under 16, we will delete it.

13. Changes

We will post updates on this page and change the date above. A material change to the processor terms will be posted here before it applies to new processing.

Company

Average Joe Technology OÜ, registry code 17309776, VAT EE102895812. Narva mnt 5, 10117 Tallinn, Harju County, Estonia. [email protected]. The company is entered in the Estonian e-Business Register.