Privacy policy

This is a translation provided for convenience. Only the French version is legally binding.

1. Who is responsible for what

Two processing operations coexist in qzaco and they do not have the same controller. The distinction is not a formality: it determines to whom a request must be addressed in order to succeed.

  • Account data (registration, billing, use of the service): the publisher, CAP-REL, is the controller.
  • The content of a page: it is the owner of the sticker who decides what to write on it, including whether to include data concerning third parties, for example the name of a tradesperson or a telephone number. The publisher hosts this content on the owner's behalf and does not exploit it. A request relating to this content should therefore first be addressed to the owner of the sticker; the matter may be referred to the publisher under the conditions described in the legal notice.

Point of contact for any question relating to personal data: https://cap-rel.fr/contact/, or by post to CAP-REL, 204 Avenue du Verger, 83140 Six Fours les Plages.

2. Data collected

  • Account: last name, first name, email address, date on which this address was proven, role and activation balance. The password is never stored in plain text; only a hash of it is.
  • Billing: postal address, postcode, city and country, requested only once, at the first online payment. An activation using credit or a recharge code requires none of them.
  • Orders: reference, product, status, payment date, as well as the version of the terms and conditions of sale accepted and the date of that acceptance.
  • Pages: title, texts of the three levels, photographs, location category, maintenance due date and end date of the paid period. Level passwords are not stored in plain text either.
  • Views: only two values, held by the page: the number of scans and the date of the last one. No IP address, no browser identifier, no table of visits: we know how many times a sticker has been scanned, never by whom. The owner reading their own page, robots, link previews in messaging apps and reloads within thirty minutes are not counted.
  • Technical server logs, including the IP addresses needed for security: they are what make it possible to limit the number of password attempts, registrations and reset requests.
  • Requests to addresses that the site never serves (.php and .env files, administration pages of other software), sent by robots probing servers: the IP address, the date, the method, the path without its parameters, the targeted domain name and the user agent. An address that repeats them is temporarily blocked by the server's firewall.

3. What is not collected

  • Photograph metadata. Every photograph uploaded is re-encoded, and in the process loses all of its EXIF metadata, including GPS coordinates. A photo of the electrical panel therefore does not carry the address of the home. This is not a side effect: it is a guarantee, and an automated test checks it with every release.
  • No bank details, as payment is made outside the Service, on a separate payment page.
  • No audience measurement or advertising cookies. The only cookies set are the session cookie and the anti-CSRF token cookie, both necessary for the service to function.
  • No third-party resources. The pages load no font, script or image from an external service: your IP address is not disclosed to anyone merely because of your visit.

4. Purposes and legal bases

  • Performance of the contract (article 6.1.b of the GDPR, in French "RGPD"): opening the account, activating a sticker, keeping the page readable for the duration sold, issuing the invoice, sending expiry and maintenance reminders.
  • Legal obligation (article 6.1.c): retention of billing records.
  • Legitimate interest (article 6.1.f): the security of the service and the prevention of abuse, as well as the counting of scans, which is data about the labelled object and not about the person looking at it.

No decision producing legal effects is taken solely on the basis of automated processing, and no profiling is carried out.

5. Sticker pages are not indexed

Sticker pages carry a no-indexing instruction (noindex, nofollow): a sticker is made to be scanned on the spot, not to be found by searching for an address on a search engine. The title of a page is, however, sent to messaging apps that expand a link pasted into a conversation, never its text: what the owner writes is meant to be read on the spot, not to be cached by a third-party service.

6. Recipients

The data are neither sold, nor rented, nor transferred. They are processed by the publisher and, solely for the operations that require it, by:

  • the hosting providers named in the legal notice: storage and running of the service;
  • the publisher's billing channel: last name, first name, email address and billing address, for issuing the invoice;
  • the email sending server: address of the recipient and content of the message sent.

No data is transferred outside the European Union: the data are hosted and processed in France.

7. Retention periods

  • Page: for the period of 10 years, then archived as read-only. It is never deleted automatically at the expiry date, and this is the very commitment of the product: a sticker affixed to a wall must keep responding.
  • Account: for as long as it exists.
  • Orders: kept, as they are billing records.
  • Password reset tokens: purged every day once expired.
  • Browsing session: two hours of inactivity.
  • Unlocking of a protected level: thirty minutes, and the owner can close the level immediately. A password read out to a tradesperson therefore does not open the page for the whole day.
  • Archive of your data: 7 days. After this period the file is erased from our servers and the link stops working; the record of your request, however, is kept, because we must be able to prove that your rights have been honoured.
  • Technical logs: 90 days for the application log, eight weeks for the log of robot requests.

8. Your rights

In accordance with the GDPR, you have a right of access, rectification, erasure, portability, objection and restriction regarding your data, as well as the right to set directives concerning what happens to them after your death (article 85 de la loi Informatique et Libertés, the French Data Protection Act).

Access and portability are self-service: from your account, the "Request a copy of my data" button prepares an archive containing your pages and their three levels, your photographs, your orders and the origin of each of your activations. Your pages appear in it twice: in JSON, so that other software can import them, and as a web page, so that you can read them. A personal link is sent to you by email as soon as it is ready. The archive contains no password: neither your account password nor those of your protected levels are stored in plain text, and the hash that takes their place protects your data rather than describing it.

The content of your pages can be corrected and replaced directly from your account area, at any time. For other requests, write to the point of contact indicated in section 1. We respond within one month of receipt; this period may be extended by two months if the request is complex, in which case you are informed of this within the first month, together with the reason. Proof of identity is requested from you only if there is reasonable doubt about your identity.

Erasure is requested from your account, and it is examined by a person rather than carried out automatically: it distinguishes what can disappear from what cannot. Before you confirm anything, the screen shows you in figures what the request will mean for your account, and you receive the same details once the erasure has been carried out.

What disappears permanently:

  • your identity, your billing address and your password;
  • your stickers that are no longer within their paid period, those you never activated and those you had moved to the trash, together with their photographs;
  • the data archives you had requested, which contain a copy of them.

What is kept, and why:

  • your stickers still within their paid period, until their expiry date. This is what was sold to you: a sticker affixed to a cabinet must keep responding to whoever scans it, including a third party who has asked for nothing. They no longer bear your name.
  • your orders: these are billing records that the law requires to be kept. The account that holds them is emptied of everything that identifies you; only a number remains.

A consequence to be aware of before making a request: activations purchased and not used are lost with the account. Their number is shown to you on the screen, before confirmation.

9. Security

Communications are encrypted (HTTPS). Both account passwords and level passwords are stored only in hashed form. Photographs are not served from a guessable public path but by a controller that checks, for each image, that the level to which it belongs is indeed open. Login attempts, registrations, reset requests and level password attempts are counted and limited.

10. Complaints

If you consider that the processing of your data infringes the GDPR, you may lodge a complaint with the CNIL (the French data protection authority), without prejudice to any judicial remedy: www.cnil.fr, or by post to 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.