Privacy Policy

1. Responsible Party

e9li GmbH
Rehetobelstrasse 39a
9000 St. Gallen
Switzerland
Email: privacy@qrbill.dev

2. Scope

This privacy policy applies to the website qrbill.dev and the associated API service api.qrbill.dev (hereinafter "Service"). It informs about the nature, scope, and purpose of collecting and using personal data in accordance with the Swiss Federal Act on Data Protection (FADP/nDSG).

3. Data Collected

3.1 Account Data

During registration we collect:

• Email address (required)
• First name, last name, phone number (required)
• Address (required for paid subscriptions)
• Password (stored as a secure hash)
• Language preference

3.2 Usage Data

When using the service we collect:

• API call counter (count per day, no content)
• API key metadata (name, creation date, last used)
• Login timestamps

3.3 Payment Data

Payment data (credit card numbers, etc.) is processed exclusively by our payment provider Stripe, Inc. and is not stored on our servers. We only store the Stripe customer and subscription ID.

3.4 QR Bill Data

Invoice data submitted via the API is processed solely for bill generation and is not stored. After generation, creditor/debtor data, IBANs, references, and messages are discarded. We retain only operational metadata such as format, amount, currency, reference type, status, request ID, and response time for abuse prevention, support, and quota accounting.

4. Purpose of Data Processing

• Provision and operation of the service
• Account management and authentication
• Billing and invoicing via Stripe
• Usage monitoring and quota calculation
• Sending transactional emails (account confirmation, password reset, quota warnings)
• Technical support

5. Data Sharing with Third Parties

We only share personal data with the following third parties:

• Stripe, Inc. — Payment processing (USA, with appropriate data protection guarantees)

No data is shared with other third parties unless we are legally obligated to do so.

6. Data Storage and Deletion

Your data is stored on servers in Switzerland. Upon account deletion, your personal data will be anonymized within 30 days. Aggregated usage statistics (without personal reference) are retained for operational purposes.

7. Your Rights

Under the Swiss Data Protection Act (nDSG) you have the following rights:

• Right of access — You can request information about your stored data
• Right to rectification — You can request correction of inaccurate data
• Right to deletion — You can request deletion of your data
• Data portability — You can receive your data in a common format

To exercise your rights, contact us at privacy@qrbill.dev .

8. Cookies

We only use technically necessary cookies for session management and authentication. No tracking or advertising cookies are used.

9. Changes

We reserve the right to change this privacy policy at any time. The current version is always available on this page.