QRVault Privacy Policy

1. Data controller

• Controller: CraftingBits (Aïda Díaz Giménez)
• Tax ID: 77632530D
• Address: Plaza Maruja Mallo, Pontevedra, Spain
• Contact: legal@craftingbits.es

2. Local storage

All the codes you scan, your history and your folder structure are stored 100% locally on your device. We do not transmit, synchronise or have remote access to this content. We keep no copy on our servers.

3. Camera access

The app asks for camera access on your device for the sole purpose of scanning QR or barcode codes when you choose to. The camera image:

• Is processed entirely on your device (on-device).
• Is not stored, sent to our servers or shared with third parties.
• Is not used for any purpose other than reading the code shown on screen.

You can revoke this permission at any time from your device settings (Settings > Apps > QRVault > Permissions). If you revoke it, scanning will stop working, but the rest of the app will continue to function normally.

4. Advertising and third-party services (Google AdMob)

We use Google AdMob to show ads inside the app. To do so, Google may collect and use device identifiers (such as the advertising ID / AdID) and other technical data to personalise ads, measure performance and prevent fraud. This collection happens automatically through Google's advertising SDK (AdMob) when the app shows ads.

• Legal basis: for personalised ads and the use of local storage for advertising purposes, the legal basis is your consent, collected through the consent form (CMP) shown when you open the app if you are in the European Economic Area (EEA), the United Kingdom or Switzerland.
• Withdrawing consent: you can withdraw or change your ad consent at any time from Settings > Privacy / Privacy options inside the app, which will reopen the consent management form.
• Non-personalised ads: if you do not grant or withdraw your consent, you will still see ads, but they will not be personalised to your activity.
• International transfers: Google may transfer this data outside the EEA. These transfers are covered by the European Commission's Standard Contractual Clauses (SCCs) and Google's other safeguards. You can find more information in Google's privacy policy and its partner policy.

This processing is also governed by Google's privacy policy.

5. Children

The app is not specifically directed at children and we do not deliberately collect data from children. If we detect that a user is a child, personalised ads will not be shown, in line with Google's policies for apps with mixed or child audiences.

In the United States we also comply with the federal COPPA (Children's Online Privacy Protection Act): we do not knowingly collect personal data from children under 13 and, in line with Google's audience signals, these users do not receive personalised ads.

The minimum age to use the app is 16 years old, as detailed in our Terms and Conditions. In accordance with Article 8 of the GDPR, where the applicable digital consent age in your country is lower, the consent of your parent or legal guardian will be required.

6. Your rights

Under the GDPR and LOPDGDD, you have the right to:

• Access your personal data.
• Rectify inaccurate data.
• Erase your data.
• Object to the processing.
• Restrict processing in certain cases.
• Data portability, where applicable.
• Withdraw your consent at any time (without affecting the lawfulness of prior processing), particularly regarding personalised ads, from the consent management button inside the app.

Since the content you create in the app (codes, notes, folders) is exclusively local, you can exercise these rights over that content directly by deleting your history or clearing the app's data from your device settings, or by uninstalling the app.

For any other request related to data processed by AdMob or other purposes, contact us at legal@craftingbits.es.

You also have the right to lodge a complaint with the Agencia Española de Protección de Datos (AEPD) at www.aepd.es, or with the data protection authority of your country of residence (e.g. the CNIL in France, the BfDI in Germany or the Garante in Italy).

If you reside in the United Kingdom, you can lodge a complaint with the UK supervisory authority, the Information Commissioner's Office (ICO) — ico.org.uk — instead of the AEPD.

7. California / United States residents (CCPA/CPRA)

If you reside in California, the California Consumer Privacy Act (CCPA/CPRA) may give you additional rights over your personal data. Because we share certain identifiers with Google AdMob for advertising purposes, this may be considered "sharing" under the CCPA/CPRA.

• Right to know which categories of personal data we collect and with whom we share them.
• Right to delete your personal data.
• Right to correct inaccurate data.
• Right to opt out of the sale or sharing ("Do Not Sell or Share My Personal Information"), which you can exercise from Settings > Privacy / Privacy options inside the app.
• Non-discrimination for exercising any of these rights.

We honour the Global Privacy Control (GPC) signal when available on your device or browser, treating it as an automatic opt-out request. Google's consent form (UMP) includes messages specific to US state regulations, which handle much of these requirements automatically.

8. Users in Brazil (LGPD)

If you reside in Brazil, this policy is also governed by the Brazilian General Data Protection Law (LGPD). The legal basis for processing data for advertising purposes is consent, which you can withdraw at any time from the app's privacy settings.

For any questions about the processing of your personal data under the LGPD, you can contact our Data Protection Officer (Encarregado de Proteção de Dados) at legal@craftingbits.es.

You may also lodge a complaint with the Brazilian National Data Protection Authority (ANPD) — www.gov.br/anpd —.

International transfers: international transfers of data to Google are governed by the same safeguards described in section 4.

9. Data retention and deletion

As we do not store your content (codes, notes, folders) on our servers, we do not set a retention period on our side: that content stays on your device until you delete it or uninstall the app. Identifiers processed through AdMob are kept according to Google's retention periods.

Deletion of your data: since all your data is stored locally, you can delete it at any time by clearing the app's data or history from your device settings, or by uninstalling the app. We do not store data on servers, so there is no data for us to delete.

10. Changes to this policy

We may update this policy occasionally. Any change will be reflected by updating the "Last updated" date at the top of this document. If the change is substantial (for example, if it affects the data we process or its purpose), we will notify you via an in-app notice before it takes effect.

11. Contact

For any questions about this policy or about how we handle your data, write to us at legal@craftingbits.es.