Privacy Policy

01Controller & contact

The controller responsible for processing personal data on this website is the operator of IWQR (iwqr.org).

For any privacy request, write to support [at] iwqr [dot] org or use the contact page. Please do not send passwords or SFTP credentials.

02Data we process

Account data: name, email address, mobile number (needed for card payments), password (stored only as a one-way hash), email verification status and, if you sign in with Google or GitHub, the account identifier, access token and profile picture provided by that service.

Billing data: billing address (street, postal code, city, region, country), orders, plans, prices, wallet balance and transactions, and payment status. Card payments are processed by our payment partner YekPay: for a top-up we send your name, email address, mobile number, billing address, the amount and an order number; you enter your card details only on the YekPay page. We receive the payment result, a reference number and the amount, never your card details.

Service data: service and order identifiers, SFTP username and password, image-processing settings, storage usage and download traffic counters, and the history of jobs run for your service.

Content: the images and files you upload. They are stored on our storage servers and delivered to visitors of your websites. Visitors' requests to delivery addresses are processed to serve the images.

Support data: messages you send through the contact form, support tickets, attachments and bug reports.

Technical and security data: IP address, browser user agent, request times, login and rate-limit counters, captcha and spam-trap (honeypot) results, blocked-request records and system logs.

WordPress connector: when you use our plugin, your WordPress site sends us the selected image files, their upload paths, your service token and SFTP password. Settings stored by the plugin remain in your own WordPress database.

03Purposes & legal bases

To create and manage your account, provide the ordered services, process payments and respond to support requests (Art. 6(1)(b) GDPR, performance of a contract).

To keep records required by commercial and tax law (Art. 6(1)(c) GDPR, legal obligation).

To protect the website, our servers and other customers against abuse, fraud and attacks, and to analyse faults (Art. 6(1)(f) GDPR, legitimate interest in secure and stable operation).

Where we ask for your consent, the processing is based on that consent (Art. 6(1)(a) GDPR); you can withdraw it at any time with effect for the future.

04Recipients & service providers

Hosting: the website and our storage and delivery servers are run on servers we operate or rent from hosting providers.

Cloudflare: this website and the Cloudflare delivery addresses are routed through Cloudflare, Inc., which processes connection data (such as IP addresses) to deliver content and protect against attacks.

YekPay: processes card payments for wallet top-ups and receives the data needed for the payment (see above).

Google and GitHub: only if you choose to sign in with them.

Email delivery: our email provider transmits verification emails, notifications and replies.

We disclose data to authorities only where we are legally required to do so. We do not sell personal data.

05International transfers

Some providers (for example Cloudflare, YekPay, Google and GitHub) may process data outside the European Economic Area. Where required, transfers are based on an adequacy decision (such as the EU-U.S. Data Privacy Framework) or on standard contractual clauses.

06How long we keep data

Account and service data are kept while your account exists and deleted or anonymised after it is closed, unless longer storage is legally required.

Order, payment and invoice records are kept for the statutory retention periods under commercial and tax law (up to 10 years).

Uploaded files are removed from our storage servers when the service is terminated; copies in browser or third-party caches may remain for a short time.

Security logs and rate-limit counters are kept only as long as needed for protection and fault analysis. Contact and support messages are kept as long as needed to handle the request and any follow-up.

07Cookies & local storage

We use only strictly necessary cookies: a session cookie that keeps you signed in and stores your language choice, and a security token that protects forms against forged requests. The session cookie expires after 180 days of inactivity or when you log out.

Your choice of light or dark appearance, sounds and closed notes is stored in your browser's local storage and never sent to us. We do not use advertising, third-party analytics or social-media tracking.

Visits through campaign links (utm_*) are counted without a cookie or IP address and linked to your account after sign-in (Art. 6(1)(f) GDPR); you can switch this off in the cookie settings. Every item, its purpose and lifetime is listed in our Cookie Policy.

08Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability, and the right to object to processing based on legitimate interests (Art. 15–21 GDPR).

You can update your name, email address and billing address in your profile at any time. For other requests, contact us at support [at] iwqr [dot] org.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work.

09Security

Connections are encrypted with TLS. Passwords are stored as hashes, server credentials and service tokens are encrypted, and access to administrative functions is restricted. No method of transmission or storage is completely secure, but we work to protect your data with appropriate technical and organisational measures.

10Children

Our services are intended for businesses and adults. We do not knowingly collect data from children under 16.

11Changes to this policy

We update this policy when our services or the law change. The date above shows the latest version. Significant changes are announced on this website or by email.