Data subject rights (DSR) procedure

QR Branding API — GDPR Art. 15-22

---

1. Recognized rights

---

2. Special context: a stateless service

QR Branding runs as a stateless service with no database. This has important implications for DSRs:

Data that does NOT exist to retrieve or delete:

• QR content (URLs, text, vCards, WiFi) → processed in memory, discarded after the response
• AI prompts → processed in memory, discarded after the response (the prompt cache keeps only the generated design, for up to 30 days, under a key derived from a SHA-256 hash of the prompt)
• Generated QR images → returned to the user, not stored
• Uploaded logos and images → processed in memory, discarded

Data that MAY exist:

• Application Insights (90 days): request paths, timings, errors, performance metrics
• Rate limit counters (2 minutes): anonymized RapidAPI identifiers, anonymized IP addresses
• Data held by LLM providers: design prompts, under each provider's retention policy

---

3. Handling procedure

3.1 Receiving the request

3.2 Identity verification

To prevent third parties from accessing someone else's data:

1. Ask the data subject to identify their RapidAPI user or subscription ID.
2. Where applicable, ask for a verification API call from their RapidAPI account to confirm ownership.
3. Do not ask for excessive documentation: verification must be proportionate.

3.3 Replies by type of right

Right of access (Art. 15)

Standard reply:

Dear [name],

With regard to your access request under Art. 15 GDPR, we inform you as follows:

QR Branding is a stateless service that does not store personal data beyond the immediate processing of each API request. We do not keep a user database, a request history or any generated QR content.

The only data that may exist temporarily is:

1. Telemetry in Application Insights (90 days): metadata about your API requests (paths, response times, HTTP status codes). This data contains no QR content and no identifiable personal data, since IP addresses are anonymized before logging.

2. Data held by LLM providers (if you used the AI feature): if you used AI generation on qr-branding.com or the managed endpoint, your design prompts were processed by our LLM providers (Groq, Google or OpenAI) acting as our processors, without any identifier of you. If you used the BYOK endpoint with your own key, the design prompts you sent may be retained under the policy of the provider you selected; we recommend contacting that provider directly to exercise your rights.

If you would like us to extract any telemetry data associated with your RapidAPI identifier, we will be glad to do so.

Right to erasure (Art. 17)

Standard reply:

With regard to your erasure request:

• QR content and generated images are never stored and are discarded immediately after each API response.
• Rate limiting counters associated with your identifier expire automatically after 2 minutes.
• If you would like us to delete any telemetry data in Application Insights associated with your identifier, we will do so and confirm once it is done.
• For data retained by the LLM provider you used with your own key (BYOK endpoint), we provide each provider's privacy contacts so you can exercise your rights directly.

Right to object (Art. 21)

For processing based on legitimate interest (rate limiting, telemetry):

1. Assess whether there are compelling legitimate grounds that override the requester's interests.
2. Rate limiting: the legitimate interest (service availability) generally prevails, but the assessment must be documented.
3. Telemetry: assess case by case. Where appropriate, configure an exclusion in Application Insights.

Right to data portability (Art. 20)

Standard reply:

QR Branding does not store structured personal data. There is no data we can export in a portable format. All processed information is discarded immediately after each API request.

---

4. Deadlines

---

5. Exceptions and refusal

A request may be refused if:

If a request is refused:

1. Inform the requester of the reasons.
2. Inform them of their right to lodge a complaint with the supervisory authority.
3. Document the refusal and its reasons.

---

6. Request log

Every DSR request must be logged:

---

7. Data held by LLM providers

7.1 QR Branding's own accounts (site and managed endpoint)

For AI generation on qr-branding.com and on the managed endpoint (POST /api/qr/ai/generate-managed), Groq, Google (Gemini) and OpenAI act as QR Branding's processors (see the subprocessors page). Requests concerning this data are handled by QR Branding as controller, following the procedure in this document. Only the design prompt and the generation parameters are sent to the provider, without the user's email, IP address or any other identifier.

7.2 BYOK endpoint

On the endpoint POST /api/qr/ai/generate, the customer supplies their own LLM provider API key (BYOK, Bring Your Own Key). Therefore:

• For these requests, QR Branding has no contractual relationship with the LLM provider.
• If a user requests access to, or erasure of, data processed by an LLM provider, they must contact the provider directly, with whom they hold their own account.
• QR Branding can give the user each provider's privacy contacts:

For xAI, DeepSeek and Qwen, also supported on the BYOK endpoint, the user should use the privacy contact published by the provider.

---

Document generated on 2026-03-08.