What Happens to Your Product Data If Your QR Vendor Shuts Down?
Key Takeaways
- You own your Tier 1 data — BrandedMark is a GDPR data processor, not owner. Your product data belongs to you, period.
- Export anytime, no exit fees — Full data portability in JSON, CSV, and GS1 XML. Leave whenever you want.
- Open standards protect you — FIDO2 passkeys and GS1 Digital Links mean your product identity is built on standards that outlast any single vendor.
The Vendor Risk Nobody Talks About
QR code and product registration platforms fail. Not in theory — in practice.
Real Examples of Platform Disruption
EVRYTHNG (acquired by Digimarc, January 2022). EVRYTHNG was the leading "Product Cloud" platform — connected billions of products via QR and NFC for brands including Avery Dennison and Mowi. When Digimarc acquired EVRYTHNG for stock, every manufacturer using the platform faced a forced migration. Product URLs changed. APIs changed. The team that built the original integrations was absorbed into a different company with different priorities. Brands that had encoded EVRYTHNG URLs into physical packaging discovered those URLs now resolved to a different platform — or didn't resolve at all.
Tappr (SSL certificate expired, April 2026). Tappr, a UK-based connected product platform used by cycling and eBike brands, let its SSL certificate expire in early 2026. Every QR code pointing to a Tappr-hosted product experience suddenly showed a browser security warning instead of the product page. Customers scanning codes on products they'd just bought saw "Your connection is not private." The issue persisted for weeks. For a manufacturer relying on Tappr for warranty registration, this meant weeks of dead QR codes on products already in customers' hands.
Scantrust (acquired by Trust Codes Global, 2025). Scantrust, a Swiss serialisation and authentication platform, was acquired by New Zealand-based Trust Codes Global. The combined entity rebranded and restructured its product lines. Manufacturers using Scantrust's original API and dashboard faced an integration migration — a process that required engineering resources and created a gap in service continuity.
These aren't edge cases. They're the normal lifecycle of venture-funded technology companies.
The Five-Year Failure Scenario
Here's how this plays out for a manufacturer:
Year 1: You launch 50,000 products with QR codes linking to your vendor's platform. Customers scan, register, access manuals.
Year 3: The vendor pivots, gets acquired, or loses funding. Your account manager leaves. API documentation goes stale.
Year 5: The platform shuts down or merges. Your QR codes — physically printed on products still in customers' homes — now link to 404 pages. Five years of warranty registrations, customer data, and service history sit in a database you can't access.
The product is still alive. Your customer still owns it. But the digital experience you built around it is gone.
Guarantee 1: You Own Your Data
Under GDPR and modern data privacy law, there's a crucial distinction: data controller (you, the manufacturer) and data processor (the platform handling your data).
Most QR vendors blur this line. They hold your product data, your customer relationships, your service history. You're renting access. If they go under, your data goes with them.
The BrandedMark Data Model
BrandedMark inverts this:
- You are the controller. Your product data — serial numbers, ownership records, warranty states, service history — belongs to you.
- We are the processor. We store, index, and deliver access to your data on your behalf.
- This is contractual, not aspirational. Your Data Processing Agreement (DPA) explicitly names you as controller and BrandedMark as processor. You have legal recourse under GDPR Article 28 if we fail to comply.
What does this mean in practice? If BrandedMark is acquired tomorrow, the acquirer inherits the processor obligation. They can't repurpose your data, sell it, or deny you access. Your legal rights survive any corporate event.
For a deeper dive into structuring your data ownership, see our product data strategy guide and why your product data is your most undervalued asset. Understanding connected product customer lifetime value shows why controlling this data is a revenue question, not just a compliance one.
Guarantee 2: Export Anytime, No Exit Fees
Data portability isn't optional. It's a legal requirement under GDPR (Article 20), the California Consumer Privacy Act, and a growing number of data sovereignty frameworks worldwide.
BrandedMark provides full export in three standard formats:
What the Export Contains
JSON export — Every product record, every ownership event, every warranty state, every service log entry. Fully structured with relationships preserved. Typical fields: product_id, serial_number, owner_id, warranty_start, warranty_end, service_events[], ownership_transfers[], registered_at, last_scan. Machine-readable, ready for import into any modern system.
CSV export — Flat tabular export for spreadsheets, legacy systems, and manual review. One row per product, columns for all core fields. Usable in Excel, Google Sheets, or any database import tool.
GS1 XML export — Industry-standard format for interoperability with supply chain platforms, DPP registries, and regulatory reporting systems. If you're subject to EU Digital Product Passport requirements, this export is already formatted for registry submission.
What Migration Actually Looks Like
A typical migration from BrandedMark to another platform takes hours, not weeks:
- Export: Download your complete dataset via the dashboard (one click) or API call
- Map: Match BrandedMark fields to your new platform's schema (most fields are GS1-standard and map directly)
- Import: Load into the new system
- Redirect: Update your QR code base URLs (BrandedMark supports URL forwarding during transition)
No fees. No waiting periods. No "exit tax." You can read the full migration guide. This portability also matters for certified pre-owned resale programs, where product history travels with the product across owners.
Guarantee 3: Open Standards Protect Your Product Identity
BrandedMark is built on open standards, not proprietary protocols. This is a deliberate architectural decision that protects you from vendor lock-in at every layer.
FIDO2 Passkeys
When a customer registers a product with BrandedMark, they can create a FIDO2 passkey that cryptographically proves ownership. The private key lives on the customer's device — not on our servers. This phishing-resistant approach to product ownership identity is essential for manufacturers managing high-value or frequently resold products.
Important nuance: FIDO2 credentials are domain-scoped, meaning a passkey created on brandedmark.com won't automatically authenticate on a different domain. However, BrandedMark stores the public key and credential metadata as part of your exportable data. If you migrate to a new platform, you can export these records and prompt customers for a lightweight re-enrolment — typically a single biometric confirmation — rather than starting from scratch. The ownership chain, product history, and entitlements transfer completely; only the authentication binding needs a one-time refresh.
GS1 Digital Links
Every QR code BrandedMark generates follows the GS1 Digital Link standard. This means your product identifiers (GTINs, serial numbers) are encoded in a format that any GS1-compliant system can read. You're not locked into BrandedMark's URL structure — the underlying product identity is portable by design.
What This Means in Practice
If you leave BrandedMark, you take with you:
- Every product record and its full history
- Every ownership chain and transfer event
- Every warranty state and service log
- FIDO2 credential records for re-enrolment
- GS1-formatted identifiers that work with any compliant platform
Your product identity is yours. We host it, but we don't own it.
What "Data Durability" Actually Means
The term gets used loosely across the industry. Here's what we specifically guarantee:
Four Pillars
Retention: Your data stays available as long as you're a customer. No auto-deletion, no data decay. Multi-region redundancy with automated backups.
Portability: Full export in standard formats at any time. No approval gates, no fees, no artificial delays.
Sovereignty: You remain the legal controller. We process on your behalf. Your DPA makes this enforceable.
Survivability: Even if BrandedMark ceases to exist, the open standards we build on (FIDO2, GS1, GDPR) ensure your data has a path forward. No proprietary format traps you. This matters especially as digital product passport requirements become mandatory across more sectors, and 70% of products never get registered — making the ownership records you do capture irreplaceable.
Frequently Asked Questions
What if BrandedMark gets acquired?
Your data ownership and portability commitments are contractual — they survive any corporate event. An acquirer inherits processor obligations. If they want to change terms, you receive notice and retain the right to export and leave.
How long does a data export take?
For most manufacturers (under 100,000 products), the dashboard export completes in under 60 seconds. API-based exports for larger datasets run asynchronously and deliver a download link via email.
What format should I use for my export?
JSON if you're migrating to another product platform. CSV if you need to review data in a spreadsheet or import into a CRM. GS1 XML if you're feeding into a DPP registry or supply chain system.
Can you sell or repurpose my customer data?
No. You own it; we process it. We cannot repurpose, monetise, or share it without your explicit written permission. This is both a GDPR obligation and a core contractual commitment.
What about product QR codes already printed on packaging?
BrandedMark supports URL forwarding during migration. Your existing QR codes can be redirected to a new platform's URLs without reprinting any packaging. This transition is included at no additional cost.
Built to Outlast Us
The best infrastructure is invisible. It works when things go right, and it protects you when things go wrong. That's what data durability means — not a marketing promise, but a contractual, architectural, and legal commitment that your product data survives anything.
Your product data should outlive any single platform. It should be yours, portable, and built on standards that don't depend on any one company staying in business.
Review our Data Processing Agreement or book a walkthrough to see exactly how your data is structured, exported, and protected.