Privacy Policy

1. Data we collect

We collect only what we need to run the service:

• Account data: your name, email, and a securely hashed password. Passwords are never stored in plain text.
• Content you create: your QR codes, their destinations, and anything you upload for hosted pages.
• Scan analytics: for each scan we record a hashed IP (never the raw IP), approximate location such as country and region, device and browser type, referrer, language, and any UTM parameters.
• Billing data: your plan and payment status. Card and UPI details are handled by Razorpay; we do not see or store your full card data.
• Support messages you send us.

2. How we use data

We use your data to:

• provide, maintain, and secure the service,
• show you scan analytics for your own codes,
• process payments and manage your subscription,
• send transactional messages such as verification and account notices,
• detect, prevent, and investigate abuse.

3. Cookies

We use a secure, httpOnly session cookie to keep you signed in and a readable cookie for security (CSRF protection). We do not put session tokens or personal data in local storage. We may store non-sensitive interface preferences on your device.

4. Who we share data with

We do not sell your data. We share it only with processors that help us run the service:

• Razorpay for payments,
• our email provider for transactional email,
• a geolocation provider to turn a hashed IP into an approximate location,
• infrastructure and object-storage providers that host the service.

5. Data retention

We keep account and content data while your account is active. Scan analytics are retained according to your plan. If a paid plan lapses we keep your data and pause codes beyond the free limit rather than deleting them, so you can restore them by re-subscribing.

6. How we protect data

We hash passwords with argon2id, encrypt data in transit and at rest, isolate each account at the database level with row-level security, hash IP addresses used for analytics, and restrict and audit access. No system is perfectly secure, but we follow the baseline in our security policy.

7. Your rights

Subject to applicable law, including India DPDP, you can request access to your data, correction of inaccurate data, and erasure of your data. You can also withdraw consent for optional processing.

A self-service account-deletion and data-export flow is being built. Until it ships, you can exercise these rights by writing to support@getqrcode.live and we will action your request. Account deletion removes or anonymizes your personal data, keeping only what we must retain by law.

8. Children

The service is not intended for children. We do not knowingly collect data from children, consistent with DPDP requirements.

9. Grievance contact

For privacy questions or to exercise your rights, contact our grievance point of contact at support@getqrcode.live. We will respond within the timelines required by applicable law.

10. Changes to this policy

We will post updates here with a new date and, for material changes, notify you through the service.