Privacy Notice

This itemised notice explains what personal data MyQRx processes, why, and your rights under the Digital Personal Data Protection Act, 2023 (“DPDP”). SafeKT Technologies Private Limited is the Data Fiduciary.

1. What we collect

• Account data — name, email, hashed password, plan and billing identifiers.
• Content data — the destinations, slugs, and styling of the codes you create.
• Traceability logs — for each scan and sensitive action we log IP address, user-agent, coarse geo, device type and timestamps, for security, fraud prevention and legal traceability.
• Payment data — handled by Razorpay; we store only their tokens and invoice metadata, never your full card number.

2. Why we process it (purpose)

• To provide the service — generate codes, resolve redirects, and show analytics.
• To keep the platform safe — reputation scanning, abuse detection, and rate limiting.
• To bill you and issue GST-compliant invoices.
• To meet legal and intermediary obligations.

3. Consent

We ask for granular, purpose-specific consent and keep a versioned record of what you agreed to and when. You can review and change your choices anytime in your consent center or the cookie banner. One functional cookie, myqrx_touch, remembers for 90 days how you first reached us (the campaign, referral link or coupon code), so a referral is credited and a coupon still applies if you sign up later. Non-essential cookies are off by default. The only non-essential ones are Google Analytics cookies, set only after you choose “Accept all”; until then Google receives cookieless, anonymised measurement signals only.

4. Retention and purge

We keep personal data only as long as needed for the purpose or as law requires. Traceability logs have a defined retention window after which they are automatically purged. Financial records are retained for six years per tax law.

5. Your rights

Under DPDP you may request access to, correction of, or erasure of your personal data, and you may withdraw consent. To exercise these rights, contact our Grievance Officer (below). We respond within statutory timelines.

6. Sharing

We share data only with processors needed to run the service (for example Amazon Web Services for hosting, file storage and email, Razorpay for payments, Google reCAPTCHA to block automated abuse on sign-in and other public forms, Google Web Risk to check that short-link destinations are not malware or phishing (it receives only the destination URL), and Google Analytics where you have allowed it), under data-processing agreements. We do not sell personal data. We never place personal data in URLs.

7. Grievance Officer

For any privacy concern or to exercise your rights, contact our named Grievance Officer.