Privacy Policy

01Who we are

This Privacy Policy explains how Subash Matheswaran (“QR-10”, “we”, “us”) collects, uses, shares and protects personal data when you visit qr-10.com, create an account, buy a subscription or scan a QR code generated with QR-10.

For personal data of our account holders and website visitors, QR-10 is the data controller (or “data fiduciary” under India’s Digital Personal Data Protection Act, 2023). For scan data collected when people scan our customers’ QR codes, we act primarily as a processor on behalf of the customer who created the code — see section 4.

02Information we collect

Information you give us

• Account data: name, email address, password (stored only as a secure hash) and profile settings.
• Content: QR code names, destination URLs, folders, design settings and any logos or files you upload.
• Billing data: billing name, billing address, country, tax ID (if provided), plan and transaction history. Card or bank details are collected and stored directly by our payment processor, Dodo Payments; we only receive limited information such as card brand, last four digits and expiry date.
• Communications: messages you send through our contact form or by email, and your feedback.

Information collected automatically

• Usage and device data: IP address, browser type, operating system, pages viewed, referring URLs, and dates and times of access to our website and app.
• Cookies and similar technologies: see our Cookie Policy.
• Security logs: login attempts, IP addresses and actions taken in your account, used to detect fraud and abuse.

03How we use your information

We use personal data for the following purposes, relying on the legal bases shown:

Under India’s DPDP Act, we process your personal data on the basis of your consent given when you register or use the Service, or for legitimate uses permitted by law. We do not use your data for automated decision-making that produces legal or similarly significant effects on you.

04Data about people who scan QR codes

When someone scans a QR code created with QR-10, our redirect service briefly processes technical information to send them to the destination and to generate analytics for the code’s owner. This may include:

• date and time of the scan;
• IP address, used to derive approximate location (country, region, city) and to filter bots and abuse;
• device type, operating system, browser and language;
• the referring application, where available.

We use this data to perform the redirect, protect the Service, and provide aggregated statistics to the QR code owner. We do not use scan data to build advertising profiles and we do not sell it. The customer who created the QR code decides why and where the code is used and is responsible for informing people who scan it where required by law. If you scanned a code and have a privacy request, please contact the organisation that displayed it; we will assist them in responding.

Scan data is kept for as long as the QR code exists in its owner’s account. When the owner deletes a code, its scan history is permanently erased 30 days later (until then, support can restore it on request); when the owner deletes their account, all of its scan data is erased immediately.

05How we share information

We do not sell or rent personal data, and we do not share it for cross-context behavioural advertising. We share personal data only as follows:

All service providers act on our instructions, are bound by written data-processing terms and may not use your data for their own purposes.

06International transfers

QR-10 is operated from India, and our service providers may process data in other countries, including the United States and the European Union. Where we transfer personal data from the EEA, UK or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK Addendum). Transfers from India are made in accordance with the DPDP Act and any restrictions notified by the Government of India.

07How long we keep data

08Security

We use administrative, technical and physical safeguards appropriate to the risk, including encryption in transit (HTTPS/TLS), hashed passwords, access controls limited to staff who need them, and regular backups. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a personal data breach occurs that is likely to affect you, we will notify you and the relevant authorities as required by law (including the Data Protection Board of India and CERT-In where applicable).

09Your rights and choices

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate or incomplete data;
• delete your data (“right to erasure”);
• export your data in a portable format;
• object to or restrict certain processing, including direct marketing;
• withdraw consent at any time, without affecting processing already carried out;
• nominate another person to exercise your rights in the event of death or incapacity (India);
• lodge a complaint with your data protection authority.

California and other US states

Residents of California and other US states with privacy laws have the right to know, delete and correct personal information and to opt out of its “sale” or “sharing”. We do not sell or share personal information as those terms are defined, and we will not discriminate against you for exercising your rights.

How to exercise your rights

Many settings can be changed directly in your account, including deleting your account. Otherwise, email contact@qr-10.com. We will respond within 30 days (or sooner where required) and may need to verify your identity first.

10Grievance Officer (India)

In accordance with the Information Technology Act, 2000, the rules made under it, and the Digital Personal Data Protection Act, 2023, our Grievance Officer is:

We will acknowledge complaints within 24 hours and aim to resolve them within 15 days of receipt. If you are not satisfied, you may approach the Data Protection Board of India.

11Children

The Service is not directed to children and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.

12Changes to this policy

We may update this Privacy Policy from time to time. If changes are material, we will notify you by email or through the Service before they take effect. The “Last updated” date at the top shows the latest version.

13Contact us

Questions or requests about privacy can be sent to contact@qr-10.com or through our contact form. Postal address: Subash Matheswaran, 32, Ayyampalayam Paaraiyure, Komarapalayam, Namakkal District, Tamil Nadu 638183, India.