Authorized Subprocessors

To deliver high-availability QR code generation, dynamic redirection, and secure subscription billing, QRnaly engages verified third-party subprocessors. Each vendor is vetted for technical and organizational security measures, data isolation, and contractual confidentiality.

Current Authorized Subprocessors

Razorpay Software Private Limited

Payment Gateway & Subscription Billing

Location: India

Purpose: Processes recurring subscriptions, add-on purchases, credit card tokenization, UPI transactions, and automated invoicing.

Data Handled: Customer email, workspace ID, billing details, and transaction amounts. QRnaly does not store raw card numbers or CVVs.

Vendor Privacy Policy

Neon Inc.

Managed Serverless PostgreSQL Database

Location: Global / Multi-Region Cloud

Purpose: High-availability relational data storage for workspace settings, QR records, salted scan telemetry, and credit ledgers.

Data Handled: Encrypted database records, configuration metadata, and salted telemetry hashes. Protected via SSL/TLS encryption in transit and AES-256 at rest.

Vendor Privacy Policy

Cloudflare, Inc. / Cloud Object Storage

DNS, Edge Routing & Encrypted Object Storage

Location: Global Anycast Edge

Purpose: Edge routing, SSL/TLS termination, bot filtering, and encrypted object storage for user-uploaded PDF documents and menu images.

Data Handled: Uploaded files (PDFs, images) and transient HTTP request metadata strictly for edge routing and rate limiting.

Vendor Privacy Policy

Hostinger Operations

SMTP Transactional Email Relay

Location: Secure SMTP Relay

Purpose: Dispatches password reset emails, account verification links, and billing transaction receipts.

Data Handled: Recipient email address, message body, and reset URL. Does not store account credentials.

Vendor Privacy Policy

Google LLC (Google Identity & GA4)

OAuth Authentication & Aggregated Web Analytics

Location: Global / USA

Purpose: Optional Google Single Sign-On and aggregated website visitor performance metrics under Google Consent Mode v2 with IP anonymization.

Data Handled: Verified email and profile name (for OAuth); aggregated page navigation events (for GA4). Zero scan telemetry shared.

Vendor Privacy Policy

Subprocessor Updates & Governance

QRnaly maintains strict oversight over all third-party technical providers. Prior to engaging any new subprocessor that handles customer or telemetry data, this directory is updated accordingly.

For subprocessor inquiries or DPA execution: privacy@qrnaly.com