Privacy Policy
Last Updated: September 16, 2026 • Binding across all global website visitors, account holders, and workspace members
1. Service Operator & Scope
This Privacy Policy explains how QRnaly (qrnaly.com) ("QRnaly", "we", "us", or "our"), operated by QRnaly Technologies as a digital software-as-a-service (SaaS) platform for QR-code creation, dynamic routing, campaign asset hosting, and scan telemetry, collects, processes, stores, and safeguards information.
Entity Notice: QRnaly is operated by QRnaly Technologies, a sole proprietorship business owned and operated by Yogesh Chhedalal Chaurasia, registered under Udyam (UDYAM-MH-33-0829050), based in Kalyan, Maharashtra, 421301, India. For full statutory disclosures, see our Business & Merchant Information.
2. Categories of Information We Process
Depending on how you interact with our platform (as an anonymous static QR creator, registered account holder, workspace collaborator, API developer, or end-user scanning a dynamic QR code), we process the following categories of data:
Full name, email address, cryptographically hashed passwords (using scrypt with individual 16-byte random salts; plaintext passwords are never stored), account role, subscription tier, and account creation timestamps.
When signing in with Google, we receive your verified Google email address, Google account ID, and display name. We do not access your Google contacts, Google Drive, or any additional private Google account data.
Workspace titles, member invitations, role permissions, custom folder hierarchies, and SHA-256 hashes of developer REST API keys (the raw secret is shown only once upon generation and never stored).
QR titles, visual styling configurations (colors, corner styles, embedded logo URLs), dynamic shortlink slugs (e.g. /q/[slug]), destination URLs, redirect history, and validation logs.
PDF documents (brochures, restaurant menus, catalogs), image files, and social profile card links uploaded by users. Uploads undergo automated magic-byte validation and malware scanning before being stored in isolated cloud object storage.
When an end-user scans a dynamic QR code, our redirect routing engine processes the HTTP request to record aggregate metrics: timestamp, device category (mobile/desktop/tablet), operating system, browser engine, referring domain, and approximate city/country derived from IP. Raw IP addresses are immediately salted and hashed before persistence, and discarded. We do not track or profile individual scanners.
Subscription status, plan tier, billing cycle, transaction IDs, and invoice records. Payment security / PCI scope: QRnaly does not store customers' full card credentials such as card number, CVV or expiry date. Payment card data is handled by the payment service provider. QRnaly will follow the PCI DSS validation requirements specified by its payment provider/acquirer for the selected integration.
Information submitted via our Abuse Reporting form (/report-abuse) or Grievance email, including reporter name, email, target URL, violation category, and evidence attachments.
3. Purposes and Legal Grounds for Processing
We process information strictly for legitimate product, operational, and security purposes:
- Core Service Delivery: Generating static QR codes, resolving dynamic shortlink redirects, rendering mobile landing pages, and serving hosted PDFs/images.
- Analytics Reporting: Providing workspace owners with aggregate scan counts, temporal distribution, geographic breakdowns, and device analytics.
- Account Security & Fraud Defense: Preventing brute-force attacks, authenticating sessions via secure cookies, verifying password reset tokens (15-minute validity), and enforcing rate limits.
- Malicious Content Filtering: Scanning target URLs and hosted files against phishing blacklists and malware registries.
- Billing & Entitlement Management: Processing subscription renewals, add-on purchases, credit ledger management, and GST-compliant invoicing.
- Statutory Compliance: Responding to lawful requests from law enforcement agencies or cybercrime authorities under applicable law.
4. Authorized Subprocessors & Infrastructure Providers
We share data with third-party service providers solely to the extent necessary to deliver the application. We do not sell, rent, or trade your data to advertisers or data brokers:
| Provider | Role / Capability | Location |
|---|---|---|
| Neon Inc. | Managed Serverless PostgreSQL Database | AWS Asia-Pacific / Global Cloud |
| Authorized Payment Service Provider | Payment Processing Service (Cards, Net Banking, UPI) | India / Global |
| Cloudflare Inc. / S3 Storage | Encrypted Cloud Object Storage (PDFs/Images) & Edge CDN | Global Edge Network |
| Hostinger Operations | SMTP Transactional Email Delivery (Password resets, receipts) | Secure SMTP Relay |
| Google LLC | OAuth 2.0 User Authentication (Optional Sign-In) | Global Identity Infrastructure |
5. India DPDP Act Alignment & Data Principal Rights
In alignment with the Digital Personal Data Protection (DPDP) Act, 2023 and the phased implementation of the DPDP Rules, 2025, QRnaly respects the statutory rights of Data Principals:
- Right to Information & Access: You may request a summary of personal data processed by QRnaly and export your campaign analytics in standard CSV format.
- Right to Correction & Erasure: You may update profile information directly in your Workspace Settings or request account closure and data deletion.
- Right to Grievance Redressal: You have the right to register grievances regarding personal data processing with our designated Grievance Officer (Grievance Redressal Page).
- Right to Nominate: In the event of death or incapacity, a Data Principal may nominate another individual to exercise these rights in accordance with applicable rules.
6. Data Retention & Subscription Lifecycle
We retain account data, workspace records, and active Dynamic QR codes as long as your account remains in good standing.
When a paid subscription expires or is canceled, previously published Dynamic QR codes continue routing during a 30-day active grace period. After 30 days, routing is suspended, while QR campaign configurations, scan telemetry, and hosted documents are safely retained for 90 days in a suspended state, allowing immediate reactivation upon plan renewal before scheduled deletion.
Unused password reset tokens expire after exactly 15 minutes. Closed accounts are purged within 30 days, subject to legal and financial retention requirements.
7. Technical & Organizational Security Safeguards
We employ robust technical controls including TLS 1.3 encryption in transit, AES-256 database encryption at rest, secure HTTP-only cookie headers with SameSite restrictions, salted IP cryptographic hashing for scan telemetry, and strict authorization guardrails to prevent Broken Object-Level Authorization (BOLA).
8. Children's Privacy
QRnaly is a commercial productivity and marketing utility intended for individuals who are at least 18 years of age. We do not knowingly collect personal data from minors.
9. Privacy Contacts & Notices
For privacy inquiries, data requests, or statutory notices, please contact:
Privacy Team: privacy@qrnaly.com • Trust & Safety / Abuse: abuse@qrnaly.com • Grievance Officer: Grievance Redressal