Privacy policy

• Account: name, email, mobile number (if you add it), company name, and your password, which we store only in scrambled (hashed) form. Why: to create and run your account and contact you about it.
• Sign-in and security: IP address, device and browser type, approximate location worked out from the IP address, and sign-in times. If you use fingerprint or face sign-in (passkeys), we store only a public key: your fingerprint or face never leaves your device. Why: to keep accounts safe, show you where you're signed in, email you when a new device signs in, prevent fraud, and keep the security logs the law requires.
• Your content: your profile, the links your QR codes open, files, menus, pages and forms you create. Why: to show them to people who scan your codes.
• Scan statistics: time of scan, device type, operating system, browser and approximate city and country. We do not store the IP address of people who scan. Why: to show owners how their QR codes perform.
• Payments and billing: billing name, address and GSTIN (if given), and payment status. Payments are handled by Razorpay; we never see your card number, CVV or UPI PIN. Why: to take payment and issue GST invoices, which the law requires.
• Shop orders: delivery name, address, phone and email, and photos you send if you report a problem. Why: to deliver your order and handle replacements and refunds.
• WhatsApp (only if you link it): your WhatsApp number and the messages and photos you send to our number. Why: to do what you ask over WhatsApp and send updates you opted in to. Reply STOP anytime.
• Phone notifications (only if you turn them on): a technical address for your browser's notifications.
• Messages to us: what you write to support or our grievance team.

We process your data on the basis of the consent you give when you sign up, buy, or turn on a feature, and for the "legitimate uses" the DPDP Act allows, such as data you give us for a specific purpose and meeting legal duties (for example, tax invoices and security logs). You can withdraw consent anytime (see "Your rights"). Withdrawing doesn't affect what was done before, and some features may stop working.

When you share your name and number with a business through a YourQR lead form or a form on its page, that business decides what happens with your details: it is the Data Fiduciary, and we process the details only on its behalf, as its Data Processor. We show only that business your details; we don't use them ourselves or contact you.

To see, correct or delete such details, contact the business. If you can't reach it, write to us through Grievance redressal and we'll help.

Only with service providers who help us run YourQR, under contracts that let them use the data only for that:

• Razorpay: payments and refunds.
• Our hosting and email providers (including Hostinger): to run our servers and send emails.
• Cloudflare: network security, and reading menu or page photos when you use SnapPage.
• Google Safe Browsing / Web Risk: checking that links are safe (only the link is sent).
• Gupshup and Meta (WhatsApp): only if you link WhatsApp.
• Courier companies: your delivery details, for shop orders.

Some of these providers may process data outside India, which the DPDP Act allows except to countries the Government restricts. We also share data when the law requires it, for example with courts, CERT-In or other authorities making a lawful request.

• Your account and content: while your account is open. After you ask us to delete it, we erase it within 30 days.
• Invoices and payment records: for as long as GST and income-tax laws require (up to 8 years), even after the account is deleted.
• Leads and form responses: for the time the account owner chooses (3 months to 3 years; 1 year by default). Owners are emailed 7 days before older entries are removed; removed entries can be restored for 30 days and are then erased for good. Bookings are kept until the appointment day has passed.
• Sign-in records and security logs: at least 1 year, as the DPDP Rules require, then deleted.
• Scan statistics: about 13 months.
• WhatsApp messages: photos are deleted once processed; message records are kept for up to 1 year.
• Complaints: 3 years, so we can show how each was handled.

We use only cookies needed to run YourQR: one to keep you signed in, one to recognise a device you've used before (for sign-in alerts), a short-lived one during fingerprint or face sign-in, and, on lead forms, one so visitors aren't asked for their details twice. We don't use advertising or tracking cookies, so there's nothing to opt out of.

Encrypted connections (HTTPS), scrambled passwords, two-step sign-in and passkeys, encrypted secrets, limited staff access, backups and security monitoring. If a personal-data breach happens, we'll tell affected people and the Data Protection Board of India, and report to CERT-In, as the law requires.

• Access: get a summary of your data. Signed in? Download it anytime from Settings → Security.
• Correction and update: edit your details in Settings, or ask us.
• Erasure: ask us to delete your account and data from Settings → Security, or through Grievance redressal.
• Withdraw consent: turn off sign-in emails, phone notifications or WhatsApp in Settings, or ask us.
• Nominate someone to use these rights for you if you die or can't act.
• Grievance redressal: complain through Grievance redressal. We answer within 15 days (the law allows up to 90).

If you're not satisfied with our answer, you may complain to the Data Protection Board of India.

YourQR is for people aged 18 and over. We don't knowingly collect children's data. If you believe a child has an account, tell us through Grievance redressal and we'll delete it.

Grievance Officer: Koyalkar Ajaykumar
Email: support@skymotiveservices.in
Sky Motive Services LLP, Hyderabad, Telangana 500098, India

Or use the form on our Grievance page.

If we change this policy we'll post the new version here, and email you about important changes before they apply.