SaathiX QR is a business software product operated from India that lets shops, restaurants, gyms, salons, doctors and other small businesses publish a business profile page and QR code. The data controller for personal data processed through the Service is SaathiX QR. For all privacy enquiries you can reach the team at legal@saathixqr.com.

We only collect the data we genuinely need to run the Service. The categories are:

• Account data, your name, mobile number, email address and password hash created during sign-up.
• Profile content, anything you publish on your public profile: business name, tagline, photos, logo, social links, gallery items, UPI handle, WhatsApp number and similar fields.
• Authentication data, one-time codes we email to you, browser session tokens and OAuth identifiers (e.g. Google sign-in).
• Usage & analytics, recorded profile visits, link clicks and supported tracked QR requests. New tracked QR records store timestamps and coarse device categories, not precise location or unique-visitor identifiers.
• Saved QR content, QR content, settings and optional logos only when you explicitly save a QR to your account. Public static generation and downloads remain local without signup. A guest save request temporarily preserves its configuration in the same browser tab for up to 30 minutes.
• Communications, messages you send to support, abuse or sales teams.
• Payment metadata, plan, status and invoice IDs. Card numbers and bank details are handled directly by our payment processors; we never store them.

• Create and secure your account, send OTPs and prevent fraud.
• Render your public profile to visitors and generate QR codes.
• Provide analytics so you can see scans, clicks and visitor trends.
• Send essential service emails (security alerts, billing, policy updates) and, only with consent, product announcements.
• Improve the Service, debug issues and develop new features.
• Comply with legal obligations and enforce our Terms.

We do not sell your personal data. If you choose an AI feature, the information you submit is processed by the configured AI service to fulfil that request.

Where the GDPR, UK GDPR or India's DPDP Act applies, we rely on the following legal bases:

• Contract, to provide the Service you signed up for.
• Legitimate interests, to keep the Service secure, prevent abuse and improve features.
• Consent, for optional cookies, marketing emails and analytics where required.
• Legal obligation, to comply with tax, accounting and lawful requests from authorities.

We share personal data only with vetted providers acting on our instructions:

• Hosting & database, Lovable Cloud for authentication, database and storage.
• Email delivery, configured email providers for account verification and service messages.
• CDN & edge, Cloudflare for caching, security and DDoS protection.
• Payments, Razorpay for the implemented subscription checkout.
• Analytics, business profile views, scans and clicks; visitor events associated with those profiles.

We may also disclose data if required by law, a binding court order, or to protect the safety of users and the public.

New tracked QR scan events are retained for up to 90 days; older events are removed when that QR redirect is next used. Recorded requests may include scanners, previews and automated traffic, and are not a count of verified human or unique visitors.

We use a small number of strictly necessary cookies for authentication and security, and browser storage for settings you save. See our Cookies Policy for the full list and how to manage them.

Information is retained as needed to provide the service, handle account requests and meet applicable record-keeping obligations. Contact legal@saathixqr.com for deletion requests and current retention details.

Account access uses authentication and access controls. Please contact us for current infrastructure and data-security details. See the Security page for details.

Subject to applicable law you have the right to access, correct, export, restrict or delete your personal data, and to object to certain processing. Send requests by emailing legal@saathixqr.com. We may verify your identity and handle requests subject to applicable law. You also have the right to lodge a complaint with your local data protection authority.

Infrastructure providers may process information outside your region. Contact us for details about applicable locations and transfer arrangements.

The Service is not intended for children under 13 (or 16 in the EU). We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.

We may update this policy from time to time. Material changes will be announced by email and posted here with a new "Last updated" date. Questions? Email legal@saathixqr.com.