Draft for review - not yet legally finalized.
Account details (name, email), the QR codes and destinations you create, and scan metadata (timestamp, approximate device type, IP address) for the analytics dashboard. Separately, when you accept our cookie banner, we look up your approximate location from your IP address (via a third-party service, ipapi.co) solely to show pricing in your local currency - we don't store this lookup, and it never runs if you decline.
Solely to operate your account, show you your own analytics, and display pricing in a familiar currency. We don't sell scan data or destination URLs to third parties. Third-party processors currently involved: Razorpay (payments), ipapi.co (currency detection, only after consent), and cdnjs.cloudflare.com (loads the QR-rendering library in your browser).
You have the right to access, correct, delete, or export your data, and to object to or restrict certain processing. The IP-based currency lookup only runs after you accept our cookie banner - declining defaults you to INR pricing with no lookup performed. [A named EU representative and a full legal basis assessment are still needed before this is launch-ready for EU visitors.]
You have the right to know what personal information we hold, to request its deletion, and to opt out of its "sale" - we do not sell personal information. [This section needs review against your actual data-sharing practices before publishing.]
We act as a Data Fiduciary under India's Digital Personal Data Protection Act. You have the right to access, correct, and request erasure of your personal data, and to file a grievance. [A named Grievance Officer with contact details is required under the Act and is not yet listed here - this must be added before publishing.]