What we collect, what we deliberately do not collect, why, how long we keep it, and how to exercise your rights under the Digital Personal Data Protection Act 2023, the GDPR and the CCPA/CPRA.
Who we are
qrcodegenerator.in and the short-link service qrrd.in are operated by Agochar Tech LLP, a limited liability partnership registered in India under the Limited Liability Partnership Act, 2008, with its registered office at 415 Decora Square, Sadhu Vasvani Road, Rajkot 360005, Gujarat, India. In this notice "we", "us" and "qrcodegenerator.in" mean Agochar Tech LLP.
For your account, billing and our own website we decide why and how personal data is used, so we are the data fiduciary (under Indian law) and the controller (under the GDPR). For data our customers collect through their codes and hosted pages, the customer decides, and we process it on their instructions — see "Data our customers collect" below.
- Privacy questions
- privacy@qrcodegenerator.in
- Grievance officer
- Rajesh Dalsaniya, Grievance officer and CEO, Agochar Tech LLP, 415 Decora Square, Sadhu Vasvani Road, Rajkot 360005, Gujarat, India. Email grievance@qrcodegenerator.in, telephone +91 86986 76976.
- EU representative
- Not yet appointed. Until one is, people in the EEA and the UK can reach us directly at the privacy address.
What we collect from you, and why
We hold what is needed to run your account and bill you, and nothing for advertising.
- Account
- Email, name, locale and time zone; a hashed password or the identity of the provider you sign in with (Google, Microsoft, GitHub, Apple or LinkedIn); a two-factor secret if you turn it on. Why: to create and secure your account. Basis: our contract with you.
- Sessions
- The device and browser you signed in from, and a salted hash of its IP address, so you can see and revoke your sessions. Basis: our legitimate interest in keeping accounts secure.
- Workspace and content
- Workspace names, team members, and the codes, destinations, designs, hosted pages and files you create. Why: they are the service. Basis: contract.
- Billing
- Plan, invoices, credit balance, billing name and address, and your GSTIN if you give one. Card and account details are entered on Razorpay’s or PayPal’s own checkout and never reach us. Basis: contract, and our legal obligation to keep tax records.
- Messages to us
- What you write to support or through the contact form, with a hashed form of the IP address and browser used, to stop abuse of the form. Basis: legitimate interest in answering you and preventing spam.
- AI features
- When you use an AI feature, the prompt and any image or file you give it are sent to our AI provider to produce a result. The result is stored and reused for the same input, so the same request is not paid for twice. AI never writes or changes the data encoded in a code. Basis: contract.
What we record when someone scans a code
A scan produces one event, built at our network edge. It contains no IP address: the address is used to derive a location and is then discarded before the event leaves the edge. No cookie is set and no script runs on the scan path.
- Location
- Country, region and city, derived at the edge from network data.
- Device
- Device type, operating system and version, browser, language and time zone.
- Context
- Referring domain and path (with the query removed), campaign tags, and which redirect rule matched.
- Uniqueness
- A keyed hash of the IP address and browser string, with a key that changes every day. It counts unique visitors within a day and cannot be reversed or linked across days.
Data our customers collect
A customer can collect information from the people who scan their codes — for example through a form on a hosted page, or scan analytics. For that data the customer is the data fiduciary or controller and we are their processor: we store it for them, use it only to provide the service to them, and delete it when their account is deleted. If you filled in a form on a page made with our service, contact the business that published it; we will pass on a request we receive.
Form submissions are stored with a hashed form of the submitter’s IP address and browser, used only to detect abuse of the form.
Who we share it with
We do not sell personal data, and we do not share it for advertising. We use service providers to run the service, each only for its purpose:
- Payments
- Razorpay for payments in rupees, PayPal for payments in dollars.
- Hosting and storage
- Cloud hosting, our edge network for short links, and object storage for files.
- Our email delivery provider, for sign-in links, receipts and notices.
- Security
- Threat-intelligence services that check destinations against lists of known malicious sites, and a bot check on our forms.
- AI
- An AI model provider, for the AI features you choose to use.
- Analytics
- Google Analytics and Microsoft Clarity on our marketing site — only if you accept them in the cookie banner.
- Authorities
- When the law requires it, under a valid order, or to stop phishing or fraud that uses our service.
Where data is processed
Our providers operate in India and other countries, including the United States and the European Union. Where personal data of people in the EEA or the UK leaves those regions, we rely on the European Commission’s Standard Contractual Clauses or an adequacy decision. We do not transfer personal data to any country the Government of India restricts under the DPDP Act. The current list of providers is on the sub-processor page.
How long we keep it
- Scan events
- By plan: Free 30 days, Lite 90 days, Starter 180 days, Starter Plus 1 year, Pro 2 years, Business 3 years, Growth 3 years, Agency 3 years, Scale 5 years. After that only daily totals remain, with nothing that identifies a person.
- Account and content
- While your account is open. When you delete it, your personal data is removed within 30 days; codes you chose to keep, and the hosted pages they point to, stay so that printed codes keep working.
- Invoices and tax records
- Eight years, as Indian tax and LLP law require, even after your account is deleted.
- Export and report links
- Seven days.
- Unused accounts
- An account with nothing in it that has not been signed into for a year may be deleted, after 14 days’ notice.
Your rights
You can use most of these yourself in account settings. For anything else, write to the privacy address. We answer within 30 days, and a grievance within the periods set out below.
- Access
- Download everything we hold about you and your workspaces, as a machine-readable file.
- Correction
- Edit your details directly, or ask us to correct anything you cannot reach.
- Erasure
- Delete your account from settings; your personal data is removed within 30 days. You choose what happens to your codes: by default each dynamic code keeps redirecting to its last destination, frozen, so printed codes keep working; or delete them too, and they stop working.
- Withdraw consent
- Where we rely on consent, such as analytics cookies, withdraw it as easily as you gave it, from “Cookie settings” on any page.
- Objection and restriction
- Under the GDPR, object to processing based on our legitimate interest, or ask us to restrict it.
- Nominate
- Under the DPDP Act, name someone to exercise your rights if you die or become unable to.
- Complain
- To our grievance officer first. In India you may then complain to the Data Protection Board of India; in the EEA or UK, to your data protection authority; in California, to the California Privacy Protection Agency.
- California
- We do not sell or share personal information, as the CCPA defines those words, and we do not use sensitive personal information to infer anything about you. We will not treat you differently for using a right.
Security
Passwords are hashed; tokens for connected apps are encrypted; sessions can be revoked from settings; staff access requires two-factor authentication; every page is served over HTTPS. No system is perfectly secure. If a breach affects your personal data, we will tell you and the Data Protection Board of India as the DPDP Rules require, and the relevant authority elsewhere where the law requires it.
Children
The service is not for children. You must be 18 or older to create an account. We do not knowingly process the personal data of anyone under 18; if you believe a child has given us personal data, write to the privacy address and we will delete it.
Changes to this notice
We will post any change here with a new effective date. If a change materially affects how we use your personal data, we will tell account holders by email and in the dashboard before it takes effect.
Who operates this service
- Operator
- Agochar Tech LLP, a limited liability partnership registered in India under the Limited Liability Partnership Act, 2008.
- Registered office
- 415 Decora Square, Sadhu Vasvani Road, Rajkot 360005, Gujarat, India
- Grievance officer
- Rajesh Dalsaniya, Grievance officer and CEO · grievance@qrcodegenerator.in · +91 86986 76976. Complaints are acknowledged within 24 hours and resolved within 15 days.
- Governing law
- Governed by the laws of India; the courts at Rajkot, Gujarat, India have jurisdiction, subject to your rights as a consumer.
This document is in force from 1 November 2026. If we change it, the new version and its date appear here, and account holders are told before a material change takes effect.