Privacy Policy

The short version

Without an account, QR Studio builds static QR codes and print templates entirely in your browser: what you type is used to draw the code on your screen and is not sent to us. If you sign in to use dynamic codes, business pages, forms or paid plans, we store the information described below so those features can work. We do not sell your data, and we show no ads. This policy is written to follow India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and its Rules.

Who we are

QR Studio, Nanjapa Nagar, 3/71, Kannampalayam Road, Ranganathapuram, Kannampalayam, Tamil Nadu 641402 (“we”), decides why and how the personal data in your account is used. Under the DPDP Act that makes us the data fiduciary for it. For the details other people leave on your codes, pages and forms, you are the data fiduciary and we are only the service that stores and passes them to you (a data processor). You can reach us at support@nexforgelabs.co.in or through the contact page.

What stays on your device

• Everything you type into the static generator or a template, until you choose to save it to your account.
• Logo and background images you upload to the generator: read locally and embedded into the code.
• Your current design and a short list of recent codes, kept in your browser’slocalStorageso the tool remembers your work. Clear your browser data to remove it.

What we collect, why, and for how long

We only collect what the features you use need. Card and bank details go to Razorpay and never reach our servers.

To protect people who scan, destination addresses are checked against Google Safe Browsing before they are accepted, which means the address (not the scanner) is sent to Google.

Your consent, and taking it back

• When you sign in or create an account you agree to this policy for the uses in the table above. We ask for nothing we do not need for those.
• Some things are separate and optional: alert and weekly-report emails (switch them off in Dashboard → Settings or with the link in the email), the phone, company and GST details you add, and a visitor’s tick on a “leave your details” form.
• You can take your consent back at any time, as easily as you gave it: switch the option off, remove the detail, or delete your account. Sign-in, billing and safety emails are part of the service and continue while you have an account.

Your rights

Under the DPDP Act you can, at any time and free of charge:

• See your data. Dashboard → Settings → Download my data gives you one file with your account, codes, scans, forms and answers, pages, saved documents and payment records.
• Correct or complete it. Edit your details in the dashboard, or write to us.
• Have it erased. Dashboard → Settings → Delete account permanently removes your account, sign-in sessions, dynamic codes and their scan history, visitor details collected through your codes and pages, your business page and photo, forms and their answers, webhooks, saved designs and documents, custom domains, add-on records and payment order records, except what the law makes us keep (see the table). We also keep one small thing after deletion: a one-way fingerprint of your email address with your free-trial start date, so the free trial cannot be claimed again. It cannot be turned back into your email.
• Get your complaint heard (see “Questions and complaints” below).
• Nominate someone to use these rights for you if you die or cannot act. Write to us with their name and how to reach them.

Children

QR Studio accounts are for people aged 18 or over. If you are under 18 you may use the static generator and templates, which collect nothing, but please do not create an account unless a parent or guardian agrees and does it with you. We do not knowingly collect a child’s data, and we never track children or aim advertising at them. If you run a school, class or event and use our forms, pages or codes to collect details about children, you must get a parent’s or guardian’s consent first. If you think a child has an account, tell us and we will remove it.

Dynamic codes, scans and tracking pixels

A dynamic code sends the person who scans it through our server to the destination its owner chose. We record the scan details in the table above and do not try to identify the scanner.

On some plans the owner can add their own tracking pixels (Google Analytics, Google Tag Manager, Meta). A code with pixels shows a short “Opening…” page that loads them before sending you on. Those tools are run by the code’s owner, who decides what they collect and must have a lawful basis to use them. The page says so and has a Continue without tracking link that skips them. We do not add pixels of our own.

Business pages and forms

A business page (/b/your-name) is public. Anything you put on it, such as your name, business, phone, email, address, links and photo, can be seen by anyone with the link, and may be found by search engines. Only add what you want to share. You can edit or remove it at any time, and deleting your account removes it.

• Page statistics. We count visits, contact saves and button taps so you can see how your page is doing. Counts are totals per day, not a record of who visited.
• Leave-your-details forms and Forms. If the owner switches one on, a visitor may send their name, phone, email, a message, answers or files. On a business page the visitor ticks a consent box first. The details go to the owner, who decides what to do with them. If the owner has set up a webhook, the details can also be sent to the address they chose.
• Reports. Anyone can report a page. We keep the reason, any note, and a one-way scrambled fingerprint of the reporter’s IP address (not the address itself). Pages can be hidden automatically or by us while a report is reviewed.

If you filled in a form on someone else’s page or code and want your details corrected or removed, ask that owner first, or contact us and we will pass it on and help.

QR Sign (signing documents)

QR Sign lets a person (the sender) ask others to sign a PDF, or sign one alone. The sender decides which document goes to whom and why, so for the document itself the sender is the data fiduciary and we act as their processor: we store and seal it for them and use it for nothing else.

• The document file. It is encrypted with a key that is kept apart from the database, and it is deleted after the time the sender chose: by default 24 hours after the last signature. Longer times (7, up to 14, 30 or 90 days) are on paid plans. A stored copy is also removed at the latest after about 100 days, even if our own deletion failed. Our staff do not open documents. While a file is being sealed, it is in the server’s memory for a moment and is never written to a log.
• The proof that stays. After the file is deleted we keep a record: the document’s fingerprint (a one-way code, not the content), the document name (or a code if the sender chose that), each signer’s name and email, when each step happened (sent, opened, code confirmed, terms agreed, signed, downloaded), and the sealed certificate. It is kept until the sender deletes it or deletes their account. It holds no IP address and no device details. Links and codes are stored only as one-way hashes.
• Signers and people copied in. A signer’s email is used only to send the request, codes, reminders and a note when the document is finished. A person copied in by the sender gets one notice when everyone has signed, never the file. Someone who signs in person on the sender’s device may be recorded by name alone.
• Your agreement. Before a signer gets a code, they tick that they agree to the Terms and this Privacy Policy and to sign electronically. We record that they did, and when.
• Signatures. A drawn, typed or uploaded signature is placed on the page and sealed into the file. A signature saved “on this device”, an unfinished document and a list of people you sent to before are kept only in your own browser, not on our servers.
• Time stamps. To prove when a signature was made we send a fingerprint of the signature (not the document) to a public time server (DigiCert, Sectigo or FreeTSA).
• Checking a file. The verify page checks a file inside your browser and does not upload it. The public Passport page shows a document’s fingerprint, times and the document name; signer names are shown only if the sender switched that on.
• Reports. Anyone who gets a request they did not expect can report it from the link in the email. We stop the request, delete the file, tell the sender, and keep the reason and the sender’s account ID in the security log for 90 days. We do not keep the reporter’s IP address.

If you were asked to sign something and want your name or email removed from the record, ask the sender first, or contact us. We may have to keep a proof that a document was signed while the sender needs it, but we will remove what we can. The companies that host and deliver QR Sign are listed under “Who else handles your data” below.

Who else handles your data

• Cloudflare hosts the site and our database, and processes standard request logs (IP address, time, browser) to deliver pages and block abuse.
• Razorpay processes payments.
• Google and Microsoft handle sign-in if you choose them, and Google Safe Browsing checks destination addresses.
• Our email provider delivers sign-in links, receipts and the notices you switch on.
• Google Fonts serves the fonts used on our pages.

We do not sell or rent your data to anyone, and these providers may only use it to do their job for us. Some of them run servers outside India, so your data may be processed abroad; the DPDP Act allows this except to countries the Government of India restricts.

Keeping it safe, and what we do if something goes wrong

We protect your data with encrypted connections, access checks on every request, limits on repeated tries, hashed passwords on gated codes and forms, and by collecting as little as we can. If a breach ever affects your personal data, we will tell the people affected and the Data Protection Board of India, as the law requires, with what happened and what to do.

Your QR codes

A static QR code contains its data directly. Once you download and publish it, anyone who scans it can read its contents, so treat it like any printed information. We cannot see, disable or change a static code you made. A dynamic code can be changed or paused by its owner, and stops working when the plan behind it lapses (after a short grace period).

Questions and complaints

For any privacy question, request or complaint, write to support@nexforgelabs.co.in with the subject “Privacy request”. We will confirm we have it and reply within 30 days. If we have not solved it, you can complain to the Data Protection Board of India. Please contact us first, as the law asks.

Changes

If this policy changes in a way that matters, the “last updated” date above will change and we will email account holders before the change applies.