Privacy Policy - Plain-language policies.

Data we collect

When you sign in, we collect your name and email address. When you save or buy a QR design, we store what you put in it — the destination, colours, captions and any logo you add — so you can download it again. For QR Dynamic, we store your link name, its destination and any PDF you attach. When you contact support we store: your subject, message, and email. We also record scan analytics for your QR codes to show you usage statistics: we never store your IP address; scans are counted using a hashed visitor identifier that rotates daily, together with the visitor's device platform (iOS, Android, or desktop) and city-level location. This analytics data is permanently deleted within 30 days of the QR code it belongs to being deleted.

How we use it

Your data is used solely to provide the service: creating and re-downloading your QR codes, sending QR Dynamic scans to the destination you set, showing you scan analytics, and responding to support requests. We do not sell, rent, or share your data with third parties for marketing.

Storage

Data is stored on Supabase (PostgreSQL, AES-256 encryption at rest, TLS 1.2+ in transit). Every user-data table is protected by Row-Level Security. Current hosting region: Mumbai, India (ap-south-1). The frontend runs on Vercel.

Cross-border data transfer

Your data is currently processed in India (Mumbai), the closest Supabase region available at setup. By signing up, you provide explicit consent to this transfer. As the service grows we may migrate to a region closer to our main user base. Data is covered by Supabase's contractual protections in line with UAE PDPL cross-border transfer requirements.

Trusted third parties

We use a limited set of processors to run the product: Supabase (hosting + database), Vercel (frontend), Vercel Analytics (cookieless page-view counts), Resend (transactional email), ImprovMX (inbound mail forwarding), Stripe (payment processing). Apple and Google sign-in (when enabled) are subject to their respective privacy policies.

Cookies

We use a small set of cookies: country detection (to localise pricing), language preference, an authentication session when signed in, and a cookie that remembers which campaign or site brought you here, for 30 days. An unpaid QR design is kept in your own browser local storage for up to 7 days so you can pick up where you left off. We do not use ad tracking. Scan counts are deduplicated using a hashed visitor identifier that rotates daily — not persistent device fingerprinting. Vercel Analytics does not set cookies or collect personal data.

We measure visits to this website ourselves and without cookies: each visit is counted with a hashed visitor identifier that changes every day, is never used for advertising or cross-site tracking, and is kept for 90 days.

Your rights under PDPL

You have the right to: access your data, correct it, delete it, port it to another provider, and withdraw consent at any time. To exercise any of these rights: security@qrkhatm.com

Breach notification

In the event of a personal data breach, we will notify the UAE Data Office within 72 hours and affected users without undue delay.

Children

The service is not directed to children under 13. We do not knowingly collect data from children.

Data retention

We keep personal data only for as long as it is needed for the purposes it was collected for, or until you ask us to delete it, unless we are required to keep it for legal or regulatory reasons.

You can request deletion of your data at any time at support@qrkhatm.com.

Account data will be deleted within 30 days of account deletion. Support correspondence is kept for up to 12 months.

Updates

We may update this policy. Material changes will be communicated in advance via your registered email or an in-app notice.

Operating entity

This service is operated by XDIGITAL SERVICES FZE, SPARK Free Zone, Sharjah, United Arab Emirates. Product brand: QRkhatm (ختم). Contact: support@qrkhatm.com