Privacy Policy

When you create your card, we collect your name and email address, along with the data and content you choose to add to the card — such as your phone number, photo, company logo, and other contact details. When a visitor fills the contact form on your public card, we store the details they submit (name, contact info, message) solely to deliver them to you. When you contact support we store: your subject, message, and email. We also record scan and view analytics for your card and QR codes to show you usage statistics: we never store your IP address; visits are counted using a hashed visitor identifier that rotates daily, together with the visitor's device platform (iOS, Android, or desktop) and city-level location. This analytics data is permanently deleted within 30 days of the card or QR code it belongs to being deleted.

Your data is used solely to provide the service: rendering your card at its public URL, forwarding lead-capture submissions to you, showing you usage analytics, and responding to support requests. We do not sell, rent, or share your data with third parties for marketing.

Data is stored on Supabase (PostgreSQL, AES-256 encryption at rest, TLS 1.2+ in transit). Every user-data table is protected by Row-Level Security. Current hosting region: Mumbai, India (ap-south-1). The frontend runs on Vercel.

Your data is currently processed in India (Mumbai), the closest Supabase region available at setup. By signing up, you provide explicit consent to this transfer. As the service grows we may migrate to a region closer to our main user base. Data is covered by Supabase's contractual protections in line with UAE PDPL cross-border transfer requirements.

We use a limited set of processors to run the product: Supabase (hosting + database), Vercel (frontend), Vercel Analytics (cookieless page-view counts), Resend (transactional email), ImprovMX (inbound mail forwarding), Stripe (payment processing). Apple and Google sign-in (when enabled) are subject to their respective privacy policies.

We use only essential cookies: country detection (to localise pricing), language preference, an owner bypass cookie when applicable, and an authentication session when signed in. Your card edit key is kept in your own browser local storage so your device can re-edit your card. We do not use ad tracking. Scan and view counts are deduplicated using a hashed visitor identifier that rotates daily — not persistent device fingerprinting. Vercel Analytics does not set cookies or collect personal data.

You have the right to: access your data, correct it, delete it, port it to another provider, and withdraw consent at any time. To exercise any of these rights: security@qrkhatm.com

In the event of a personal data breach, we will notify the UAE Data Office within 72 hours and affected users without undue delay.

The service is not directed to children under 13. We do not knowingly collect data from children.

We keep personal data only for as long as it is needed for the purposes it was collected for, or until you ask us to delete it, unless we are required to keep it for legal or regulatory reasons.

You can request deletion of your data at any time at support@qrkhatm.com.

Account data will be deleted within 30 days of account deletion. Support correspondence is kept for up to 12 months. If a published digital card's page stays disabled for three (3) continuous months, its data may be permanently deleted. For details, see the "Continued Card Suspension" clause in our Terms of Service, including the transitional provisions for cards disabled before that clause takes effect.

We may update this policy. Material changes will be communicated in advance via your registered email or an in-app notice.

This service is operated by XDIGITAL SERVICES FZE, SPARK Free Zone, Sharjah, United Arab Emirates. Product brand: QR Khatm (ختم). Contact: support@qrkhatm.com