Privacy Policy
Data we collect
Today, the only personal data we collect is your email address when you join the waitlist — nothing else. Once the service launches and you create a card, we will collect: your name, email, phone, photo (optional), company logo (optional), and the content you choose to display. When a visitor fills the contact form on your public card, we store the details they submit (name, contact info, message) solely to deliver them to you. When you contact support we store: your subject, message, and email. Public-card scan counts will be recorded as aggregate analytics only (no IPs or browser fingerprints).
How we use it
Your data is used solely to provide the service: rendering your card at its public URL, forwarding lead-capture submissions to you, showing you usage analytics, and responding to support requests. We do not sell, rent, or share your data with third parties for marketing.
Storage
Data is stored on Supabase (PostgreSQL, AES-256 encryption at rest, TLS 1.2+ in transit). Every user-data table is protected by Row-Level Security. Current hosting region: Mumbai, India (ap-south-1). The frontend runs on Vercel.
Cross-border data transfer
Your data is currently processed in India (Mumbai), the closest Supabase region available at setup. By signing up, you provide explicit consent to this transfer. As the service grows we may migrate to a region closer to our main user base. Data is covered by Supabase's contractual protections in line with UAE PDPL cross-border transfer requirements.
Trusted third parties
We use a limited set of processors to run the product: Supabase (hosting + database), Vercel (frontend), Vercel Analytics (cookieless page-view counts), Resend (transactional email), ImprovMX (inbound mail forwarding), Stripe (payment processing). Apple and Google sign-in (when enabled) are subject to their respective privacy policies.
Cookies
We use only essential cookies: country detection (to localise pricing), language preference, an owner bypass cookie when applicable, and an authentication session when signed in. Your card edit key is kept in your own browser local storage so your device can re-edit your card. We do not use ad tracking or browser fingerprinting. Vercel Analytics does not set cookies or collect personal data.
Your rights under PDPL
You have the right to: access your data, correct it, delete it, port it to another provider, and withdraw consent at any time. To exercise any of these rights: security@qrkhatm.com
Breach notification
In the event of a personal data breach, we will notify the UAE Data Office within 72 hours and affected users without undue delay.
Children
The service is not directed to children under 13. We do not knowingly collect data from children.
Data retention
Waitlist emails are kept only until launch, then deleted or migrated to your account with your consent — you can request deletion at any time before that. Account data will be deleted within 30 days of account deletion. Support correspondence is kept for up to 12 months.
Updates
We may update this policy. Material changes will be communicated in advance via your registered email or an in-app notice.
Operating entity
This service is operated by XDIGITAL SERVICES (FZE), SPARK Free Zone, Sharjah, United Arab Emirates. Product brand: QR Khatm (ختم). Contact: support@qrkhatm.com
Payments and Billing
Payments for subscriptions and one-time purchases are processed securely through Stripe, our third-party payment processor. We do not store your full card details on our servers. You can manage or cancel your subscription at any time from your account settings. Cancellations take effect at the end of your current billing period, and applicable refunds are handled in accordance with our refund policy.
For deeper technical detail, see the security page.