Privacy Policy
Last updated 18 October 2026
This policy explains how QRzify handles personal data in QRzify, in line with India's Digital Personal Data Protection Act, 2023. There are two groups of people: account holders (you create codes) and scanners (people who scan a code).
What we collect from account holders
- Email address, name (optional) and a hashed password.
- Billing state, GSTIN (optional) and payment records, so we can issue invoices.
- The codes you create, their destinations, designs and the tracking IDs you add.
What we collect when a code is scanned
For each human scan of a dynamic code we record the time, the country and city (looked up from the IP address on our own server with the free DB-IP Lite database, IP Geolocation by DB-IP), the device type, operating system and browser, and the website that referred the scan. We also store a one-way hash of the IP address and browser that changes every day, so we can count unique scanners. We never store raw IP addresses with scan data. Link-preview bots and prefetches are not counted.
If the code's owner added a Google Analytics or Tag Manager ID, or a retargeting pixel (Meta, Google Ads, TikTok or LinkedIn), that tag runs for a moment on the scan page before the visitor is sent on. The owner is the data controller for that tag, and the pixel provider's own policy applies to what it collects.
Webhooks, custom domains and team members
If an account owner sets up a webhook, we send the address they chose a message for each scan or status change. It contains the code, the time, the country, city, device, operating system, browser and referrer of the scan, and never an IP address or the daily hash. If an owner connects their own domain, scans on that domain are handled exactly like scans on ours, and the owner controls the domain's DNS. If an owner invites team members, those people can see that account's codes and analytics according to their role, and we keep their email address and role for as long as they are members.
Why we use it
To run the service, show you analytics, bill you, keep the service safe from abuse such as phishing, and meet legal duties. We do not sell personal data.
How long we keep it
Raw scan records are kept for your plan's analytics history (30 to 365 days), then deleted. Daily totals without personal details are kept longer. Payment records are kept for as long as tax law requires.
Who we share it with
Service providers who help us run QRzify: hosting and security (for example Cloudflare and our server host), email delivery, and our payment gateway. They may only use data to provide their service to us.
Cookies
We use essential cookies to keep you signed in. With your consent we also use analytics on our own website. QRzify never sets cookies on the short link address, including an account owner's own domain, so scanning a code does not store anything on the visitor's device from us.
Your rights
You can access, correct and export your data from Settings, and you can delete your account there at any time. When you delete your account we remove your codes, scan data and personal details; financial records stay but are no longer linked to your identity. To exercise any right or to complain, contact our grievance officer below.
Security and children
We use encryption in transit, hashed passwords and access controls. QRzify is not directed at children under 18.
Contact
Grievance Officer, support@mail.viralish.in. See also Contact and Grievance.