Privacy policy

This policy explains what personal data QRStitch collects, why, and what control you have over it. We’ve written it to be read, not skimmed past: if anything is unclear, contact us.

1. Who we are

QRStitch (qrstitch.com) is operated by Kalpesh Mishra, a sole proprietor, Sabarmati, Ahmedabad, Gujarat, India (“QRStitch”, “we”, “us”). For data we collect about you, such as your account details, we are the data controller (a “data fiduciary” under India’s Digital Personal Data Protection Act, 2023).

You can reach us at hello@qrstitch.com, or our Grievance Officer at the details in section 12.

2. The short version

• The free generators run in your browser. What you type into a static QR code, barcode or bulk spreadsheet, including WiFi passwords, is not sent to us.
• We never store the IP address of people who scan dynamic QR codes. Scan statistics are counted without identifying anyone.
• Analytics cookies are optional. In the EEA, the UK and Switzerland they are only set after you accept.
• We don’t sell personal data and we don’t use it for advertising profiles.

3. What we collect

When you use the free tools without an account

• Content you enter: processed in your browser only. It isn’t uploaded or stored by us.
• Technical data: like every website, our hosting provider (Cloudflare) processes your IP address, browser type and the page requested in order to deliver the page and protect it from attacks. We don’t use this to identify you.
• Analytics (optional): see section 6.

When you create an account

• Account details: your name, email address and a securely hashed password, or your basic Google profile (name, email, photo) if you sign in with Google.
• Your QR codes and content: names, destinations, designs, folders, and any files you upload for hosted pages (PDFs, images, logos).
• Security records: sign-ins and account changes, with a hashed (not raw) IP address, so you can review your security history and we can detect abuse.
• Billing: your plan and payment history. Payments are processed by our payment partner, which acts as the merchant of record. We never see or store your full card number.
• Messages: emails you send us, and your preferences for product emails.

When someone scans a dynamic QR code

When a person scans a dynamic code created on QRStitch, we record: the time of the scan, the approximate location (country, region and city, derived from the IP address by Cloudflare at the moment of the scan), the device type, operating system, browser and language.

The IP address itself is never stored. To estimate unique scans, we calculate a one-way hash of the IP address, browser and code combined with a secret that changes every day. The hash can’t be turned back into an IP address, and because the secret changes daily, a person can’t be followed from one day to the next.

The owner of the code sees these statistics in aggregate (for example, “120 scans from Mumbai on Android”). They never see who scanned.

4. How we use personal data

Purpose	Data used	Legal basis
Provide the service: create, host and redirect your codes	Account details, QR codes, files	Contract
Show scan statistics to code owners	Scan data (section 3)	Legitimate interest of the code owner; no individual is identified
Keep the service safe: stop phishing, malware, spam and account attacks	Destinations, hashed IPs, security records	Legitimate interest; legal obligation
Send account emails (verification, password reset, receipts, service notices)	Email address	Contract
Send product news and tips	Email address	Consent (you can unsubscribe at any time)
Understand how the website is used, to improve it	Analytics cookies (section 6)	Consent in the EEA, UK and Switzerland; legitimate interest elsewhere, with an opt-out
Billing, tax and accounting	Billing records	Contract; legal obligation

5. Who we share data with

We share personal data only with service providers who help us run QRStitch, under contracts that limit their use of it:

• Cloudflare: hosting, content delivery, databases, file storage, bot protection, and Cloudflare Web Analytics, which counts visits without cookies or tracking you across sites.
• Google: website analytics (Google Analytics, optional), Google sign-in (if you choose it), Gmail, which currently sends our account emails (sign-up confirmations and password resets), and Google Web Risk, which checks destination links against lists of known dangerous sites.
• Microsoft: Clarity session analytics (optional), which helps us see where pages are confusing. Clarity masks the text you type.
• Hostinger: our email provider. It hosts our mailbox.
• Our payment partner: processing payments, taxes and invoices as merchant of record.

We may also disclose data when the law requires it, to respond to valid legal requests, or to protect people from fraud and harm. If QRStitch is ever sold or merged, personal data would transfer under the same protections, and we would tell you first.

6. Cookies and analytics

We use a small number of cookies and similar technologies. Essential ones keep you signed in and protect forms from bots. Optional analytics (Google Analytics and Microsoft Clarity) help us improve the website.

• In the EEA, the UK and Switzerland, optional analytics only run after you choose “Accept”.
• Elsewhere, analytics run by default, and you can switch them off at any time.

Change your choice at any time with Cookie settings in the footer of every page. The cookie policy lists each cookie and how long it lasts.

7. International transfers

Our providers operate worldwide, so data may be processed outside your country, including in India, the United States and the European Union. Where the law requires it, transfers are covered by appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

8. How long we keep data

• Account data and QR codes: while your account is open. After you delete your account, we delete your data within 30 days, and from backups within a further 30 days.
• Scan statistics: stored as daily totals. What you can see depends on your plan (for example, 30 days on Free); totals are deleted with your account.
• Security records: up to 12 months.
• Billing records: as long as tax and accounting law requires (usually 8 years in India).
• Emails to us: as long as needed to answer, and up to 2 years afterwards.

9. Your rights

Depending on where you live, you have the right to:

• access the personal data we hold about you, and get a copy in a portable format;
• correct inaccurate data;
• delete your data (you can delete your account yourself in Settings);
• object to, or ask us to restrict, some processing;
• withdraw consent at any time, for example for analytics cookies or product emails;
• nominate someone to exercise your rights if you die or become incapacitated (India);
• complain to your data protection authority, such as the Data Protection Board of India or your EU or UK supervisory authority.

To use any of these rights, email hello@qrstitch.com from the address linked to your account. We reply within 30 days.

10. Security

We protect data with encryption in transit (HTTPS everywhere), hashed passwords, encrypted secrets, strict access controls and regular reviews. No system is perfectly secure; if a breach affects your personal data, we will tell you and the relevant authorities as the law requires.

11. Children

QRStitch accounts are for people aged 18 and over. We don’t knowingly collect personal data from children. If you believe a child has created an account, contact us and we will delete it.

12. Contact and Grievance Officer

For privacy questions, email hello@qrstitch.com.

In accordance with the Information Technology Act, 2000, the rules made under it, and the Digital Personal Data Protection Act, 2023, our Grievance Officer is:

• Name: Kalpesh Mishra
• Email: hello@qrstitch.com
• Address: Kalpesh Mishra (QRStitch), Sabarmati, Ahmedabad, Gujarat, India

We acknowledge complaints within 24 hours and aim to resolve them within 15 days.

13. Changes to this policy

When we make important changes, we’ll update the date at the top and, if you have an account, email you before the changes take effect.