Privacy policy

Last updated 11 November 2026

QRVow ("we", "us") is run by Anand Varma, a sole proprietorship based in Hyderabad, Telangana, India. This policy explains what personal data we handle when you use qrvow.com (including www.qrvow.com) and our QR codes, and the choices you have. For the Digital Personal Data Protection Act, 2023 we are the Data Fiduciary for your account data.

The short version

• We never store who scanned a code: no IP addresses, no device IDs, no tracking cookies.
• We keep your email address and your codes so you can sign in and manage them, plus any files and page content you choose to host with us.
• Pages we host for you (contact cards, menus, Wi-Fi pages) are public to anyone who scans the code.
• We don't sell or rent personal data, and we don't show ads.
• Paddle handles payments. We never see your card or bank details.

What we collect, and why

If you make a free static code

Nothing. The free generator runs entirely in your browser. What you type is never sent to us.

If you create an account

• Email address: to send sign-in links, important notices about your codes (for example, when a destination changes or a safety check flags it) and receipts-related messages. We don't send marketing email unless you opt in.
• Your codes: names, destinations and settings you enter, plus their change history so you can undo a change.
• Plan details: your plan, status and renewal date, received from Paddle.

When someone scans a code

We count scans per code per day, grouped by country (from our network provider's location estimate) and device type (phone, tablet, desktop). We don't store IP addresses, full user agents or anything that identifies the person scanning. These counts power the statistics in your dashboard.

When you report a code

We keep the code, the reason and the details you write. To count independent reports without storing who sent them, we keep a one-way, keyed hash of your network address combined with the date, which cannot be turned back into the address.

When you use Vow or AI art

Your chat messages to Vow, and any photo you send it (a menu or a business card, for example), go to AI models running on Amazon Bedrock (Amazon Web Services) so they can write a draft for you. The same goes for the prompt you write for an AI art code. These requests are not used to train the models, and we don't keep the messages, photos or prompts after the request is answered, except what you then save (a code, a page, an art image and the prompt that made it). We count how many AI requests you make each month to apply your plan's allowance.

Files you upload and pages we host

Files you upload for a hosted page (PDFs, images, audio and video) and the page content you enter are stored on Amazon Web Services in the United States (us-east-1) until you remove them or delete your account. A hosted page is public: anyone who scans its code, or has its link, can see everything on it, including contact details and, on a Wi-Fi page, the Wi-Fi password. Only put on a page what you're happy for those people to see.

When you use the QR safety check

A link you check with our safety checker (or that a scanned code points to) is sent to Google Web Risk and abuse.ch URLhaus to look for phishing and malware. Only the link is sent, not who you are.

When you email us

We keep the conversation so we can help you and keep a record of complaints and grievances.

Security logs

Our servers keep technical logs (for example, request times and errors) to run and secure the service and to meet Indian cyber-security directions, which require some logs to be kept for 180 days.

Keeping codes safe

To protect people who scan our codes, we check each destination address against Google Web Risk and abuse.ch URLhaus, look up how old its domain is, and follow its redirects. Only the destination address is sent for these checks, never your personal details.

Who processes data for us

• Amazon Web Services: hosting, database, file storage and email delivery (United States), and Amazon Bedrock for the AI models behind Vow and AI art.
• Paddle.com: our merchant of record for payments, invoices, tax and refunds. Paddle's own privacy policy applies to the checkout.
• Cloudflare Turnstile: the "verify you are human" check on our forms.
• Google Web Risk and abuse.ch URLhaus: destination safety checks (addresses only).

Some of these providers store data outside India. We only use providers that protect it with appropriate safeguards, and we don't transfer data to any country the Government of India restricts.

Cookies and storage

We don't use advertising or tracking cookies. When you sign in, your browser keeps a session token in local storage so you stay signed in; signing out removes it. Cloudflare Turnstile and Paddle's checkout may set the cookies they need to work.

How long we keep data

• Account data and codes: while your account exists. Deleting a code removes it; deleting your account removes your account data and stops your codes.
• Scan counts: for as long as the code exists.
• Payment and tax records: as long as Indian tax law requires (Paddle keeps the full payment records).
• Security logs: 180 days. Abuse reports and grievance records: up to 3 years.

Your rights

You can ask to see, correct, update, export or erase your personal data, withdraw consent, or nominate someone to act for you. Email help@qrvow.com from the address on your account. We reply within 7 days and act within 30 days. If you're not satisfied, you can contact our Grievance Officer, and then the Data Protection Board of India.

Children

QRVow is not meant for anyone under 18. We don't knowingly create accounts for children.

Security

Data is encrypted in transit and at rest. Sign-in uses one-time email links, so there are no passwords to leak. If a breach affects your personal data, we'll tell you and the Data Protection Board as the law requires.

Changes

If we change this policy in a way that matters, we'll email account holders before the change takes effect.

Contact

Anand Varma, QRVow, Hyderabad, Telangana, India · help@qrvow.com