Privacy Policy
How QRius handles your data
QRius is a QR code and barcode platform run by Uminber Designs. This policy explains what we collect when you use qr-ius.com and app.qr-ius.com, why we collect it, and the choices you have.
Who we are
QRius is operated by Uminber Designs, a partnership firm registered in India, with its registered office at Ground Floor, Shed No. A-12, Rashmi Growth Hub 2, Odhav–Vastral Ring Road, Ahmedabad 382418, Gujarat, India (GSTIN 24AAIFU5144M1ZU). In this policy, "QRius", "we" and "us" mean Uminber Designs. We decide how and why your personal data is processed, so under data protection law we are the data fiduciary (India) and the controller (EU and UK).
What we collect
Your account
- Your name, email address and password. We store passwords only as a one-way hash.
- If you sign in with Google: the name, email address and account ID on your Google account.
- Billing details you add, such as a billing name, address, phone number and tax number, and a record of the plans you've used.
What you create
Your QR codes and barcodes and everything in them: links, text, Wi-Fi details, contact cards, payment details, and the logos or images you upload. Please only encode information you're allowed to share.
Scans of your dynamic codes
When someone scans a dynamic QR code that has scan tracking turned on, we record the time of the scan, an approximate location (city and country), the device type, operating system, browser and browser language. We work out the location from the scanner's IP address at the moment of the scan, using an IP geolocation service, and we don't store the IP address. To count unique scanners we store a one-way, keyed hash of the IP address and browser that changes every month, so it can't identify a person or follow them over time. Static codes, and dynamic codes without tracking, don't record scans.
Website analytics
On qr-ius.com and app.qr-ius.com we use Umami, an analytics tool that runs on servers operated by Uminber Designs (analytics.uminber.in). It doesn't use cookies. It records the pages viewed, the referring site, browser, device type, country and page-speed timings, and we remove IDs and query strings from app addresses before anything is sent. On qr-ius.com only, we may record a sample of visits as session replays and heatmaps to find where the page is confusing. Replays never run inside the app, and they mask everything typed into forms.
Cookies
We only use cookies the service needs to work: one keeps you signed in, one protects forms against cross-site request forgery, and one remembers that you've seen the cookie notice. We don't use advertising cookies.
Messages and forms
When you contact us, we keep your message and contact details so we can reply. The sign-in, sign-up and contact forms may use Google reCAPTCHA to block spam. When they do, Google processes your IP address and browser information under its own privacy policy.
Server logs
Our hosting provider keeps standard web server logs (IP address, time, the address requested and the browser) for security and troubleshooting.
How we use it
- To run QRius: create and store your codes, redirect scans of dynamic codes and show you scan analytics.
- To keep accounts safe: sign-in, password resets, and preventing fraud, spam and abuse.
- To talk to you: account emails such as verification, password resets and plan changes, and replies to your messages. We only send product news if you've agreed to receive it.
- To improve QRius, using aggregated analytics.
- To meet legal obligations, such as keeping tax and accounting records.
We don't sell your personal data, and we don't use it for advertising.
Who we share it with
We share personal data only with service providers that help us run QRius, under terms that require them to protect it:
- Hostinger, which hosts our servers and databases;
- our email provider, which delivers account emails;
- an IP geolocation service, which turns a scanner's IP address into an approximate location;
- Google, if you choose Google sign-in or a form uses reCAPTCHA;
- payment processors, once paid plans start. We don't take payments during the beta.
We may also disclose information when the law requires it, to protect people's safety or our rights, or as part of a merger or sale of the business, in which case this policy keeps applying to your data.
Where it's stored
Our servers are run by Hostinger. Some of our providers process data outside India. When data is transferred out of India, the European Economic Area or the UK, we rely on the safeguards the applicable law requires.
How long we keep it
- Account data: while your account is open. Ask us to close your account and we'll delete or anonymise your personal data within 30 days, apart from what the law requires us to keep.
- Codes and scan records: until you delete the code or your account. Deleting a code deletes its scan records.
- Invoices and payment records: as long as Indian tax law requires, currently up to 8 years.
- Messages to us: up to 2 years after the conversation ends.
- Server logs: normally no longer than 90 days.
Your rights
Depending on where you live, you can ask us to:
- give you a copy of your personal data;
- correct data that's wrong or incomplete;
- delete your data or close your account;
- withdraw consent you've given, without affecting what we did before;
- restrict or object to some processing, or move your data to another service (EU and UK);
- nominate someone to exercise your rights if you die or become unable to (India).
Email help@uminber.in from your account's email address and we'll reply within 30 days. You can download your codes from the app at any time. You can also complain to your data protection authority or, in India, to the Data Protection Board of India.
Security
Connections to QRius are encrypted with HTTPS, passwords are hashed, and access to production systems is limited to the people who need it. No system is perfectly secure, so if you think someone has accessed your account, change your password and email us.
Children
QRius isn't meant for anyone under 18, and we don't knowingly collect their personal data. If you think a child has given us personal data, email us and we'll delete it.
Grievance officer
As Indian law requires, our grievance officer is Niraj Ojha, Uminber Designs, Ground Floor, Shed No. A-12, Rashmi Growth Hub 2, Odhav–Vastral Ring Road, Ahmedabad 382418, Gujarat, India. Email help@uminber.in. We'll acknowledge your complaint promptly and aim to resolve it within one month.
Changes to this policy
We'll post any changes on this page and update the date at the top. If a change is significant, we'll email account holders before it takes effect.