Privacy Policy

Last updated: 2 October 2026

This policy explains what personal data Concept Box Technology (a sole proprietorship based in India) collects when you use freeqrstudio.com, how we use it and the choices you have. The short version: we collect only what we need to run the Service, we don't sell your data, and we don't show ads.

1. Who is responsible for your data

Concept Box Technology is responsible for (the “data fiduciary” or “controller” of) personal data about our visitors and account holders. When you create dynamic QR codes and people scan them, you decide what those codes are for, and we process the scan data on your behalf.

2. What we collect

Static QR codes — nothing

Static QR codes, including any logo you add, are generated entirely in your browser. Their content is never sent to our servers.

Your account

• Your email address, and a password (stored only as a secure hash by our authentication provider).
• If you sign in with Google: your name, email address and profile picture from your Google account.
• Workspace details: workspace name, team members and their roles, and pending invitations (the invitee's email address).

Dynamic QR codes you create

The destination URL, label and settings of each dynamic code (such as expiry date, scan limit and UTM tags). Passwords you set on a QR code are stored only as a secure hash. Custom domains, API keys (stored as a hash) and webhook endpoints you add are stored with your workspace.

When someone scans a dynamic QR code

We record the time of the scan, the approximate location (country, region and city, worked out from the IP address by our hosting provider), the operating system, device type and browser, the phone's preferred language, the browser's user-agent string, the referring page if any, and UTM campaign tags. We do not store the scanner's IP address and we don't try to identify individual people. To count unique scans we keep a one-way hash of the IP address, user agent, QR code and date, made with a secret key. Because the date is part of it, the hash changes every day and is different for every QR code, so it can't be used to follow anyone across days or codes, and it can't be turned back into an IP address. This data is shown to the QR code's owner as analytics, in CSV exports and — if they have set them up — sent to their webhooks.

Payments

Payments are handled by our payment partner. We never receive your full card number, UPI credentials or bank details. We receive and store your subscription status, plan, billing period and the partner's customer and subscription IDs.

Website analytics

We use Google Analytics (which sets cookies) and Vercel Web Analytics (which does not use cookies) to understand how visitors use our website, such as which pages are visited and roughly where visitors come from. See section 6 for how to opt out.

Emails you send us

Your message and email address, so we can reply.

3. How we use it

• To provide the Service: sign you in, run your workspace, redirect your short links and show your analytics.
• To manage subscriptions and billing.
• To keep the Service secure and prevent abuse, such as phishing links.
• To understand and improve how the website is used.
• To send account emails: a welcome email, reminders before free-trial QR codes expire, a notice when people scan one of your codes that is no longer active, and (on paid plans) a weekly scan summary you can unsubscribe from with one click. We also email you about important changes, such as prices. We don't send marketing emails without your consent.
• To comply with legal obligations, such as tax and accounting records.

Under India's Digital Personal Data Protection Act, 2023 we process personal data with your consent or for legitimate uses permitted by law. For visitors in the EU/UK, our legal bases are performing our contract with you, our legitimate interests (security, improving the Service), consent (analytics cookies) and legal obligations.

4. Who we share it with

We don't sell or rent personal data. We share it only with service providers who help us run the Service:

We also share data when you ask us to (for example, webhooks you configure send scan data to your own server), and when required by law or to protect people from harm.

5. Where your data is stored

Our providers may store and process data outside India, including in the United States and the European Union. When we transfer data, we rely on providers that protect it with appropriate safeguards.

6. Cookies

• Essential cookies keep you signed in. The Service can't work without them.
• Analytics cookies are set by Google Analytics. You can block them in your browser settings or with Google's opt-out browser add-on; the Service works normally without them.

7. How long we keep it

• Account and workspace data: while your account is open. When you ask us to delete your account, we delete it within 30 days.
• Dynamic QR codes and their scan data: until you delete the QR code or your account. Deleting a QR code deletes its scan history.
• Billing records: as long as tax and accounting law requires (in India, generally 8 years).
• Backups may keep copies for a short period after deletion before being overwritten.

8. Your rights

You can ask us to give you a summary of your personal data, correct it, delete it, or withdraw consent you've given. You can also nominate someone to exercise these rights for you. If you are in the EU/UK you can also object to processing, ask us to restrict it, or ask for a copy in a portable format, and complain to your local data protection authority. Many details (like your QR codes and scan data) you can view, export and delete yourself in the dashboard. For anything else, email support@freeqrstudio.com — we reply within 30 days.

9. Security

We use encryption in transit (HTTPS), hash passwords and API keys, and restrict access to personal data. No system is perfectly secure; if a breach affects your data, we will notify you and the authorities as required by law.

10. Children

The Service is not meant for anyone under 18, and we don't knowingly collect their personal data. If you believe a child has given us personal data, email support@freeqrstudio.com and we will delete it.

11. Grievance officer

For any concern or complaint about how we handle personal data, contact our Grievance Officer: The Proprietor, Concept Box Technology, India — support@freeqrstudio.com. We acknowledge complaints within 48 hours and resolve them within 30 days.

12. Changes to this policy

We may update this policy. The date at the top shows when it last changed. If a change materially affects you, we will tell you by email or in the dashboard. See also our Terms of Service.