This Privacy Policy explains how YouQR India ("YouQR", "we", "us") collects, uses, and protects information when you use youqr.co and our dashboard (together, the "Service"). We are based in and primarily operate for users in India, and we handle personal data in line with India's Digital Personal Data Protection Act, 2023 ("DPDP Act").
1. Who This Applies To
This policy covers two kinds of people:
- Account holders: businesses and individuals who sign up to create and manage QR profiles.
- Visitors: people who scan a QR code and interact with an AI conversation, including anyone who submits their details through the mandatory intake form before chatting.
2. Information We Collect
From account holders:
- Account details: name, email address, mobile number (optional), password (handled by our authentication provider, never stored by us in plain text).
- Billing information processed by Razorpay; we do not store your full card details.
- Content you upload: knowledge base documents, guardrail instructions, business profile details.
- Usage data: scans, conversation counts, feature usage, log data needed to operate and secure the service.
From visitors who scan a QR code and start a conversation:
- Name, email address, phone number, and the purpose of their enquiry, collected through a mandatory intake step before the AI conversation begins, with explicit consent at the point of collection.
- The content of the conversation itself (the questions asked and answers given), stored so the account holder can review transcripts and so guardrail performance can be monitored.
We do not knowingly collect more personal data than is needed to operate the service.
3. How We Use Information
We use the information above to:
- Create and manage accounts and QR profiles.
- Generate AI responses grounded in the knowledge base and guardrails configured for that profile.
- Process payments and manage subscriptions.
- Record leads and conversation transcripts so account holders can follow up with visitors.
- Detect abuse, enforce guardrails, and keep the service secure.
- Communicate with you about your account, billing, or service changes.
We do not sell personal data, and we do not use visitor conversation data to train AI models outside of generating that specific response.
4. Consent
Where we rely on consent, in particular for collecting a visitor's name, email, phone number, and enquiry details before a conversation starts, that consent is collected explicitly through a checkbox at the point of collection, and can be withdrawn by the visitor by not proceeding with the conversation. Account holders consent to this Privacy Policy and our Terms & Conditions when creating an account.
5. Who We Share Information With
We share information with the following categories of third parties, only as needed to operate the service:
- ElevenLabs, which processes conversation text and voice audio to generate AI responses.
- Anthropic, which summarizes and analyzes conversation transcripts.
- Razorpay, which processes payment information for paid plans.
- Infrastructure and hosting providers that store and run the service.
We do not share personal data with third parties for their own marketing purposes.
Lead and visitor data. If you are a visitor who scanned a business's QR code and chatted with its AI assistant or submitted an enquiry form, see our Lead Data Notice for how that specific data is handled — the business that owns the QR code and YouQR act as joint controllers of it, which works a little differently from the rest of this policy.
6. Data Retention
- Account and profile data is retained while your account is active.
- If you cancel a paid plan, profile, knowledge base, guardrail, and lead data beyond Free-plan limits may be deleted, consistent with our Terms. Your QR code's basic routing record is kept so previously printed or distributed codes continue to work.
- We retain conversation transcripts and lead data for as long as the related account is active, so you can access and act on them, unless you request earlier deletion.
7. Your Rights
Subject to applicable law, including the DPDP Act, you have the right to:
- Access the personal data we hold about you.
- Correct inaccurate personal data.
- Request deletion of your personal data, subject to our legitimate need to retain certain records, such as billing records required by law.
- Withdraw consent where our processing is based on consent.
To exercise these rights, contact us at [privacy@youqr.co]. Account holders can also manage most of their own account data directly from their dashboard settings.
8. Security
We use reasonable technical and organisational measures to protect personal data, including encrypted connections, access controls on our systems, and scoped, least-privilege credentials for the services that process your data on our behalf. No system is completely secure, and we cannot guarantee absolute security.
9. Children's Privacy
YouQR is not directed at children, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
10. International Data Transfers
Some of our sub-processors, including our AI provider, may process data outside India. Where this happens, we take reasonable steps to ensure data is handled in line with this Privacy Policy and applicable law.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will post the updated version here with a new "Last updated" date.
12. Grievance Officer and Contact
In accordance with the DPDP Act, you can reach our Grievance Officer at:
- Name: Sachin Diwakar
- Email: [privacy@youqr.co]
- Address: 875 E1, Shahdara Delhi, 110032 India
For all other questions about this policy, contact [privacy@youqr.co].
Last updated: 6 November 2026