Privacy Policy

Effective Date: November 2026

1. Data Fiduciary & Service Overview

This Privacy Policy explains how MultiLinkQR ("we", "us", or "our"), operated by proprietor VishalKumar Patel (registered address: C-115, Zenon, Opp. Unique Hospital, Nr. Kiran Motors, Khatodra Wadi, Surat, Gujarat 395002, India), acts as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 (DPDP Act) of India and handles personal data in accordance with global privacy standards including the General Data Protection Regulation (GDPR).

We design our QR generation and edge routing services around data minimization and zero raw identifier retention.

2. Categories of Data We Process

A. Account & Workspace Information

When you register for MultiLinkQR, we collect your email address, name, workspace name, language preference (English or Hindi), time zone, preferred currency (INR or USD), and two-factor authentication credentials (TOTP secret keys).

B. Dynamic QR Codes & Page Content

We store your short link slugs, destination URLs, multi-link titles, social profile links, uploaded brand logos, custom CSS configurations, and redirect rules.

C. Anonymized Scan Telemetry (Privacy-First)

When someone scans a dynamic QR code, we process the request at Cloudflare edge PoPs.We NEVER store raw IP addresses or raw User-Agent strings. Instead, we compute a one-way visitor hash:

visitorHash = HMAC-SHA256(ip + userAgent, rotatingDailySalt)

The salt rotates every 24 hours. We record only aggregated country, city, general device category (mobile/desktop/tablet), operating system, and scan timestamp.

D. Customer Leads (Processor Role)

When our business customers activate lead forms on their QR pages (e.g. restaurant menus or event RSVPs), the customer acts as the Data Fiduciary (Data Controller). MultiLinkQR acts strictly as a Data Processor storing submissions on their behalf.

3. Data Retention Periods

We maintain strict data retention schedules:

Raw Scan Events: Retained for exactly 400 days, after which individual scan records are permanently purged by automated cron jobs.
Daily Statistical Aggregates: Aggregated daily counters (total scans, unique scans, countries) are stored indefinitely without any personal identifiers.
Security & Access Logs: Access logs, authentication records, 2FA modifications, and administrative blocks are retained for 180 days.
Error Traces & Samples: Application error logs are retained for 30 days; performance samples are retained for 14 days.
Account Deletion Grace Period: When you delete your account, records are soft-deleted for a 30-day grace period, then permanently purged from databases and backups.

4. Third-Party Sub-processors

We rely on trusted cloud infrastructure providers to provide our services. For a full list and description of data processed, please visit our dedicated page:

View MultiLinkQR Sub-processors →

5. Your Data Principal Rights

Under the India DPDP Act, 2023 and GDPR, you have the following rights:

Right to Access & PortabilityDownload a complete ZIP archive of your account, QR codes (JSON), and scan history (CSV) instantly from Settings > Data.

Right to Correction & ErasureEdit your profile at any time or initiate permanent account deletion with a single click.

Right of Grievance RedressalFile a formal complaint with our Grievance Officer, guaranteed response within 24h and resolution within 15 days.

Right to NominateDesignate a representative to exercise your data rights in the event of death or incapacity.

6. Age Restriction & Grievance Officer

Minimum Age 18+: MultiLinkQR does not knowingly allow individuals under 18 years of age to register accounts. Every account holder must certify they are at least 18 years old upon registration.

For any privacy inquiries or to exercise your statutory rights, please visit our Grievance page or contact our Grievance Officer directly:

VishalKumar Patel (Grievance Officer)

Email: support@multilinkqr.com

C-115, Zenon, Opp. Unique Hospital, Nr. Kiran Motors, Khatodra Wadi, Surat, Gujarat 395002, India