Infrastructure & Privacy

Authorized Sub-processors

Last updated: November 2026

Overview & Due Diligence

Under the India Digital Personal Data Protection (DPDP) Act, 2023 and the General Data Protection Regulation (GDPR), MultiLinkQR engages trusted third-party service providers ("Sub-processors") to process specific categories of data necessary for delivering our services.

Each sub-processor undergoes strict privacy and security evaluations and is bound by contractual data protection agreements that enforce confidentiality, encryption, and strict limitations against using data for any secondary purpose.

List of Active Sub-processors

Cloudflare, Inc.

USA & Global Edge PoPs (India Edge Routing)

Global Edge Network, CDN, DNS, KV Caching, WAF, DDoS Protection & Turnstile Bot Checks

Data Processed: Scan requests, visitor IP addresses (processed transiently in memory, hashed, zero raw retention), encrypted KV cache of active codes, Turnstile bot-check signals on public forms.

Operating Legal Entity: Cloudflare, Inc. (USA) / Cloudflare Global PoPs (including Mumbai, Delhi, Chennai, Kolkata)

Neon, Inc.

USA / AWS Infrastructure (eu-central-1 / ap-south-1 compliant)

Serverless PostgreSQL Database Infrastructure

Data Processed: User profile data, workspace configurations, aggregated analytics metrics, lead submissions collected by customers.

Operating Legal Entity: Neon, Inc.

Resend, Inc.

USA

Transactional Email Delivery

Data Processed: Email addresses, login magic links, security notices, renewal reminders, weekly performance digest emails.

Operating Legal Entity: Resend, Inc.

Dodo Payments, Inc.

USA / Global

Merchant of Record, Global Checkout & Card Payments (USD/Global)

Data Processed: Billing names, customer emails, card tokenization, payment receipts, refund requests.

Operating Legal Entity: Dodo Payments, Inc.

Razorpay Software Private Limited

India (Bengaluru, Karnataka)

Domestic Payment Gateway (India INR UPI, Netbanking, Cards)

Data Processed: Indian billing contact details, transaction references, UPI IDs, payment status events.

Operating Legal Entity: Razorpay Software Pvt. Ltd.

Functional Software, Inc. (Sentry)

USA

Application Error Tracking & Performance Monitoring

Data Processed: Redacted stack traces, crash reports, anonymized error events (PII strictly scrubbed before transmission).

Operating Legal Entity: Functional Software, Inc. (Sentry)

Google LLC (Web Risk, Google Sign-In & Google Analytics)

USA

URL Safety Verification, Optional Google Login & Consent-Based Website Analytics

Data Processed: Destination URLs submitted by users (screened for malware/phishing against Google Web Risk API lists); name and email address if you choose to log in with Google; aggregated website usage data only after you accept analytics cookies.

Operating Legal Entity: Google LLC

PostHog, Inc. (optional)

USA / EU

Product Analytics (only if enabled, only after you accept analytics cookies)

Data Processed: Pseudonymous product usage events (pages viewed, buttons clicked) without names, emails or QR content.

Operating Legal Entity: PostHog, Inc.

Cross-Border Data Transfers

MultiLinkQR processes traffic close to users via Cloudflare edge points of presence in India (Mumbai, Chennai, Delhi, Hyderabad, Bengaluru, Kolkata). Where data is transferred across borders for database resilience or cloud infrastructure, we ensure compliance with the DPDP Rules on cross-border data flows and standard contractual clauses for international data security.