Privacy Policy

1. Who we are

[Company legal name] ("we") is the Data Fiduciary for personal data processed to run A2Z QR Card. Registered office: [Registered office address]. Contact: [grievance email].

2. Data we collect

• Account data: name, email, mobile number, password (stored as a secure hash), account type.
• Profile data you choose to add: photo, contact details, work details, social links, payment details, business details and registration IDs.
• Documents you upload to the vault, and their names, dates and notes.
• Business data: customers, leads, invoices, products, team members and branches you add.
• Usage data: log-in times, device and browser type, IP address, scans and profile views (shown to you as statistics).
• Billing data: plan, invoices and payment status. Card and UPI details are handled by our payment provider, not stored by us.

3. Why we use it

• To create and run your account and profiles, and show the public fields you choose.
• To send verification codes, reminders, receipts and important service messages.
• To process subscriptions and meet tax and accounting duties.
• To keep A2Z secure, prevent abuse and investigate reports.
• To improve the service using aggregated statistics.
• To send product updates or offers, only if you opt in. You can opt out at any time.

4. Legal basis

We process personal data with your consent, which you give when you register and when you choose to add optional information, and for legitimate uses allowed by law, such as complying with legal obligations, responding to emergencies and preventing fraud. You can withdraw consent at any time; this does not affect processing already done.

5. What is public

Only fields you mark Public appear on your profile, which anyone with your link or QR code can see. The document vault, emergency contacts, bank account numbers and fields you mark Private are never shown on a scan. Profiles are never shown in search engines: every profile page asks search engines not to index it.

6. Sharing

• Service providers who host, store, send messages or process payments for us, under contracts that require them to protect your data.
• People you choose to share with, such as a document you approve for a request, or staff you give access to.
• Authorities, when required by law or a valid legal order.
• We do not sell your personal data.

7. Storage and security

Data is stored on secure servers. We use encryption in transit, access controls, and permission checks on every vault download. Full security details will be published before launch. No system is perfectly secure; we will notify you and the Data Protection Board of India of a personal data breach as the law requires.

8. How long we keep it

We keep your data while your account is active. After you close your account or ask for deletion, we delete or anonymise it within the period set out in the Data Deletion policy, except where the law requires us to keep records such as invoices for longer.

9. Your rights

• Access: ask for a summary of the personal data we hold and how it is used.
• Correction and erasure: correct, complete, update or delete your data.
• Withdraw consent for optional processing.
• Grievance redressal: complain to our Grievance Officer, and then to the Data Protection Board of India if unresolved.
• Nominate a person to exercise your rights if you die or become incapacitated.

To use these rights, email [grievance email] or use the Data Deletion page.

10. Children

A2Z is not intended for children. Where a child's profile is created, it must be created and managed by a parent or legal guardian, whose verifiable consent is required. We do not track or target advertising at children.

11. Cookies

We use a small number of cookies and similar storage, as set out in the Cookie Policy.

12. Grievance Officer

[Grievance Officer name], [Company legal name], [Registered office address]. Email: [grievance email]. We acknowledge complaints within 24 hours and aim to resolve them within 15 days.

13. Changes

We will tell you about significant changes to this policy by email or in the app before they take effect.