Privacy Policy

Last updated: 1 January 2026

CopyQR (“CopyQR”, “we”, “us”) is a business-to-business software platform for photocopy and print shops in India. Shop owners use CopyQR to receive documents from their customers and print them. This Privacy Policy explains what personal data we process, why, for how long, and the choices available to you. It should be read together with our Retention Policy and Terms of Service.

Operator (entity responsible as data fiduciary for account data):creatorhub.apps , creatorhub.apps@gmail.com

1. Who we are and the roles we play

Under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and applicable rules, the roles differ depending on whose data is involved:

• Shop-owner account data. For information about a shop owner and their account (name, contact details, billing details, subscription status), CopyQR is the data fiduciary — we decide why and how that data is processed.
• Customer documents and print orders. For documents and personal data uploaded by a shop’s own customers, the shop owner is the data fiduciary and CopyQR acts only as a data processor, processing that data on the shop’s instructions and to provide the printing service.

If you are a customer of a shop and have a privacy question about a document you uploaded, please contact that shop first. We support shops in responding and, where required, will act on verified instructions from the shop.

2. Personal data we collect

2.1 From shop owners

• Name, email address, phone number, and shop/company details you provide at sign-up.
• Authentication credentials (managed by our identity provider; passwords are never stored in plain text).
• Subscription and billing records: plan, transaction identifiers, amounts, currency, and payment status.
• Operational and audit logs related to your account and configuration.

2.2 From a shop’s customers (uploaders)

• The document files you choose to upload, and their metadata (file name, type, size, page estimate).
• Print preferences (copies, colour, duplex, page range, paper size, instructions).
• Any name or phone number you optionally provide for order collection. These fields are optional unless the shop configures otherwise; we do not require government identification to upload a document.
• A consent record showing that you accepted the applicable privacy notice and policy version.

3. Why we process it (purpose and legal basis)

• To create and manage shop accounts, and to provide, secure, and support the service.
• To receive, store temporarily, and make documents available to the correct shop for printing.
• To process subscription payments and maintain billing history.
• To detect abuse, prevent fraud, and maintain platform security and audit logs.
• To comply with our legal obligations.

For customer documents, our processing is carried out on the instructions of the shop (the data fiduciary), based on the consent or other lawful basis the shop relies on. We obtain your consent for the processing described in the notice shown at upload.

4. How long we keep data

Uploaded documents are deleted by a scheduled job after the retention window configured for that shop — by default 24 hours after the order is marked completed, and never longer than a hard ceiling of 7 days. The scheduled job removes the stored object and its metadata. We do not claim instant or total erasure: deletion from encrypted backups is delayed and limited, and backup copies are overwritten or expire on the backup rotation schedule. See the Retention Policy for details.

Account, billing, and audit records are kept for as long as your account is active and for a further period required for legal, tax, and accounting purposes:8 years .

5. Who we share data with

• The relevant shop — so it can print the documents you submitted to that shop. Documents are made available only to the shop that owns the upload link.
• Razorpay — our payment processor for subscription payments. Payment credentials such as card numbers and UPI PINs are entered on Razorpay’s systems and are never stored by CopyQR; we receive and store only transaction identifiers, amounts, and payment status.
• Infrastructure and hosting providers — including cloud database, storage, and hosting providers used to run the service.
• Professional advisers and authorities — where required by law or to establish or defend legal claims.

We do not sell personal data. A current list of sub-processors, with locations, is available on request .

6. Your rights (DPDP Act, 2023)

Subject to applicable law and verifying your identity and authority, you may:

• Access — request a summary of the personal data we process about you.
• Correction — request that inaccurate or incomplete data be corrected or updated.
• Erasure — request deletion of your personal data, where we are not required to retain it.
• Grievance redressal — raise a complaint with our grievance officer and receive a response within the period required by law.
• Nominate — nominate another individual to exercise your rights in the event of death or incapacity.
• Withdraw consent — withdraw consent at any time; this does not affect processing already carried out.

Where you are a customer and the shop is the data fiduciary for your uploaded document, requests concerning that document will be actioned on the shop’s instructions.

7. Consent and the upload notice

Before you upload a document, we show a notice explaining the purpose (printing your order), who will see it (the shop you selected), and the retention period. Your acceptance is recorded together with the policy version you agreed to. You should not upload documents you do not have the right to share.

8. Security

We use HTTPS in production, private document storage, short-lived authorised download links, server-side access control, and audit logging. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We do not claim any certification or “full compliance”.

9. Children

The platform is intended for use by adults. We do not knowingly process the personal data of children without the verifiable consent of a parent or lawful guardian as required by the DPDP Act.

10. Grievance officer

Grievance Officer for privacy matters:creatorhub.apps . Response timelines and escalation are described in the Contact page.

11. Changes to this policy

We may update this policy. Material changes will be notified to shop owners, and the “last updated” date above will change. Continued use after an update means you accept the revised policy.

This page is a first draft and is not a substitute for review by a qualified Indian legal professional. See docs/legal-review-checklist.md.