qrmake.co: Product Privacy Notice
Passiko Labs Private Limited · qrmake.co
Last updated: 19 October 2026
1. About this notice
qrmake ("qrmake") is a free QR code generator at qrmake.co, run by Passiko Labs Private Limited ("Passiko", "we", "us"), registered office 543, Shivaji Nagar Road, Near Old Fire Station, Shivaji Nagar, Nanded, Maharashtra 431602, India.
This notice explains what qrmake does with personal data. It adds to our main Privacy Policy, which covers your Passiko account, sub-processors, security, cookies, children and your rights in full. If the two differ on something specific to qrmake, this notice applies.
Under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), Passiko is the Data Fiduciary for the data described here.
Our promises, and how they show up in this notice:
- No ads, and no ad tracking. qrmake shows no ads and uses no advertising cookies.
- No surprise charges. Static codes are free. Paid plans are monthly or yearly, or a one-time Event code; paid plans cancel in one click, and we email you 7 days before any renewal.
- Codes never stop working because of money. A code is never switched off because a plan ends or a payment fails. A code stops only if you delete it, if an unpaid inactive account is cleaned up (section 9), or if it breaks our Terms (section 11).
2. Static QR codes: no account, nothing sent to us
Static codes are drawn in your browser. The text you type (for example a link, UPI ID, Wi-Fi password or contact card) and any logo image you add are not sent to our servers and are not stored by us. You do not need an account.
3. Dynamic QR codes: what we store
A dynamic code prints a short link (qrmake.co/r/<code>) that redirects to a web address you can change later. To create one, you sign in with your Passiko account at accounts.passiko.com. qrmake does not run its own sign-up form.
| Data | Why we need it |
|---|---|
| Your Passiko account ID (linked to the email or Google profile you sign in with) | To know which codes are yours |
| The name you give each code | To show it in your dashboard |
| The destination web address | To send people who scan the code to it. This is how editing works |
| The short-link code, and created/updated times | To run the redirect |
Any logo image you add to a dynamic code is also processed in your browser and is not uploaded to our servers.
The free plan includes 3 dynamic codes. They do not expire.
4. Scan statistics: what we record when someone scans a dynamic code
When a person scans a dynamic code, we record one scan entry in our own database (Supabase, hosted in Mumbai, India) so the code's owner can see how it is performing:
| Recorded | Not recorded |
|---|---|
| Time of the scan | IP address |
| Device type (mobile, tablet, desktop, other) | Full browser "user agent" text |
| Operating system and browser name | Cookies. The redirect sets none |
| Country and city, worked out by our host (Vercel) from the network connection | Any fingerprint or cross-site identifier |
| Scans by obvious bots or empty browsers (they are redirected but not counted) |
The owner of the code sees these statistics as totals and charts (time, device, country, city). We do not try to identify the people who scan, and we do not use scan data for advertising or sell it.
Because we keep no IP address, cookie or identifier, we cannot link a scan back to a particular person.
Why we record scans. We record scans to provide scan statistics to the code's owner, as part of the service they signed up for (a legitimate use, and our agreement with the code owner). Our Terms of Service ask code owners to tell their audience that scans of their dynamic codes are counted.
IP addresses. Our host, Vercel, briefly handles the scanner's IP address to deliver the request, keep the service secure, and work out the approximate country and city. We do not store IP addresses. Vercel keeps its standard request logs for a few days only, and we do not send these logs anywhere else or keep them longer.
5. Analytics on the qrmake website
If you accept analytics cookies in our consent banner, we use PostHog (see the main Privacy Policy) to learn which features are used. For qrmake these events record only the kind of code (for example "Wi-Fi" or "link"), the download format, and simple actions such as "dynamic code created". They never include the text inside a code, a destination address, or a short link. If you refuse, no analytics run.
6. Cookies on qrmake
| Where | Cookies |
|---|---|
| Scan redirect (qrmake.co/r/…) | None |
| Static code generator | Analytics cookies only if you accept them |
| Signed-in dashboard | Essential sign-in cookies, to keep you logged in |
7. Payments
- Payments are processed by Razorpay. You enter card, UPI, net-banking or wallet details directly with Razorpay. Your card details never reach us. We receive only what we need to confirm the payment, such as a payment ID, amount, status and method type.
- Plans may be monthly or yearly. You can cancel in one click, and we email you 7 days before each renewal.
- Refunds are covered by our Terms of Service and Refund Policy.
- If a plan ends, your dynamic codes keep redirecting. Only creating and editing codes pauses.
We use your email address to send receipts and renewal reminders. These are service emails, not marketing.
8. Who else sees this data
We do not sell qrmake data. We use the providers already listed in the main Privacy Policy, section 5:
- Vercel: hosts qrmake and handles every request, including redirects.
- Supabase: stores dynamic codes and scan statistics in India (Mumbai).
- PostHog: website analytics, only after you consent.
- Razorpay: payments.
The person who owns a dynamic code sees the scan statistics for that code. People who scan a code are sent to the owner's destination website, which has its own privacy practices. We are not responsible for them.
9. How long we keep it
| Data | How long |
|---|---|
| Static code content | Never stored by us |
| Dynamic codes (name, destination, short link) | Until you delete the code, you delete your account, or the account becomes inactive (see below). Codes do not expire. They keep working for as long as they are being scanned |
| Detailed scan entries (section 4) | 24 months from the scan. After that we keep only daily totals for each code (for example, the number of scans per day), which do not describe individual scans |
| Daily scan totals | As long as the code exists, and deleted with it |
| Abuse reports | 2 years after the report is closed |
| Billing, invoice and payment records | For as long as Indian tax and company law requires, even after account or data deletion |
| Deleted data in backups | Removed within 30 days (same as the main Privacy Policy) |
When you delete your account. If you delete your qrmake data or your Passiko account, we delete that account's dynamic codes and all their scan data within 30 days. During that time, anyone scanning those codes sees a neutral "this code is no longer active" page.
Inactive accounts. If an account has had no sign-in and no scans on any of its codes for 24 months, and has never paid for a qrmake plan or Event code, we email the owner. If they do not tell us within 30 days that they want to keep it, we may delete that account's dynamic codes and scan data. A code that is still being scanned is never deleted for inactivity. Paid Event codes, and any account that has ever paid, are exempt from this cleanup, so a paid Event code's lifetime redirect holds.
Billing records are kept separately. Billing, invoice and payment records are not code or scan data. We need them for GST and tax law, so we keep them after you delete your account or your qrmake data, for as long as Indian tax and company law requires.
10. Your rights and controls
You have the rights listed in section 9 of the main Privacy Policy. For qrmake:
- Access: your dashboard shows every dynamic code, its destination and its scan statistics. You can also ask us for a summary.
- Correct: edit a code's name or destination at any time in the dashboard.
- Erase: delete a single code, or use Account → Delete to delete all your dynamic codes and their scan statistics (completed within 30 days, see section 9). Before you do, you can download each one as a static code so printed copies keep working. Printed copies of a deleted dynamic code stop redirecting. Deleting your qrmake data does not delete your Passiko account, which you may use for other Passiko products. To delete that too, email legal@passiko.com.
- Withdraw consent for analytics at any time through the consent banner.
- If you scanned a code: we hold no data that identifies you, so we usually cannot find "your" scans. You can still contact us with any question.
To make a request, email legal@passiko.com from your account email with the subject "Privacy request". We may need to verify your identity.
11. Reporting a harmful code
If a qrmake code leads somewhere harmful (for example a scam or malware), report it at qrmake.co/report or email support@passiko.com. We use the report, and any contact details you include, only to investigate. We may disable a code that breaks our Terms of Service. We keep abuse reports for 2 years after they are closed.
12. Grievance Officer and contact
- Grievance Officer: Akshay Jondhale, Director & CEO
- Email: legal@passiko.com
- Address: Passiko Labs Private Limited, 543, Shivaji Nagar Road, Near Old Fire Station, Shivaji Nagar, Nanded, Maharashtra 431602, India
We acknowledge grievances within 48 hours and resolve them within 15 days. If you are not satisfied, you may complain to the Data Protection Board of India.
General qrmake help: support@passiko.com.
See also our Terms of Service, Refund Policy, and the main Passiko Privacy Policy.