Privacy Policy

Customers: your name, email address and profile photo from your Google account when you sign in, and your loyalty activity: the shops you joined, stamps, rewards, scratch cards and the times you used them.

Businesses: the owner’s name and email address from Google sign-in, the business name, address, branches, logo, menu, rewards and settings, a mobile number given at checkout (our payment partner needs it), and billing records such as plan, amount, date and payment reference.

Contact form: the name, phone number, email, business name, city and message you type in.

Everyone: technical details sent by your browser, such as IP address, browser and device type, and the date and time of requests. We record these with each QR scan to detect fraud.

We do not collect your precise location, contacts, photos or payment card details.

To sign you in and keep you signed in.

To run loyalty programs: add stamps, unlock rewards, issue scratch cards and check redeem codes.

To show each Business its own program activity and statistics.

To prevent fraud and abuse, for example spotting repeated scans or misuse of a QR code.

To take payments, keep billing records and meet legal and tax obligations.

To send service emails Businesses have chosen, such as a daily summary, and to reply to messages you send us.

We do not sell personal data and do not use it for advertising.

A Business sees the Customers who joined its program: their name, email address and their stamps, rewards and visits with that Business only. It never sees your activity at other shops on First QR.

A Business may download this list to run its own program. Once downloaded, the Business is responsible for that copy.

Google, to let you sign in with your Google account.

Cashfree Payments, to process plan payments. Card, UPI and bank details are entered on Cashfree’s secure page and are not shared with us.

Our hosting and email providers, who store data and send emails for us under confidentiality obligations.

Authorities, where the law requires it, or where needed to protect people or prevent fraud.

If the business behind First QR is merged or sold, data may pass to the new owner under this policy.

We use only the cookies needed for the service to work: one to keep you signed in and one that protects forms from forgery (CSRF). Your browser may also store small settings, such as a collapsed menu.

We do not use analytics, advertising or tracking cookies. If we add them in future, we will update this policy first.

We keep your data while your account is open.

When you delete your account, your profile, cards, stamps and rewards are deleted straight away. QR scan logs are kept for fraud checks without your name or account, holding only the IP address, browser type and time of each scan.

When a Business deletes its account, its business details, branches, programs, menu, uploaded images and its Customers’ cards for that business are deleted. Payment records are also kept by Cashfree for as long as the law requires.

Contact form messages are kept for as long as needed to answer them and follow up.

You can see and download your data at any time: Customers from Profile, Businesses from the Privacy page of the dashboard.

You can correct your details, withdraw consent by deleting your account, and ask us to delete your data. You can also nominate someone to use these rights for you if you are unable to.

To use any right, or to complain, contact our Grievance Officer below. If you are not satisfied with our reply, you can complain to the Data Protection Board of India.

Data travels over encrypted (HTTPS) connections. Access to personal data inside our team is limited to people who need it to run and support the service, and admin actions are logged.

Redeem codes are short-lived and stored only in hashed form. No system is completely secure, so if you think your account has been misused, tell us straight away.

The service is meant for adults. We do not knowingly collect data from children under 18 without the consent of a parent or guardian. If you believe a child has signed up, contact us and we will delete the account.

If we change this policy, we will update the date at the top. For significant changes, we will tell signed-in users before they take effect.

First QR runs this service. For questions, requests about your data, refunds or complaints, contact our Grievance Officer. We acknowledge complaints within 48 hours and aim to resolve them within 30 days.