Privacy Policy

This Privacy Policy explains how ThinkAIQ LLP (“QRakshak”, “we”, “us”) processes personal data when you use the QRakshak website, the QR Safety mobile app, printed QR products, and related services (together, the “Service”). It is a notice under section 5 of the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and is written to be read together with the DPDP Rules, 2025.

Who is responsible: ThinkAIQ LLP is the Data Fiduciary for the Service. For white-label deployments, the partner brand is the Data Fiduciary for its customers and we act as its Data Processor under a separate data processing agreement.

How to read this notice: this notice is published in English. If you prefer any language listed in the Eighth Schedule to the Constitution of India, write to contact@thinkaiq.com and we will provide the notice (or the relevant parts of it) in that language, free of cost, as required by section 5(3) of the DPDP Act.

1. Summary — the short version

• We collect the details you type into a QR profile, your account details, and the fact that a QR was scanned.
• We use that data to show a helper what they need in an emergency, to send alerts, and to connect a masked call.
• We do not sell personal data, run advertising, or use advertising identifiers.
• We do not collect background location, your contacts, SMS, call logs, or microphone audio.
• You can withdraw consent, access, correct, export or delete your data. A child's profile requires verifiable guardian consent.

Our DPDP status: we are a Data Fiduciary under the DPDP Act. We have not been notified as a Significant Data Fiduciary; if that changes we will additionally appoint an independent data auditor, carry out a data protection impact assessment, and run periodic audits as the Act requires.

2. Personal data we collect

We follow data minimisation: if a field is not needed for safety, we do not ask for it. The table below is the complete list of categories we process.

2.1 What we do NOT collect

• No background location. GPS/coarse location is requested only when you actively tap “Share my location” during an alert; it is never collected in the background.
• No contacts, SMS, call logs or microphone audio. The app blocks these permissions.
• No advertising identifier and no advertising or behavioural-tracking SDK.
• No photos beyond the one you upload to a QR profile (camera is used only when you choose to scan or upload).
• No call recordings are requested or stored by the Service. If a provider offers call recording, we require it to be disabled for our account. Telephony providers process call metadata to connect a masked call; they do not receive your full contact list.
• No children's behavioural data. Child and student profiles are used only for safety and emergency response.

2.2 Where the data comes from

• From you: account details, QR profile fields, emergency contacts and support messages. When you add an emergency contact, you confirm you have informed them and have any consent the law requires; we use their details only to send the alerts/calls you trigger.
• From a guardian or school: a child/student profile and guardian contact details, where they create or manage the profile.
• Automatically: scan timestamps, hashed IP, browser/user-agent, delivery status and push token.
• From providers: call/SMS/email delivery status and error codes (no message content is read by us).

3. Why we process it (purposes) and our lawful basis

Under the DPDP Act we process personal data on the basis of your consent (section 6) and, where applicable, the legitimate uses listed in section 7 (for example, responding to a medical emergency, complying with a legal obligation, or protecting safety during a disaster or public-health event).

• Provide the Service: create your account, display the helper page, generate QR codes, and let you edit or delete your data.
• Emergency response: send family alerts by email, push and phone; connect a masked call; show a 112 dial intent.
• Safety and abuse prevention: rate limiting, fraud prevention, device binding, and investigating misuse such as stalking or bulk scanning.
• Legal compliance: invoices and tax records, responding to valid legal requests, and incident reporting.
• Service communications: security notices, material policy changes, and (only with separate consent) product updates. We do not send promotional messages to child profiles.
• Improvement: aggregated, de-identified usage statistics. We do not use personal data for advertising or sell it.
• No automated decisions: we do not make automated decisions that produce legal or similarly significant effects about you. Alerts are triggered by a human action, not by profiling.

We do not process personal data for any new purpose without a fresh notice and, where required, fresh consent. We do not use dark patterns: refusing optional consent is as easy as giving it.

4. Consent, notice and withdrawal

• Notice before collection: this policy and the in-product notices describe each field and purpose before you submit it.
• Granular choices: optional fields (for example, a photo or medical note) can be left blank; optional communications are opt-in.
• Record: we record the notice version (2026-10-29.v3), time, purpose, method and a hashed IP for consent given through the Service. For child/student profiles the guardian's consent method and reference are recorded.
• Withdrawal: you can withdraw consent at any time from the app (QR settings → delete/withdraw) or by writing to contact@thinkaiq.com. Withdrawal is as easy as giving consent. We stop processing within 30 days unless we must keep the data to comply with law or establish/defend a legal claim.
• Consent Manager: where a Consent Manager registered with the Data Protection Board of India is available, you may also give, manage and withdraw consent through that Consent Manager. We will publish the integration on this page when it is live.
• Consequences: if you withdraw consent for data that is essential to a QR, we may have to deactivate that QR. We will tell you before doing so.

5. Children and students

The Service is designed for adults to create and manage safety profiles. You must be at least 18 years old to hold an account. Child and student profiles may be created by a parent, guardian, or an authorised school only.

• Verifiable parental consent: before a child or student profile is activated we require a guardian consent record. Self-service activation uses a 6-digit code sent to the guardian's email (10-minute expiry, 5 attempts); only an HMAC hash of the code is stored, and the verified token is consumed once. School enrolments use the school's verified enrolment/guardian reference. The QR record stores the consent method, notice version, server timestamp and a unique consent reference — never the raw guardian phone number in the audit log.
• No tracking or targeted advertising: we do not track children, monitor their behaviour, or serve targeted advertising to them (DPDP Act section 9).
• No harmful processing: child data is used only for safety, identification in an emergency, and the guardian/school relationship.
• School model: where a school collects and manages student data, the school is responsible for obtaining guardian consent unless we have agreed in writing that we will do so. The limited education/health exemption in section 9(4) is applied only where its conditions are actually met.
• Guardian controls: a guardian can review, correct, export or delete a child's profile at any time, and can withdraw consent.

6. Who we share data with

We do not sell personal data. We share only what is necessary with processors acting on our instructions, under contracts that require confidentiality, security and DPDP-compliant processing. The current list, with purposes and locations, is published at /legal/sub-processors.

• Hosting and database: Cloudflare (edge/CDN, rate limiting) and Railway (application hosting); Neon (PostgreSQL database).
• Email alerts: Resend; fallback SMTP/SendGrid when configured.
• Masked calls: Plivo and TeleCMI (primary providers), with TellyCaller/Exotel/Knowlarity as failover when enabled.
• Push notifications: Google Firebase Cloud Messaging (FCM) and Apple Push Notification service (APNs).
• Payments and invoicing: our internal ledger and the bank/payment provider used for a transaction; we do not store full card numbers.
• Professional advisers and authorities: auditors/lawyers under confidentiality; law enforcement, courts or regulators only on a valid legal request or where required by law.
• Business transfer: if the business is merged or sold, data may transfer to the successor under this policy; we will notify you.

Telephony providers receive the destination phone number server-side to complete a masked call. The helper and the owner see only the provider's virtual/masked number — never each other's real number. In the woman-safety category, masking is mandatory and a direct-number fallback is locked off. For other categories, if every masked provider fails and the platform has enabled an emergency direct-dial fallback, the helper's dialer may open the family number directly; this fallback is off by default.

7. Cross-border transfers

Some processors (for example Cloudflare, Railway, Neon, Resend, Google and Apple) may process data outside India. We transfer personal data only as permitted by the DPDP Act and any restricted-country notification issued by the Central Government. Where required, we use contractual safeguards and keep security logs in line with CERT-In directions. You can ask us for the current location of each processor at contact@thinkaiq.com.

8. How long we keep data

• QR profiles and contacts: for the life of the QR, plus up to 90 days after expiry/archival so a renewal or dispute can be handled.
• Scan logs: 180 days. Alerts, deliveries, notifications: 365 days.
• Audit and security logs: at least 180 days (CERT-In), then deleted unless a legal hold applies.
• Account data: deleted within 30 days of a verified request, except records we must keep by law (for example tax invoices for 8 years).
• Backups: encrypted backups rotate out within 30 days; deletion propagates as backups expire.
• Legal hold: if a claim, investigation or legal obligation requires it, we may retain specific records for longer and will limit access to them.

We do not keep personal data longer than necessary for the purpose for which it was collected. Our retention rules are enforced by scheduled deletion jobs, not only by policy.

9. Security

We use reasonable technical and organisational safeguards as required by section 8(5) of the DPDP Act, including:

• TLS in transit. Dedicated phone/contact columns and recoverable QR tokens are encrypted with AES-256-GCM. Sensitive QR profile fields (guardian/emergency phone numbers, medical notes, allergies, safe word, pickup person, conditions) are also encrypted at field level with AES-256-GCM; names/class/serial stay plaintext so dashboards and school lists can operate. Profile photos rely on database/backup encryption at rest (not individual field-level encryption) because of their size. All QR profile fields are access-controlled and masked in the helper view.
• PINs and security answers stored as one-way PBKDF2-SHA256 hashes; OTPs stored as HMAC hashes.
• Row-Level Security and tenant scoping so one customer cannot read another customer's data.
• Role-based access, least privilege, device binding, rate limiting and audit logging.
• Secrets kept in the deployment environment, never in the repository or logs.
• Incident response with containment, rotation, CERT-In reporting and post-incident review.

No system is perfectly secure. If you find a vulnerability, please report it to contact@thinkaiq.com — see /legal/security.

10. Personal data breaches

If a personal data breach occurs, we will contain it, assess the risk, and notify the Data Protection Board of India and each affected Data Principal without delay, in the form and manner prescribed under the DPDP Act and Rules. We will also report cyber incidents to Indian Computer Emergency Response Team (CERT-In) within the timelines required by its directions. Our internal target is to complete initial assessment and intimation decisions within 72 hours of detection.

11. Your rights

As a Data Principal you have the right to:

• Access a summary of the personal data we process, the purposes, and the identities of the processors we share it with.
• Correct inaccurate or incomplete data, and complete missing data.
• Erase data that is no longer necessary, subject to legal retention obligations.
• Withdraw consent at any time.
• Grievance redressal — a readily available grievance officer and a time-bound response.
• Nominate another person to exercise your rights in the event of death or incapacity.

Requests are free. Submit them from the email/phone registered to your account (or give us enough information to verify you) at contact@thinkaiq.com or through /legal/data-request. We acknowledge within 1 day and resolve within 15 days. We may ask for verification and will not charge a fee unless a request is manifestly unfounded or repetitive.

If we refuse a request, we will explain why and tell you how to complain to the Data Protection Board of India. Nothing in this policy limits any right you have under Indian law.

12. Cookies and similar technologies

We use only strictly necessary cookies for sign-in, session refresh, CSRF protection and partner branding. We do not use advertising cookies, cross-site tracking pixels, or third-party analytics that profile you. See /legal/cookies for the exact cookie names, purposes and lifetimes.

13. Marketing

We do not send marketing to child profiles. You can opt out of product updates at any time; we will still send essential service and security notices (for example, a material change to this policy or a security incident affecting your account).

14. Third-party links and integrations

The Service may link to third-party sites (for example, app stores or a partner). Their privacy practices are their own; read their policies. We do not control their processing.

15. Changes to this policy

We may update this policy. For material changes we will publish the new version, update the effective date and version number, and give at least 30 days' notice in the app or by email before the change takes effect. Where the change is based on consent, we will ask for fresh consent before applying it. The previous version is available on request from the Grievance Officer.

16. Contact us

Data Fiduciary: ThinkAIQ LLP
Akash Kumar (Grievance & Data Protection Officer)
Email: contact@thinkaiq.com
Grievance: contact@thinkaiq.com
Security: contact@thinkaiq.com
2nd Floor, C/O Vidya Devi, Vidya Bhawan, Ashok Nagar, Kankarbagh, Patna, Bihar - 800020

If your complaint is not resolved to your satisfaction, you may contact the Data Protection Board of India. You can also read our Grievance Redressal Policy and Data Rights pages.