QRakshak · Legal
Sub-processors
Effective: 29 October 2026 · Version 2.1 · Operated by ThinkAIQ LLP
In short: We use a small set of vetted providers for hosting, email, push and masked calls. They process data only on our instructions. We do not sell data and we do not use advertising processors.
ThinkAIQ LLP uses the processors below to run the Service. We require each processor to be bound by confidentiality, security safeguards, breach notification and processing only on our documented instructions (through the provider's DPA or our own). The list covers the platform; a white-label partner may have additional processors under its own DPA.
1. Current processors
| Provider | Purpose | Data received | Location |
|---|---|---|---|
| Cloudflare | Website/API edge, CDN, rate limiting, DNS | Request metadata, IP address (hashed in our logs), security events | Global edge network |
| Railway | Application hosting (API/web) | Application data in transit, service logs (PII-minimised) | As configured for the deployment |
| Neon | Primary PostgreSQL database | Account, QR, contact and alert records (sensitive fields encrypted) | Database region configured in our infrastructure (may be outside India) |
| Resend | Transactional email (alerts, OTP, notices) | Recipient email, subject and message content | United States / global infrastructure |
| SendGrid or an SMTP relay | Email failover (only when configured) | Recipient email, subject and message content | As configured |
| Plivo | Masked call session and virtual number | Destination phone number (server-side), call metadata; never the full contact list | India and United States (provider infrastructure) |
| TeleCMI | Masked call bridging — fallback after Plivo | Destination phone number (server-side), call metadata | India |
| TellyCaller / Exotel / Knowlarity | Voice failover (only when enabled) | Destination phone number (server-side), call metadata | India |
| MSG91 / Fast2SMS / Twilio | SMS failover (only when enabled) | Recipient phone number and message | India / United States |
| Google Firebase Cloud Messaging (FCM) | Android push notifications | Push token, notification title/body and alert IDs | Global |
| Apple Push Notification service (APNs) | iOS push notifications | Push token, notification title/body and alert IDs | Global |
| Expo / EAS | Mobile build and over-the-air update delivery | App bundle and build metadata (no user profile data) | Global |
| Google Play / Apple App Store | App distribution, crash and install metadata | App install and crash data as controlled by the store | Global |
| Bank / payment provider | Payment processing and settlement (when used) | Name, amount, payment reference, GSTIN if provided; we do not store card numbers | India |
2. What processors do not get
- Your PIN, OTP or password (we store only one-way hashes and never share them).
- Your full contact list, SMS, call logs, microphone audio or background location.
- Advertising identifiers — we do not collect them.
- A raw phone number in logs or analytics. Telephony providers get the destination number only to connect the call.
3. Cross-border transfers
Some processors operate outside India. We transfer data only as permitted by the DPDP Act and any restricted-country notification, with contractual safeguards. Security logs are kept in line with CERT-In directions. You can ask for the current location of a specific processor by emailing contact@thinkaiq.com.
4. Changes
We may add or replace a processor. For a material change we will update this page at least 30 days before the change takes effect, and notify white-label partners under their DPA. If you have a legitimate data-protection objection, contact us and we will discuss an alternative. If we cannot resolve it, you may stop using the Service and request deletion.
5. Partner and school deployments
A white-label partner or school may be the Data Fiduciary for its users and we act as its Data Processor. In that case the partner's DPA and sub-processor list also apply. Our template is available to partners on request; it covers roles, security, breach notice, audit, deletion and exit.
6. Contact
Privacy: contact@thinkaiq.com
Grievance: contact@thinkaiq.com
ThinkAIQ LLP · 2nd Floor, C/O Vidya Devi, Vidya Bhawan, Ashok Nagar, Kankarbagh, Patna, Bihar - 800020
Contact & grievance officer
Akash Kumar (Grievance & Data Protection Officer)
Email: contact@thinkaiq.com
Acknowledgement within 1 day · resolution within 15 days.
If you are not satisfied with our response, you may complain to the Data Protection Board of India under the DPDP Act 2023. Data requests: /legal/data-request. Security reports: contact@thinkaiq.com.
2nd Floor, C/O Vidya Devi, Vidya Bhawan, Ashok Nagar, Kankarbagh, Patna, Bihar - 800020 · These documents are provided in English; translations of the privacy notice are available on request and will be published before a language is offered in the app.