Privacy Policy
Effective: 1 January 2026
1. Who we are and scope
Luvox (Luvox) runs the service. For information about your account and use of the workspace, we decide why and how it is used. For information about people who scan or respond to the codes you publish (scan analytics, feedback answers, enquiry forms), you decide why it is used and we process it on your behalf.
If you scanned a code and landed on a page, the organization that published the code is responsible for that page and its notice.
2. Information we collect
- Account: name, email address or phone number, organization name, role, and settings you enter in your profile.
- Workspace content: QR code details and destinations, folders, designs, uploads such as logos, bulk-upload files, feedback form definitions, and integration settings.
- Scan analytics for managed codes: time of scan, which code, operating system and browser category, the origin of the referring page where provided, approximate country and city when location lookup is enabled, and a salted hash of the IP address used to count unique scans. We do not store the raw IP address in scan records.
- Feedback and enquiry responses submitted through hosted forms: the answers a visitor chooses to give, and any contact details they choose to provide with explicit consent.
- Billing: plan, payment and refund status, amounts, currency, billing country and Razorpay identifiers. Card details are entered with Razorpay and are not stored by us.
- Sponsor sessions on the free plan: which sponsor card was shown or clicked, and when. No form content is recorded.
- Technical and security data: sign-in events, rate-limit counters and error logs.
3. How we use information
- To create and operate your account and workspace, and to resolve managed codes to their destinations.
- To produce scan reports, exports and weekly summaries you ask for.
- To process payments, prevent fraud and meet tax and accounting duties.
- To keep the service secure, enforce the Acceptable Use Policy and fix problems.
- To improve the product using aggregate counters, but only after you click to allow usage measurement.
We do not sell personal data.
4. What scan analytics do and do not tell you
Unique scans are counted per code per UTC day using the hashed IP address and a normalized operating system and browser. This is not a count of people. Location is approximate and may be unknown. We do not claim to identify individuals from scans.
5. Cookies and similar technologies
We use a small number of cookies and browser storage items. Details are in the Cookie Policy.
6. Who we share information with
- Hosting and infrastructure providers that run the service.
- Our authentication provider and message-delivery services, to verify your email or phone.
- Razorpay, to process payments.
- An IP location provider, when location lookup is enabled, which receives the visitor's IP address to return an approximate location.
- Google, only if you connect Google Sheets or similar integrations, and only for the data you choose to send.
- Professional advisers, and authorities when the law requires it.
These providers may only use the information to provide their service to us.
7. How long we keep information
- Account and workspace data: while your account is active, and for a short period after closure to complete deletion and resolve disputes.
- Scan records: workspace owners can set a retention period for raw scan records and for aggregates; records past the period are purged.
- Feedback answers: each form has its own retention, from 7 to 365 days. Export what you need before it expires.
- Billing and tax records: for as long as the law requires.
- Backups: deleted data may persist in backups until they are overwritten on their normal cycle.
8. Your rights
Subject to applicable law, including India's Digital Personal Data Protection Act, 2023, you can ask us to give you a summary of your personal data and who it has been shared with, correct or complete it, erase it, withdraw consent, and nominate another person to exercise your rights if you die or cannot act. You can also raise a grievance with our grievance officer, listed below, and if unsatisfied, with the Data Protection Board of India once it is operational.
To make a request, email grievance@luvox.in from the address on your account. We may need to verify your identity. If your information is in a workspace owned by someone else, we may direct your request to that organization.
9. Children
The service is for people aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has given us data, contact us and we will delete it.
10. Security
We use technical and organizational measures described on our Security page. No system is completely secure, and we cannot guarantee absolute security.
11. Where information is processed
Our providers may process information in India and in other countries. Where the law requires safeguards for such transfers we apply them.
12. Changes
We will post updates here with a new effective date and notify you of material changes.
13. Contact and grievance officer
Luvox, Hyderabad, Telangana, India. Grievance officer: Grievance Officer, grievance@luvox.in.