DPDP Act 2023 & Security Standards

Privacy Policy

How MyLuckyQr collects, stores, processes, and protects your personal phone numbers, business details, in-store scan visits, and wallet transactions.

Last Updated: October 2026Digital Personal Data Protection Act, 2023ISO/IEC 27001 Aligned

Zero Data Selling

Your phone number, scan history, and purchase details are never sold or rented to third-party ad brokers.

In-Store Verification Only

Location telemetry is strictly used to confirm legitimate physical presence at store counters for scan validity.

Complete User Control

Full rights under DPDP Act 2023 to export your data, revoke communication consent, or permanently delete your account.

1. Privacy Commitment & Scope

Data Principles

Our core pledge to protect customer and merchant information under Indian DPDP Act 2023.

At MyLuckyQr ("we", "us", "our"), we are deeply dedicated to maintaining the trust of our customers, participating merchants, and application visitors. This Privacy Policy details how we collect, store, process, and safeguard your personal information across our website, web application, QR scanning interfaces, and loyalty software.

We process personal data in strict alignment with the Digital Personal Data Protection Act, 2023 (DPDP Act, India), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and globally accepted privacy standards.

Our Core Data Pledge: We never sell, rent, or trade your personal mobile number, visit records, or private purchasing data to third-party advertising brokers or data harvesters.

2. Information We Collect

Data Collection

Specific personal, business, and visit attributes collected across user roles.

We collect only the data necessary to provide seamless QR loyalty experiences, verify genuine in-store visits, and execute secure reward redemption:

A. For Customers

Phone & WhatsApp Number: Verified via OTP for account identity, digital wallet mapping, and receipt delivery.
Profile Details: Full name, profile avatar, optional birthday (dateOfBirth for milestone perks), and referral code.
Visit Records: Store ID, scanned QR token, visit timestamp, recorded purchase amount, and claimed rewards.

B. For Businesses / Merchants

Business Credentials: Business name, owner name, business ID (businessId), category, and GST number.
Location & Contact: Street address, city, state, postal code, GPS latitude/longitude (for customer store locator), phone, and official website.
Store Media: Shop logos, storefront photos, catalog menus, operating hours, and staff access accounts.

3. Device Data, Push Tokens & Technical Telemetry

Device & Telemetry

Browser headers, Firebase FCM push notifications, IP addresses, and anti-spoofing telemetry.

When you interact with MyLuckyQr via mobile or desktop browsers, our servers automatically collect technical telemetry to ensure system security and high performance:

Firebase Cloud Messaging (FCM Tokens): Web push notification tokens (fcmToken) are stored securely to notify you in real time when you win spin rewards or when your vouchers are about to expire.
IP Address & Geolocation: Used for geographic load balancing, session integrity, and verifying that QR scans originate within legitimate store proximity.
Device Fingerprints: Hashed hardware and browser user-agent tokens (deviceInfo) are utilized exclusively by our fraud prevention algorithms to detect device farm abuse.

4. How We Use Your Data

Data Purpose

Legitimate business purposes: reward assignment, wallet balances, fraud defense, and receipts.

We process your personal information strictly based on explicit user consent and legitimate service execution:

QR Scan & Spin Execution

Calculating spin probability, allocating discount vouchers, and generating single-use claim codes.

Wallet & Transaction Ledger

Maintaining INR wallet balances, crediting cashbacks, and logging sales and discount entries.

Loyalty Milestone Tracking

Counting qualified store visits to automatically unlock milestone rewards (e.g., 5th visit perk).

Merchant Billing & GST

Generating accurate GST tax invoices for merchant platform subscriptions and SMS/WhatsApp credits.

Anti-Fraud Defense

Detecting multi-account device farming, OTP brute force, and unauthorized remote scan emulation.

Customer Support & Grievances

Resolving voucher redemption disputes, merchant verification tickets, and technical support queries.

5. WhatsApp, SMS & Email Broadcast Rules

Messaging Consent

TRAI compliance, opt-in records, promotional vs transactional dispatches, and opt-out mechanisms.

MyLuckyQr facilitates communication between enrolled businesses and their verified patrons via WhatsApp, SMS, and Email:

Consent Basis: By registering your phone number to claim an in-store reward, you consent to receive transaction receipts and occasional loyalty updates from that specific visited merchant.
No Inter-Merchant Data Cross-Contamination: Your contact number is never shared with other merchants on MyLuckyQr without your explicit scan at their store.
Immediate Opt-Out: You can unsubscribe from promotional messages at any time via in-message STOP replies or through account preference toggles.

6. Payment Data & Razorpay Security

Payment Security

PCI-DSS compliance, tokenized card and UPI handling, and zero financial credential storage.

When merchants pay for platform subscriptions or recharge marketing campaign credits, financial transactions are routed through our RBI-authorized payment partner, Razorpay.

PCI-DSS Level 1 Security Protocol:

MyLuckyQr NEVER stores, views, or logs complete credit card numbers, debit card PINs, CVV codes, or UPI netbanking passwords on our application servers. All sensitive financial tokens are processed directly inside Razorpay's encrypted vault. We receive only transaction status IDs (razorpayPaymentId, razorpayOrderId) to update plan balances.

8. Anti-Fraud Monitoring & Device Protection

Security Guardrails

Automated fraud flags, multiple account device tracking, and defensive blacklisting.

To protect genuine store owners from syndicates and bot automation, MyLuckyQr maintains automated security monitoring:

Automated Fraud Indicators Monitored:

Multiple account signups originating from the same physical mobile device fingerprint.
Abnormal bursts of OTP verification attempts or automated script scans.
Scans performed from data center IPs, Tor exit nodes, or high-risk proxy tunnels.

Accounts flagged for fraud are placed on administrative review. Non-compliant accounts are blacklisted and reward claims are automatically invalidated.

9. Cookies & Client-Side Session Storage

Local Data

Essential session cookies, CSRF tokens, dark/light theme state, and client caching.

We use minimal, strictly necessary cookies and browser local storage mechanisms to provide a seamless user experience:

Authentication & CSRF Cookies: Cryptographically signed session tokens (authjs.session-token) and CSRF protection tokens to safeguard your account against cross-site forgery.
Theme & UI Preferences: Local storage flags to remember your dark mode / light mode selection across browser sessions.
No Invasive Ad Tracking: We do not deploy third-party advertising tracking cookies (such as Facebook Pixel or cross-site ad retargeting trackers).

10. Data Retention & Archival Schedules

Retention Policy

Retention schedules for OTP logs, visit histories, GST tax invoices, and inactive profiles.

Personal data is retained only for as long as necessary to fulfill the operational, loyalty, and statutory purposes for which it was collected:

OTP Verification LogsRetained 30 Days (auto-purged)

Active Customer Loyalty LedgersRetained for Account Lifetime

Merchant Financial & GST InvoicesRetained 8 Years (Indian Tax Law)

11. Your Privacy Rights (DPDP Act, 2023 & GDPR)

User Control

Right to access, correction, data export, account deletion, and withdrawal of consent.

Under the Digital Personal Data Protection Act, 2023 (DPDP Act) and international data protection regulations, you hold enforceable rights concerning your personal information:

Right to Access & Portability

Request a complete digital export of your visit history, earned rewards, and wallet ledger.

Right to Rectification

Update inaccurate phone numbers, names, or store listings directly in your account dashboard.

Right to Erasure ("Be Forgotten")

Request permanent deletion of your customer profile, OTP history, and notification tokens.

Right to Withdraw Consent

Revoke marketing broadcast permissions or stop push alerts at any time without penalty.

12. Data Protection Officer & Grievance Redressal

Grievance Redressal

Official contact channels for privacy concerns, data inquiries, and grievance escalation.

In compliance with the Digital Personal Data Protection Act, 2023, MyLuckyQr has appointed a dedicated Data Protection Officer (DPO) and Grievance Officer:

Designation: Data Protection & Grievance Redressal Officer

Entity: MyLuckyQr Inc. / Platform Security Operations

Email: privacy@myluckyqr.com

Physical Address: Tech Park, Outer Ring Road, Bangalore, Karnataka - 560103, India

Grievance inquiries are acknowledged within 24 hours and resolved within statutory timelines under applicable law.

Data Protection Officer

Exercise Your Data Rights

Have inquiries regarding your stored visit records, want to request an export of your data, or wish to permanently delete your account? Our privacy team responds within 24 hours.

privacy@myluckyqr.com+91 (800) 123-4567

Contact Privacy Desk Terms of Service