Privacy Policy

📄 Privacy Policy for VibeQR

Last Updated: August 18, 2026
Effective Date: August 18, 2026

 

1. Introduction

Welcome to VibeQR ("we," "our," or "us"), operated by Vibe Create Media LLP, based in Latur, Maharashtra, India. We are committed to protecting your privacy and ensuring the security of your personal data.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our review management platform at https://reviews.vibecreatemedia.in/ (the "Service").

By accessing or using VibeQR, you agree to the practices described in this policy. If you do not agree, please do not use our Service.

2. Information We Collect

2.1 Information You Provide Directly

We collect the following types of information when you register, subscribe, or interact with our Service:

  • Account Information: Name, email address, phone number, business name, business address, Google Business Profile ID

  • Payment Information: Credit/debit card details, billing address (processed securely through our payment processor; we do not store full card numbers)

  • Business Data: Google reviews, review responses, QR codes generated, customer contact information you upload for review requests

  • Communications: Support tickets, emails, chat messages, and feedback you send to us

2.2 Information Collected Automatically

When you use our Service, we automatically collect:

  • Usage Data: Pages visited, features used, time spent, IP address, browser type, device information, operating system

  • Cookies and Similar Technologies: We use cookies, web beacons, and local storage to enhance user experience, analyze traffic, and personalize content (see Section 9 for details)

  • Log Data: Server logs including timestamps, referring URLs, and error reports

2.3 Information from Third Parties

We may receive information from:

  • Google APIs: When you connect your Google Business Profile, we access review data, business information, and response capabilities per Google's API Terms of Service

  • Payment Processors: Transaction confirmation data from Razorpay, Stripe, or other payment gateways

  • Analytics Providers: Aggregated usage statistics from tools like Google Analytics, Mixpanel, or Hotjar

3. How We Use Your Information

We use the collected information for the following purposes:

Purpose Legal Basis (GDPR) Data Categories Used
Provide and maintain the Service Contract performance Account, Business Data
Process payments and subscriptions Contract performance Payment, Account
Send service notifications (updates, security alerts) Contract performance Email, Phone
Respond to customer support requests Legitimate interest Communications, Account
Improve product features and user experience Legitimate interest Usage Data, Analytics
Prevent fraud, abuse, and security threats Legitimate interest Log Data, IP Address
Comply with legal obligations Legal obligation All relevant data
Send marketing communications (with consent) Consent Email, Business Info

We do NOT:

  • Sell your personal data to third parties

  • Use AI to generate fake reviews (prohibited by Google's April 2026 policy)

  • Operate on-site review kiosks or tablets (prohibited by Google)

  • Set staff quotas for collecting reviews (prohibited by Google)

  • Engage in review gating (filtering negative reviews)

4. Data Sharing and Disclosure

We may share your information with the following third parties:

4.1 Service Providers (Data Processors)

  • Google LLC: For accessing and managing Google Business Profile reviews via official APIs

  • Payment Processors: Razorpay, Stripe, or PayPal for billing (they operate under PCI-DSS compliance)

  • Cloud Hosting: AWS, DigitalOcean, or similar providers for data storage

  • Email Services: SendGrid, Amazon SES, or Postmark for transactional emails

  • Analytics Tools: Google Analytics, Mixpanel for usage insights (data is anonymized)

  • Customer Support: Intercom, Zendesk, or WhatsApp Business API for support communications

All processors are bound by Data Processing Agreements (DPAs) and must comply with applicable data protection laws.complianceautomator+1

4.2 Legal Requirements

We may disclose your information if required by law, court order, or government regulation, including:

  • Compliance with Indian laws (Information Technology Act 2000, DPDPA 2023)

  • Response to lawful requests from law enforcement

  • Protection of our rights, property, or safety (and that of our users)

4.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of the transaction. We will notify you via email and/or prominent notice on our Service before any such transfer.

5. Data Retention

We retain your personal data only as long as necessary:

Data Type Retention Period Reason
Account Information Duration of active subscription + 3 years Service provision, legal compliance
Payment Records 7 years Indian tax law (Income Tax Act 1961)
Google Reviews & Responses Duration of subscription + 90 days Service functionality
Usage Analytics 24 months Product improvement
Support Tickets 2 years Customer service quality

You may request deletion of your data at any time (see Section 7). We will delete your data within 30 days of receiving a valid request, except where retention is required by law.dev+1

6. Data Security

We implement industry-standard security measures to protect your data:

  • Encryption: All data transmitted between your browser and our servers is encrypted using TLS 1.3

  • Access Controls: Role-based access, multi-factor authentication (MFA) for internal systems

  • Regular Audits: Quarterly security assessments and penetration testing

  • Data Backups: Daily encrypted backups stored in geographically separate locations

  • Incident Response: Documented breach notification process (we will notify you within 72 hours of discovering a breach affecting your data)complianceautomator+1

However, no method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

7. Your Data Protection Rights

Depending on your location, you may have the following rights:

7.1 GDPR (European Union/EEA)complianceautomator+1

  • Right to Access: Request a copy of your personal data

  • Right to Rectification: Correct inaccurate or incomplete data

  • Right to Erasure ("Right to be Forgotten"): Request deletion of your data

  • Right to Data Portability: Receive your data in a structured, machine-readable format

  • Right to Restrict Processing: Limit how we use your data

  • Right to Object: Object to processing based on legitimate interests

  • Right to Withdraw Consent: Withdraw consent at any time (where processing is consent-based)

7.2 CCPA/CPRA (California, USA)

  • Right to Know: Request disclosure of data collected, used, and shared

  • Right to Delete: Request deletion of personal information

  • Right to Opt-Out: Opt-out of sale or sharing of personal information

  • Right to Non-Discrimination: Receive equal service even if you exercise rights

7.3 DPDPA 2023 (India)

  • Right to Access: Know what personal data is being processed

  • Right to Correction & Erasure: Correct or delete inaccurate data

  • Right to Grievance Redressal: File complaints with our Data Protection Officer

  • Right to Nominate: Designate someone to exercise rights in case of death or incapacity

7.4 How to Exercise Your Rights

To exercise any of these rights, contact us at:

  • Email: privacy@vibecreatemedia.in

  • Address: Vibe Create Media LLP, Latur, Maharashtra, India

  • Response Time: We will respond within 30 days of receiving your requestdev+1

You may also be asked to verify your identity before we process your request.

8. International Data Transfers

VibeQR is operated from India. Your data may be transferred to and processed in countries other than your own, including:

  • United States: For cloud hosting (AWS, Google Cloud) and analytics

  • European Union: For certain service providers (if applicable)

We ensure adequate safeguards for international transfers:

  • Standard Contractual Clauses (SCCs): For transfers from EU/EEA to Indiacomplianceautomator+1

  • Data Processing Agreements: With all third-party processors

  • Binding Corporate Rules: Where applicable

By using our Service, you consent to the transfer of your data to India and other countries where our service providers operate.

9. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience:

9.1 Types of Cookies We Use

Cookie Type Purpose Duration Can You Opt-Out?
Essential Cookies Enable core functionality (login, security) Session No (required for Service)
Analytics Cookies Track usage patterns, improve features 24 months Yes (via browser settings)
Preference Cookies Remember your settings (language, theme) 12 months Yes
Marketing Cookies Personalize ads (if applicable) 12 months Yes (via cookie banner)

9.2 Managing Cookies

You can control cookies through:

  • Browser Settings: Most browsers allow you to block or delete cookies

  • Cookie Consent Banner: Our website displays a cookie consent popup where you can customize preferences

  • Opt-Out Tools: Google Analytics Opt-out Browser Add-on, Your Online Choices (EU)

Disabling cookies may affect certain features of our Service.

10. Children's Privacy

VibeQR is not intended for users under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child without parental consent, we will take steps to delete it promptly.

If you believe a child has provided us with personal data, please contact us at privacy@vibecreatemedia.in.

11. Third-Party Links

Our Service may contain links to third-party websites (e.g., Google Business Profile, payment processors). This Privacy Policy does not apply to those sites. We encourage you to review the privacy policies of any third-party sites you visit.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

  • Notification: We will notify you of material changes via email and/or a prominent notice on our website

  • Effective Date: The "Last Updated" date at the top of this policy will be revised

  • Your Continued Use: Using our Service after changes constitutes acceptance of the updated policy

We recommend reviewing this policy periodically.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Data Protection Officer (DPO):

  • Email: privacy@vibecreatemedia.in

  • Address: Vibe Create Media LLP, Latur, Maharashtra, India

  • Response Time: Within 30 daysdev+1

Grievance Officer (India - IT Act 2000):

  • Email: grievance@vibecreatemedia.in

  • Name: [Insert DPO/Founder Name]

You may also lodge a complaint with your local data protection authority if you believe your rights have been violated.

14. Additional Compliance Notes for Review Management Platforms

In compliance with Google's April 2026 Review Policy and India's Bureau of Indian Standards IS 19000:2022, VibeQR users must agree to the following:sansalegal

  • No AI-Generated Reviews: Users may not use AI tools to create fake or synthetic reviews

  • No Review Gating: Users may not filter or suppress negative reviews before publication

  • No On-Site Kiosks: Users may not operate tablets/kiosks at business premises for review collection

  • No Staff Quotas: Users may not set mandatory review collection targets for employees

  • Disclosure of Incentives: Any incentives offered for reviews must be clearly disclosed

Violations of these policies may result in suspension of your VibeQR account.

✅ Implementation Checklist

Before publishing, ensure you:

  • Replace all bracketed placeholders [ ] with actual company details

  • Add a link to this policy in your website footer (visible on every page)startupfundraising+1

  • Set up a dedicated email: privacy@vibecreatemedia.in

  • Create a cookie consent banner for your website

  • Sign Data Processing Agreements (DPAs) with all third-party processors (Google, AWS, payment gateways)complianceautomator+1

  • Document your data mapping (what data flows where, retention periods)startupfundraising+1

  • Add this policy link to your login page, signup forms, and checkout pages

  • Review and update this policy every 6-12 months or when laws change

 

 

← Back to Home