Privacy Policy & Data Protection

THIS GLOBAL PRIVACY POLICY AND DATA PROTECTION AGREEMENT (the "Policy") constitutes a legally binding document detailing how Ranpariya Lab, operating as "Buzz QR AI" ("Company," "we," "us," or "our"), orchestrates the collection, processing, storage, and dissemination of your personally identifiable information (PII) and telemetric data when you access or interact with the Buzz QR AI mobile application, associated Application Programming Interfaces (APIs), and cloud infrastructure (collectively, the "App").

1. Corporate Identification and Data Controller Matrix

For the purposes of international data protection legislation, Ranpariya Lab serves as the designated Data Controller regarding the processing of your personal data. We bear the ultimate responsibility for determining the purposes and means of processing your data.

2. Exhaustive Typology of Information Collected

To provision, optimize, and secure the App's enterprise-grade functionalities, we systemically harvest and process the following granular classifications of data:

2.1. Granular Device Telemetry and Technical Data

Our server architecture autonomously harvests hardware and software heuristics to ensure cryptographic compatibility and diagnostic integrity. This includes:

• Hardware manufacturer, exact device model, system architecture (e.g., ARM64), and primary display resolution matrix.
• Operating System (OS) version, kernel build, and system-level linguistic configurations (locale and time zone).
• Internet Protocol (IP) address allocations, network gateway abstractions, and cellular network status metrics.

2.2. Application Usage and Diagnostic Telemetry

To perpetually refine our user experience and preemptively neutralize software anomalies, we aggregate:

• Micro-interactions within the application interface (e.g., temporal duration spent on specific UI paradigms, frequency of QR generation).
• Comprehensive crashlytics, encompassing stack traces, memory allocation states at the moment of failure, and exception handling logs.
• Performance benchmarking data, including application cold-start durations and API latency metrics.

2.3. Advertising and Monetization Vectors

The App subsidizes its operational costs through the display of targeted digital advertisements orchestrated by Google AdMob. Consequently, we must extract and syndicate specific data vectors to facilitate programmatic ad bidding:

• Your device's unique, resettable Advertising Identifier (e.g., Google Advertising ID on Android, or Apple IDFA on iOS).
• Approximate geolocation coordinates derived exclusively through IP address triangulation (we do not extract precise GPS coordinates for advertising).
• Interaction metadata concerning displayed advertisements (e.g., impressions, click-through rates, and ad dismissal events).

3. Hardware Permissions and Access Justifications

The App operates on a principle of least-privilege. We explicitly mandate the following hardware permissions, all of which are governed by your operating system's native permission consent matrices:

• Optical Sensor (Camera): Strictly required for the real-time optical capture and algorithmic decoding of physical QR codes and 2D matrices. We do not transmit live video feeds to our servers; all decoding is executed locally on your device's processor.
• Local Storage (Files/Media): Exclusively utilized to persist generated QR codes as graphical image files (e.g., PNG/JPG) into your device's native gallery directory, and to read images you explicitly select for decoding.
• Network State (Internet): Required to interface with our backend APIs for premium QR generation, real-time cryptographic validation, and the fetching of programmatic ad payloads.
• Push Notifications: Required to transmit asynchronous operational alerts, security bulletins, and promotional literature via Firebase Cloud Messaging.

4. Purposes of Processing (The "Why")

We process your data strictly on the legal bases of Legitimate Commercial Interest, Performance of a Contract, and User Consent. The processing purposes are explicitly defined as:

• To algorithmically encode, decode, and render complex QR data structures flawlessly.
• To perpetually execute security audits, neutralize vulnerabilities, and eradicate software bugs.
• To dynamically serve advertisements, thereby maintaining the economic viability of the free-tier application.
• To aggregate non-identifiable, macro-level usage statistics to inform future software architectural decisions.

5. Third-Party Syndication and SDK Processors

We do not, under any circumstances, execute the sale of your raw personal data to shadow data brokers. However, the architectural reality of modern application development necessitates the integration of specialized third-party Software Development Kits (SDKs). These entities act as Data Processors and are bound by their respective, globally compliant privacy covenants:

6. Global Advertising Consent and Personalization

The App integrates the Google Mobile Ads SDK. Depending on your geographical jurisdiction (e.g., within the European Economic Area under the GDPR, or California under the CCPA), the App will dynamically present a Consent Management Platform (CMP) dialog upon initialization. This dialog empowers you to explicitly grant or revoke consent for the processing of your Advertising ID for personalized ad targeting. Should you decline, the App will strictly serve non-personalized advertisements, utilizing only contextual data.

7. COPPA Compliance and Protection of Minors

8. Data Security Architecture and Cryptographic Retention

We deploy a defense-in-depth cybersecurity posture. All data transmitted between your device and our sovereign servers is encapsulated within TLS 1.3 cryptographic tunnels. Data at rest is secured utilizing industry-standard encryption algorithms within heavily fortified, physically secure data centers.

We retain your data only for the temporal duration strictly necessary to fulfill the purposes outlined in this Policy, or as mandated by statutory legal, tax, or accounting obligations. Upon the expiration of this necessity, your data is subjected to irrevocable cryptographic shredding.

9. International Data Subject Rights (DSR)

We universally recognize and enforce your sovereign rights over your data, regardless of your geographic domicile. You possess the unalienable right to:

• Right to Access: Petition a comprehensive ledger detailing the exact data we hold concerning you.
• Right to Erasure (Right to be Forgotten): Demand the absolute deletion of your data from our active databases and localized caches.
• Right to Rectification: Compel the correction of any inaccurate or antiquated data vectors.
• Right to Restrict Processing: Halt the processing of your data for specific purposes, such as personalized advertising, which can natively be executed via your device's OS-level privacy settings (e.g., "Opt out of Ads Personalization").

To execute any of these rights, you must dispatch a formal writ to our Data Protection Officer via the contact email provided herein. We are legally bound to respond to all validated requests within thirty (30) calendar days.

10. Cross-Border Data Transmissions

Given the global nature of cloud infrastructure, your data may be routed, processed, and persisted on servers located outside of your sovereign nation (e.g., in the United States). By interacting with the App, you explicitly authorize these trans-border data flows, acknowledging that they are safeguarded by robust Standard Contractual Clauses (SCCs) and international data transfer frameworks designed to ensure an equivalent level of cryptographic protection.

11. Policy Iteration and Promulgation

The Company reserves the unilateral, unencumbered right to iterate, amend, or completely overhaul this Policy at our sole discretion, driven by evolving jurisprudential landscapes or technological paradigm shifts. All material modifications shall be immediately promulgated via updates to this document, with the "Effective Date" modified accordingly. Your continued utilization of the App post-promulgation constitutes your irrevocable acceptance of the revised terms.

12. Legal Contact Information

All legal inquiries, DSR execution requests, and regulatory correspondence must be directed to: