Privacy Policy

1. Who we are and our role

BharatAI Solutions Private Limited decides why and how personal data is processed for the QwikExit shopper account, the optional features you switch on (analytics, personal recommendations, offers and alerts, remembering your last location), the QwikExit Pro plan, our website and our own business relationships. For these we are the Data Fiduciary under the DPDP Act.

When you buy from a store, your purchase contract is with that retailer (the store's owner), which sells the goods, sets prices and offers, issues the GST invoice in its own name, receives the payment in its own payment gateway account (or through Razorpay Route, which settles it to the retailer) and handles returns. The retailer is a Data Fiduciary for its own sales and store records, and we process the checkout, invoice and exit-verification records on its behalf as its Data Processor, under a written contract (see our Retailer Terms). Where a retailer collects personal data directly (for example a loyalty programme of its own), its own privacy policy applies to that.

The QwikExit Store app and the Retailer Console are used by retailers' employees. Their personal data is processed for the retailer, and by us as the Data Fiduciary for their login accounts and our security records.

We have not been notified as a Significant Data Fiduciary. If we are, we will appoint a Data Protection Officer in India and publish their details here.

2. Personal data we collect

2.1 Shoppers (the QwikExit app)

Camera. The camera is used on your phone to read product barcodes, store QR codes and Cart QR codes. Images are processed on the device and are never recorded, uploaded or stored by us. Photos, contacts, microphone, health data and advertising identifiers are not accessed. We do not read your Android Advertising ID or iOS IDFA and do not track you across other companies' apps or websites.

2.2 Store staff (the QwikExit Store app and Retailer Console)

Name, work email, phone number (if given), role, store, sign-in details (password stored only as a one-way scrypt hash, and one-time codes), invitations, the actions taken in the app or console (for example exit checks, flags, stock changes and settings changes, with time and IP address), and assisted carts credited to them.

2.3 Retailers, partners and website visitors

Business contact details (name, work email, phone, company, city), company and compliance details you give us at onboarding (such as GSTIN, PAN, registered address and bank details for settlement), messages sent through our website forms, contracts and invoices. The website does not use analytics or advertising cookies (see our Cookie & Storage Policy).

2.4 What we do not collect

We do not collect card numbers, CVV, UPI PIN, net-banking credentials, passwords for other services, biometric data, Aadhaar numbers, health, caste, religion, sexual orientation or other sensitive personal data. We do not run CCTV or face recognition; any CCTV in a store belongs to the retailer and is covered by the retailer's own notice.

3. Why we use it, and on what legal basis

Under the DPDP Act we process personal data either with your consent (section 6) or for a legitimate use (section 7). Each use:

We use personal data only for the purposes listed here. If we want to use it for a new purpose, we will ask for your consent first where the law requires it. We do not use your personal data to train artificial-intelligence models.

4. Your consent choices and how to withdraw them

When you first open the app after signing in, we show a consent screen listing each optional purpose in plain language. Each one is off unless you turn it on, and checkout works with all of them off. You can review the notice in English and, on request, in any language listed in the Eighth Schedule to the Constitution of India.

• Improve the store experience: link your cart activity to your account.
• Personal recommendations: build your private preference profile.
• Offers & notifications: receive offers and offer alerts from partner stores near you.
• Remember my last location: keep your last location so alerts come only from stores near you.

Withdrawing consent is as easy as giving it: switch the purpose off in Profile → Privacy & My Data, or email hello@qwikexit.com. When you withdraw, we stop that processing and, within a reasonable time, erase the data kept only for it (for example, turning off personal recommendations deletes your profile; turning off "Remember my last location" deletes the saved location). Withdrawal does not affect processing done before it, or data we must keep by law. Withdrawing the location permission in your phone settings stops location use immediately.

When the consent text changes, we record the new version and ask you again. Once registered Consent Managers are available under the DPDP Act, you may also give, manage and withdraw consent through one.

5. Profiling, offers and automated checks

Preference profile. With your consent we work out simple preferences (for example favourite brands, usual sizes and price range) from your purchases and linked activity. It is used only to show you more relevant offers and suggestions inside QwikExit. It is never shared with stores or brands. You can view it, refresh it or delete it in Profile → Privacy & My Data.

Offers. Offers are created by retailers and brands. We decide which offers to show you based on distance, what you follow and (if allowed) your profile. Paid or sponsored offers are labelled. Stores and brands receive anonymous counts of views, clicks and redemptions, not your identity.

Exit risk checks. To protect retailers from theft and to keep the exit fast for most shoppers, our system gives each paid cart a risk level (for example from the number and type of items, mismatches between scans and items, and unusual patterns). The risk level only suggests whether the store staff should do a quick check or a full check of the bag. It never refuses your purchase, accuses you, charges you or blocks your account on its own. A person always decides, and you can ask for the store manager. If you think a check was handled unfairly, contact us (section 12).

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.

6. Who we share personal data with

We do not sell or rent personal data. We share it only as follows:

Every service provider that processes personal data for us does so under a contract that limits use to our instructions and requires reasonable security safeguards, as required by section 8(2) of the DPDP Act.

7. Where your data is stored, and transfers outside India

Your personal data is stored in India, on Amazon Web Services and MongoDB Atlas in the Asia Pacific (Mumbai) region. Some service providers (for example Google, Apple, Resend and Anthropic) may process limited data outside India, mainly in the United States, when you use their features. Such transfers are made in line with section 16 of the DPDP Act and are not made to any country the Government of India has restricted.

8. How long we keep it

We keep personal data only as long as needed for the purpose it was collected for, or as the law requires, and then erase or anonymise it.

9. Your rights

Under the DPDP Act you have the right to:

• Information and access (section 11): a summary of your personal data and processing, and who we have shared it with. Use Profile → Privacy & My Data → Download my data for a copy of your account, receipts, linked activity and profile, or email us.
• Correction, completion and updating (section 12): edit your name and phone in Profile; email us to correct anything else, including your email address.
• Erasure (section 12): delete your account in the app (Profile → Delete account) or by email, or ask us to erase specific data. We keep only what the law requires (section 8).
• Withdraw consent (section 6(4)) at any time, as described in section 4.
• Grievance redressal (section 13): complain to our Grievance Officer (section 12), and then, if not satisfied, to the Data Protection Board of India.
• Nominate (section 14): name someone to exercise your rights if you die or become unable to. Email us the nominee's name and contact details from your registered email.

To use any right, email hello@qwikexit.com from your registered email address (or use the in-app options). We may ask you to confirm your identity. We do not charge for requests. We reply within 30 days, and grievances are resolved within the timelines in section 12. Please also note your duties under section 15 of the DPDP Act: give accurate information, do not impersonate anyone, and do not file false or frivolous complaints.

If you are a store employee, a request about the records your employer keeps (for example exit checks you made) may be passed to that retailer to answer, and we will help them.

10. Children

The QwikExit app is meant for adults. You must be 18 or older to create an account, and you confirm this on the consent screen. We do not knowingly process the personal data of anyone under 18, and we do not track, behaviourally monitor or send targeted offers to children. If you believe a child has created an account, email hello@qwikexit.com and we will delete it. Children can still shop at the store's normal billing counter, or with a parent's or guardian's account under their supervision.

11. Security, and what happens if there is a breach

We follow reasonable security practices in line with the IT Act, the 2011 security rules and DPDP Rule 6, including:

• Encryption in transit (HTTPS/TLS) and at rest; secrets kept in AWS Secrets Manager.
• One-way hashing of passwords (scrypt), sign-in tokens and one-time codes; exit passes signed with a per-retailer secret and valid for a short time.
• Strict separation of each retailer's data, role-based access, two-step verification (email codes) for our internal team, and access only for people who need it.
• Logging and monitoring of access to personal data, kept for at least one year; regular backups; and reviews of our security measures.
• Payment data never touching our servers.

No system is completely secure. If a personal data breach happens, we will inform affected users without delay, in plain language, with what happened, the likely consequences, what we are doing, and what you can do. We will report it to the Data Protection Board of India without delay and in detail within 72 hours, and to CERT-In within 6 hours where its directions require, as the law requires.

12. Grievance Officer and contact

For any question, request or complaint about your personal data or this Policy, contact our Grievance Officer:

• Email: hello@qwikexit.com
• Post: Grievance Officer, BharatAI Solutions Private Limited, C-24 Shaha Dana Colony, Izzat Nagar, Bareilly, Uttar Pradesh 243122, India

We acknowledge complaints within 24 hours and resolve them within 15 days (and in any case within the 90 days allowed by the DPDP Rules). If you are not satisfied, you may complain to the Data Protection Board of India (dpb.gov.in). See our Grievance Redressal page for the full process.

13. App store disclosures

The data types and purposes in this Policy match what we declare in the Apple App Store privacy details and the Google Play data safety section. In short: we collect contact info (email, name, phone), purchases, approximate and precise location (only while the app is open, and saved only with your consent), user IDs, product interactions, and diagnostics. We use them for app functionality, fraud prevention and security, analytics and personalisation only with your consent, and never for third-party advertising or tracking. Data is encrypted in transit, and you can ask for it to be deleted (see Account & Data Deletion).

14. Changes to this Policy

We may update this Policy. The date at the top shows the latest version. For material changes we will tell you in the app or by email before they take effect, and where a change needs your consent we will ask for it again on the consent screen. Earlier versions are available on request.

15. Contact