Effective and Last Updated: October 21, 2026
QwickPe Tech LLP ("QwickPe", "we", "us" or "our") operates qwickpe.com, the QwickPe Android application and related services (together, the "Platform"). The iOS application is not yet publicly available. For personal data processed for our own purposes, QwickPe is the data fiduciary.
This notice explains what personal data we collect, why we use it, who receives it, how long we keep it and the choices available to you. It is written with the Information Technology Act, 2000 and applicable rules in mind and is designed to support the phased requirements of the Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025 as they come into force.
When you use the Android application, we may process your account identifier, name, verified email address or mobile number, profile and role selection (Buyer, Cardholder or both), authentication and account-security events, consent records, notification preferences and support history.
For card-offer and shopping features, we may process the selected bank, card network or card variant, masked identifiers or last digits where needed, participating marketplace, product or cart details, displayed price, applicable offer, delivery estimate, deal acceptance and expiry times, Merchant order reference and Buyer/Cardholder transaction status. The app may open supported marketplace content in an in-app browser or redirect you to a third party. Marketplace credentials and checkout information remain subject to that third party's service.
For wallet, earning and payout features, we may process ledger entries, reward or commission amount, locked/unlocked or pending status, bank-account holder name, bank name, masked account number, IFSC or another payout identifier, payout reference, failed or completed status and related tax or verification information. A balance shown in QwickPe is a Platform ledger and is not a bank deposit or stored-value account unless a separately identified authorised provider expressly says otherwise.
We may also process order evidence, delivery or return evidence, communications, referrals and reward events, dispute records, and information you voluntarily submit to support or fraud review.
Do not send us a full card number, CVV, PIN, OTP, UPI PIN, banking password or marketplace password. QwickPe does not need these credentials. A regulated payment or identity-verification provider may separately request information under its own notice where legally required.
Our app, hosting and security providers may process IP address, browser type, device model, operating system and app version, language, time zone, push-notification token, installation or session identifier, approximate location derived from IP, timestamps, screens or pages used, referring source, diagnostic, crash, performance and security logs. We use this information to operate, secure and improve the Platform—not to obtain unrelated content from your device.
Depending on the feature you choose, the app may request notification permission, foreground approximate/precise location for a Merchant page's user-invoked location function, or use an operating-system picker/share sheet for an evidence, invoice or statement file. Permission prompts must explain the purpose at the point of use. You may deny or later revoke optional permissions in device settings, though the related feature may not work. The current Android build removes microphone and broad external-storage permissions and does not request contact-list, SMS, call-log or background-location access. A future materially different permission requires an updated in-context explanation and the permission or consent required by law and app-store rules.
We store a dated record of your cookie choices, policy version and allowed categories in your browser's local storage. Google Maps remains blocked until you allow external content. Details appear in our Cookie Policy.
We may receive transaction status, refund, payout, identity-verification or fraud signals from a Merchant, bank, card issuer, payment/payout provider, verification provider or another user involved in the same deal. We may combine it with your Platform record only for the purposes described in this Policy.
Where processing relies on consent, your action must be free, specific, informed and unambiguous. You may withdraw that consent as easily as you gave it, although withdrawal does not affect processing already lawfully completed or records we must retain by law.
We do not sell personal data. We disclose only what is reasonably necessary to:
We may keep de-identified information that can no longer reasonably identify you.
We use access controls, role-limited administration, transport encryption, masked identifiers, database security rules, logging, environment separation and vendor controls appropriate to the nature of the data. Access to private form, account and transaction records is limited to authorised personnel or processors with a business need. No online service can promise absolute security. If a personal-data breach requires notice under applicable law, we will notify the competent authority and affected individuals in the required manner.
We may need enough information to verify your identity before completing a request. We will not charge for ordinary requests unless permitted by law.
After receiving a deletion request, we may ask you to confirm control of the registered email address or mobile number. We may delay final deletion while a deal, return, payout, chargeback, complaint or legal hold is open. Once the request is verified and eligible for completion, we close access and delete or irreversibly anonymise data that is no longer required. Where we must retain a limited record, we restrict it from ordinary product use and keep it only for the applicable legal, fraud, accounting or dispute purpose.
Deletion from active systems may not immediately remove encrypted disaster-recovery copies. Backup data remains protected, is not restored for ordinary use and is overwritten on the normal backup cycle, unless law requires a longer hold.
The Platform is intended only for people aged 18 or older. We do not knowingly offer financial or transaction features to children or seek their data. If you believe a child has submitted personal data, contact us so we can investigate and delete it where appropriate.
Some providers may process data outside your state or outside India, subject to applicable transfer restrictions and contractual safeguards. External marketplace, bank, social-media and map services operate under their own privacy notices. Following a link does not make QwickPe responsible for that service's practices.
QwickPe may use rule-based checks to identify offer eligibility, suspicious activity, duplicate accounts or transaction risk. These checks can be incomplete or wrong and do not guarantee an issuer or Merchant decision. Where a significant restriction results from an automated flag, you may contact support and provide relevant context for human review, subject to security and legal limits.
The permissions, software development kits and data practices in each released build must match its Google Play Data safety disclosure and, when iOS launches, its Apple App Privacy disclosure. If a new build introduces a materially different data purpose or sensitive permission, we will update the relevant disclosure and provide notice or obtain consent before that use where required.
For questions, consent withdrawal, data-rights requests or complaints, contact:
Name: Abhijeet Singh
Phone / WhatsApp: +91 91960 25102 · Chat on WhatsApp
Privacy email: support@qwickpe.com (use the subject “Privacy request”)
Address: QwickPe Tech LLP, Araji No. 499, Pisaur, Shivpur, Varanasi, Uttar Pradesh 221003, India
Response target: acknowledgement within 48 hours and a substantive response within 30 days, subject to the nature of the request and any shorter statutory period.
We may update this notice when our practices or legal obligations change. We will post the revised date and provide a prominent or direct notice where a change materially affects you. If fresh consent is required, we will ask for it; we will not treat silence as consent.
The exact fields depend on the feature used. The following inventory is intended to be comprehensive, not a statement that every field is collected from every user.
The in-app Merchant browser can process the current Merchant URL, visible product/offer/order text, price, cart/checkout state and order/refund identifiers needed to perform the function you initiated. A browsing session may remain device-memory-only until you confirm a purchase, but a confirmed or support-relevant event may be sent to QwickPe to create or evidence the Deal. Merchant login cookies and content remain subject to the Merchant's own privacy policy.
We obtain data directly from you; from the app/device and website browser; from the other matched Deal participant to the extent necessary to operate the transaction; from Merchants and publicly available offer/product pages; from Payment Partners, banks or payout providers; from Firebase/Google, Cloudflare, messaging and diagnostics providers; from referral links; and from fraud-prevention, security or lawful public-authority sources. We do not treat information as freely usable merely because it is publicly visible.
We process data only for a lawful purpose. Depending on the activity and the law then in force, processing may be based on your specific consent; action requested by you to create or perform a service; voluntary provision for a specified purpose; compliance with law or court/government requirements; prevention/detection/investigation of offences and security incidents; protection of legal claims; or another recognised legitimate use.
Consent for optional analytics, external content, testimonial publication and marketing is separate from access to ordinary content. Consent is not valid for an unrelated purpose merely because you accepted the Terms. Withdrawing consent stops future consent-based processing after a reasonable implementation period, but does not invalidate processing already lawfully completed or records still required for a Deal, refund, fraud, accounting, complaint or legal obligation.
India's Digital Personal Data Protection Act, 2023 and Digital Personal Data Protection Rules, 2025 have phased commencement dates. We intend this Policy and our controls to support the applicable provisions as they take effect; references to a future right or process do not misstate a provision as already enforceable before its notified commencement.
| Recipient category | Typical information | Purpose |
|---|---|---|
| Cloud/database and application providers | Account, form, Deal, content, logs and identifiers | Hosting, storage, authentication, functions, configuration, security and delivery |
| Payment and payout providers | Amount, contact/account reference, provider IDs, payment method and status | Authorisation, collection, reconciliation, refund, payout and fraud handling |
| OTP, SMS, email, WhatsApp and push providers | Contact destination, template variables, token and delivery status | Authentication, service notices, support and consented marketing |
| Analytics/crash/diagnostic providers | Pseudonymous installation, device, event, crash and performance data | Reliability, security and product measurement; website Analytics is consent-controlled |
| Merchant/marketplace and matched participant | Minimum order/Deal, fulfilment and redacted transaction context | Complete, verify, cancel, return, refund or dispute the Deal |
| Professional advisers, auditors and authorities | Relevant account, transaction, complaint or evidence record | Legal compliance, audit, claims, investigation and rights protection |
Processors receive contractual/instructional limits appropriate to their role. Some recipients independently determine processing under their own notices—for example a Merchant, card issuer, bank, Google Maps or Payment Partner. We do not sell personal data or share it for another party's unrelated behavioural advertising.
Providers reflected in the current technology stack may include Google Firebase/Cloud (authentication, push messaging, Remote Config, analytics, crash diagnostics, database and functions), Cloudflare (delivery and Turnstile security), Razorpay (supported payment processing), Meta/WhatsApp and SMS providers (OTP/service templates), Brevo/SMTP providers (email delivery), and Google Analytics for the website only after consent. Google Gemini may be used for minimised product/offer-text assistance where enabled; credentials and unrelated personal data should not be included in that input. Provider availability and exact subprocessor may change, but the purpose and data-minimisation limits in this Policy continue to apply.
| Record | Normal operational period | Reason / end point |
|---|---|---|
| Active account and profile | While the account is active | Service delivery; then deletion/anonymisation subject to retained categories below |
| Authentication session | Normally up to 30 days active, with bounded security history after expiry | Authentication and account security; current implementation schedules history purge approximately 90 days after session expiry |
| Push notification/inbox record | Typically about 30 days; delivery diagnostics may last about 90 days | Delivery, troubleshooting and unread/open status |
| Uncompleted product-interest journey | Typically up to 180 days | Continuity/follow-up, then automatic expiry |
| Payment attempt / reconciliation working record | Typically up to 180 days unless linked to a completed financial record or dispute | Prevent duplicate charges and reconcile provider outcomes |
| Completed Deal, Wallet, invoice, payout and tax record | For the applicable accounting, tax, limitation, audit and fraud period | Financial integrity, legal claims and statutory records; not erased merely because a display history is hidden |
| Open complaint, return, refund or chargeback | Until final resolution plus the applicable claim/audit period | Resolve the matter and establish the outcome |
| Referral and device anti-abuse record | For the reasonable fraud/audit period, minimised or hashed where practicable | Prevent deletion/re-registration abuse and duplicate reward claims |
| Website forms and consent evidence | Service need plus a reasonable evidence period; consent evidence may be kept up to three years after withdrawal/expiry | Respond to request and demonstrate the choice |
| Career application | Recruitment process plus normally up to 12 months after role closure | Assess, communicate and defend the hiring process; longer talent-pool use requires a suitable notice or permission |
| Certificate verification record | While active and, in minimised form, while authenticity or revocation may reasonably need verification | Confirm issuance and prevent revoked, expired or altered credentials from being misrepresented |
| Cookie preference | Up to 12 months on the device | Remember your categories; clearing site storage removes it |
These are categories and normal periods, not an instruction to retain every record for the maximum. Backups may age out on a separate protected cycle and are not returned to ordinary use. A legal hold, regulator request, unresolved fraud or litigation may extend a relevant record; we limit access and delete/anonymise it when the hold ends.
You may ask for access/summary, correction/completion/update, erasure, withdrawal of consent, communication preferences, grievance resolution and nomination where a statutory nomination right applies. Send the request from the registered channel where possible and identify the account and requested action. We may use OTP, registered email/mobile confirmation or proportionate supporting information; never send a full card number, CVV, PIN, password or OTP to support.
We may refuse or narrow a request that is unverified, manifestly abusive, seeks another person's data, would undermine security/fraud controls, conflicts with law or would delete a record still needed for an open transaction or legal obligation. We will explain the basis where law permits and provide the escalation route. Authorised agents must establish identity and authority.
Controls include HTTPS/TLS, protected session storage, OTP hashing and attempt limits, role-based admin access, database rules, least-privilege practices, environment-secret separation, provider webhooks/signatures, idempotency, audit trails, device/session revocation, monitoring and backup/recovery measures appropriate to risk. No internet service can promise absolute security.
We assess suspected incidents, contain exposure, preserve evidence, reset/revoke affected credentials, coordinate with processors and notify CERT-In, other authorities and affected individuals when and within the time required by applicable law. A notice may be phased as facts become reliable. Users should report suspected compromise to legal@qwickpe.com and avoid including secrets.
The Platform is for persons aged 18 or older and is not directed to children. Age entered at onboarding, contractual capacity and payment/card restrictions support this rule. We do not knowingly undertake behavioural monitoring or targeted advertising directed at children through QwickPe. If you believe a minor created an account, contact us with enough information to locate it; we may restrict access, verify age/guardianship proportionately and delete data not lawfully required.
You can update supported profile fields and should keep payout, contact and delivery information accurate. We may correct data using reliable provider or Merchant confirmation and keep an audit trail where a financial record changes. Fraud and eligibility controls consider transaction/device/account signals and are not intended to discriminate on religion, caste, ethnicity, disability, political belief or another protected ground. Age and location may be used only where relevant to legal/service eligibility.
This Policy should be read with the Cookie Policy, Account & Data Deletion Policy, Terms of Service, Payments & Wallet Policy and Grievance Redressal Policy. A short in-context notice may provide feature-specific detail; it supplements this Policy and cannot silently authorise an unrelated use.