Privacy Policy

1. Who we are and the law this policy follows

PurchaseBarcode is run by RNR Associates, a sole proprietorship at 2/388 First Floor, Front Side, Subhash Nagar, New Delhi, Delhi 110027, India. We decide what personal data the website collects and how it is used. We collect it and keep it, on servers run by our hosting provider (section 5).

We publish this policy under the Information Technology Act, 2000 (section 43A) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, which require a published privacy policy.

The Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 have been notified. The parts that set out the duties of businesses like ours have not come into force yet; under the government's notification of 13 November 2025 they start in May 2027. We will update this policy for them before then.

2. The personal data we collect

When you create an account

• Your name, email address and mobile number.
• Your password. Under the 2011 Rules a password is sensitive personal data. We store it only as a one-way bcrypt hash, so nobody at PurchaseBarcode can read it.
• A 6-digit email verification code. It is emailed to you with your name, is kept only in your session data on our server, and expires after 10 minutes.
• The date and time you last logged in.
• If you use "Forgotten your password?", a random reset token and its expiry time are saved in your account record.

In your profile (optional)

• Your address, city, state, pincode and GST number (GSTIN). We use them to fill in the checkout form for you.

When you check out and pay

• Billing name, email and mobile number (required), and billing address, city, state, pincode and GSTIN (optional). These are saved with the order when you submit the checkout form, before you pay, and are used for your invoice.
• The items in your cart and any coupon you use.
• A record that you ticked the checkout declaration: its version and the date and time you accepted it.
• Payment references from Razorpay: the Razorpay order ID, payment ID and signature, the amount and the payment status. You enter your card, UPI or bank details on Razorpay's checkout; your full card number, CVV, UPI PIN and banking passwords never reach us. Razorpay's confirmation of your payment to our server includes the payment method and partial details, such as your UPI ID, the last four digits and network of your card, or your bank's name; we use them only to confirm the payment and do not store them.
• The barcode numbers issued to you and when they were delivered, your invoice number, date and amounts, and the order updates shown under Notifications in your account.

When you contact us

• The contact form saves your name, email address, phone number (if you give one), subject and message, the page you sent it from, the date and time, and your account if you are logged in.
• The form has an optional box: "You may contact me by WhatsApp or phone about my enquiry or purchase". Sign-up and checkout have the same box. It is never ticked for you. If you tick it, we record that, with the date and the version of the wording.
• If you email, call or WhatsApp us, we receive what you send us through that service.

How you found us

• When you arrive on our site, we note how you came: the campaign tags in the link, if it has any (source, medium, campaign, content and term); whether the link came from a Google, Microsoft or Meta advert; the domain of the website that sent you (only the domain, never the full address); the page you landed on (without anything after a "?"); and the date and time. We keep this in two cookies on your device (section 3).
• When you create an account, send us a message or place an order, a copy of how you first arrived and how you most recently arrived is saved with that record. From then on it is personal data about you, and we use it to learn which websites, adverts and campaigns bring us customers.
• We also count visits per day by how they arrived. These counts are totals and hold nothing that identifies you.

WhatsApp button taps

• When you tap a WhatsApp button on our site, we record which button it was, the page it was on, the time and how you arrived. If you are logged in, we also record your account. The link to your account is removed 24 months after the tap, and the record of the tap itself 25 months after it.
• The tap only opens WhatsApp. The conversation itself takes place on WhatsApp, which Meta runs, and not on our site.

Product pages you publish

• You can choose to publish a page for a barcode number you bought from us. Everything you enter on that page is shown publicly with the number until you unpublish it. Your name, email address and phone number are not shown unless you type them into the page yourself.
• If a page is taken down after a complaint, we keep a copy of it for 180 days, as the law requires of websites that host other people's content.

Technical data

• We do not store your IP address or your browser details with your account, messages or orders.
• To stop our forms and sign-in being abused, we count requests per network. We store only a pseudonymised form of the network's address: a keyed hash, whose key is kept outside our database. These counts are deleted after about two days. When our staff take an action in the admin area, the same kind of hash of their address is kept with the record of that action.
• Hostinger, which hosts the website, handles every request, including your IP address and browser details, and may keep its own server logs.
• Our error logs can contain order numbers, account and payment IDs and email-sending errors.

3. Cookies and outside services on our pages

• PHPSESSID (needed for the site to work). It is set on every visit and links your browser to your session on our server, which keeps you logged in and holds short on-screen messages and, while you sign up, your verification code. The cookie ends when you close your browser.
• pb_ft and pb_lt (our own, first-party cookies). pb_ft records how you first arrived on our site and pb_lt how you most recently arrived from a link, an advert or another website: the campaign tags, the advert network, the referring site's domain, the landing page and the date (see "How you found us" in section 2). They hold no name, email address, account number or other identifier of you, are signed so that they cannot be altered, and last 90 days. The site works without them.
• Google Analytics. Our pages load Google Analytics from googletagmanager.com, which sets Google's own cookies (names beginning _ga) in your browser and sends Google the pages you open, your approximate location from your IP address and your browser details. We use it only to count visits and see which pages and sources bring us customers. These are not cookies the site needs in order to work: you can block or delete them in your browser, or use Google's own opt-out, and everything on this site except those counts will work as usual. We run no advertising or remarketing service on our pages.
• Google Fonts. Our pages load their fonts from Google (fonts.googleapis.com and fonts.gstatic.com), so your browser sends your IP address and browser details to Google when it fetches them.
• Razorpay. The payment page loads Razorpay's checkout from checkout.razorpay.com. Razorpay may set its own cookies or storage in its checkout window under its own privacy policy.
• Pages that do not exist. If you open an address that does not exist on this site, Hostinger may show its own "page not found" page. That page is Hostinger's, not ours; it loads Google Analytics and other third-party scripts, which may set cookies.

You can block or delete cookies in your browser, but logging in and checkout need the PHPSESSID cookie. Without pb_ft and pb_lt the site works as usual, and your visit simply counts as a direct one.

4. Why we use your data

• To create and run your account and confirm your email address.
• To take your order, take payment through Razorpay, issue your barcode numbers and keep the record that stops a number being issued twice.
• To produce your invoice and keep the tax and accounting records the law requires.
• To answer your messages and complaints and to help with your orders.
• To learn which websites, adverts and campaigns bring us enquiries and customers (see "How you found us" in section 2).
• To keep the website working and secure and to find and fix errors.
• To meet our legal obligations.

The emails the site sends are: your sign-up verification code; an update when we change the status of your order (a copy comes to us); and your invoice, when we re-send it to you. We do not send marketing emails, and we do not use your data for advertising.

Follow-up about unfinished purchases

• Why. If you send us a message, create an account, add a pack to your cart, or start a checkout or a payment that does not go through, one of our team may contact you to answer your question or help you finish.
• What we use. Your name, email address, phone number, company (if you gave one), what you tried to buy, whether a payment failed, our notes of earlier contact, and how you found us.
• How we contact you. By email. We call you or message you on WhatsApp only if you ticked "You may contact me by WhatsApp or phone about my enquiry or purchase".
• How to stop it. Reply to our email or write to contact@purchasebarcode.com, or send "stop" to us on WhatsApp. We then mark you as not to be contacted.

5. Who receives your data

We do not sell or rent your personal data. It goes only to the recipients below, and only for the purposes in section 4.

• Razorpay (razorpay.com), our payment gateway: the amount, your order number, and your billing name, email and mobile to fill in its checkout. You give your card, UPI or bank details to Razorpay directly.
• Hostinger, our hosting provider: it runs the servers that hold the website and its database.
• Our email service provider, which delivers the website's emails: the emails listed in section 4 and their contents.
• Google: your IP address and browser details when your browser loads our fonts (section 3).
• buzzlytech.com, a store that issues barcode numbers from the same pool as us: the shared record of issued numbers holds your account ID number and order ID next to each number, so that neither store issues it again. It does not hold your name or contact details.
• WhatsApp (Meta): only if you choose to message us on WhatsApp.
• Government authorities, courts and law enforcement, when the law requires it.

We do not send your data to GS1 or to any ISBN agency, and we do not look up or register your numbers with them.

6. How we protect your data

• The website is served over HTTPS, so data between your browser and our server is encrypted in transit.
• Passwords are stored only as bcrypt hashes.
• We never receive your full card number, CVV, UPI PIN or banking passwords, and we do not store the partial payment details Razorpay's confirmation carries.
• Your account pages, codes and invoices open only after you log in, and only for orders that belong to your account.
• Payment confirmations are checked against Razorpay's signature before any code is issued.
• The admin area needs a separate admin login.

No website is completely secure. If a security incident affects your personal data, we will report it as the law requires.

7. How long we keep your data

• Orders, invoices and payment records. The Central Goods and Services Tax Act, 2017 (section 36) requires us to keep them until 72 months after the due date of the annual GST return for the year they belong to. For example, records for the financial year 2026-27 are kept until at least 31 December 2033. We keep them longer if they are part of an appeal, investigation or other proceeding, and other laws, such as income-tax law, may also require us to keep some records.
• The record of issued numbers (number, account ID, order ID) is kept permanently, so a number is never issued twice.
• Your account and profile are kept while your account exists.
• Contact messages are kept for up to 18 months. Follow-up records (section 4) that did not lead to an order are anonymised 18 months after their last activity.
• Unpaid orders, unverified sign-ups and account notifications are not deleted automatically at present. You can ask us to delete them (section 8).
• How you found us. The copy saved with an account, message or order is kept as long as that record. The pb_ft and pb_lt cookies end 90 days after they are set. The daily visit counts hold no personal data and are deleted after 25 months.
• Advert click identifiers (only if we switch keeping them on) are deleted 90 days after the click. If we stop keeping them, they go from our records at once, and from your pb_ft or pb_lt cookie the next time you open one of our pages.
• WhatsApp button taps. The link to your account is removed 24 months after the tap; the tap itself stays as an anonymous count, and that anonymous record is deleted 25 months after the tap.
• Pseudonymised network addresses. The request counts are deleted after about two days. The records of our staff's actions in the admin area, with their hashed address, are kept for 13 months.
• Download files. The ZIP of your codes is made when you download it and deleted straight after. Invoice PDFs are made when you open them and are not stored.
• Session data is kept on the server under the hosting provider's default settings; the PHPSESSID cookie ends when you close your browser.
• Server logs are kept under Hostinger's settings. Our own error log is started afresh once it passes 5 MB, and the 2 previous copies are kept.

8. Your rights and choices

• See and correct your data. In Profile you can change your name, mobile number, address, city, state, pincode and GSTIN. To change your email address, or the billing details saved on a past order, write to us.
• Choose not to give data. You can decline to give us personal data. We need your name, email address and mobile number to open an account, and billing details to issue an invoice, so without them we cannot sell to you.
• Withdraw your consent. You can withdraw your consent at any time by writing to us. We will then stop using your data, except what the law requires us to keep, and we may have to close your account.
• Ask us to erase your data. There is no self-service account deletion yet. Write to us and we will erase the data no law requires us to keep, and tell you what we must keep and why.

How to ask. Email contact@purchasebarcode.com from the email address registered on your account, with "Privacy request" in the subject, or write to us at the address on this page. We may ask you to confirm the request comes from you. We respond within one month.

9. Children

Our service is for businesses and adults. Accounts and purchases are for people aged 18 or over, as our Terms of Service say. We do not knowingly collect personal data from anyone under 18, and we do not track or monitor children. If you think a child has given us personal data, contact us and we will delete it, unless the law requires us to keep it.

10. Questions and grievances

For any question or complaint about your personal data, use the grievance contact on this page. We acknowledge a grievance within 48 hours and resolve it within one month. The full process is on our Grievance Redressal page.

11. Changes to this policy

When our practices or the law change, we will update this page and the "Last updated" date at the top.