1Who we are
hi4.in ("we", "us", "our") runs the website hi4.in and the short links, QR codes and pages served from it.
This policy explains what personal data we process, why, and the choices and rights you have. It is written for India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the rules made under it. For the personal data described here, we are the "Data Fiduciary" and you are the "Data Principal".
This policy covers the hi4.in website, your hi4.in account, the API, and every hi4.in short link, QR code and page. It does not cover the websites that hi4.in links point to — those have their own privacy policies.
2What we collect
When you create an account
- Your name, email address and password. We store the password only as a one-way hash — nobody at hi4.in can read it.
- Your plan, sign-up date and last log-in time.
- Security records: log-in and sign-up attempts with the IP address and browser used, so we can stop password guessing and fake sign-ups.
What you create
- Short links: the destination address, the link name, an optional title, password (stored as a hash) and expiry date.
- QR codes, bio and business pages, and digital visiting cards, with everything you choose to put on them.
- API keys you create for your own tools.
Your bio page, visiting card and anything you publish on them are public. Anyone with the link can see them. Only add phone numbers, email addresses, UPI IDs or addresses that you are happy to share publicly.
When you contact us or fill a form
- Your name, email, mobile number and message, plus the IP address and browser used to send the form, which helps us block spam.
- If you use the chat window on our website, the messages you send and any contact details you give in the chat.
Without an account
- You can make a few short links a day without signing up. We keep a counter linked to your browser session and IP address to enforce the daily limit and stop abuse.
Payments
- Online payments are not live yet. When they are, a licensed payment gateway will process payments. We will receive the payment status, amount, date and a transaction reference, and we will never see or store your full card number, CVV or UPI PIN.
- Billing details you give us for invoices, such as your business name, address and GSTIN.
3When someone opens a link or page
When anyone opens a hi4.in short link, scans a hi4.in QR code or views a hi4.in page, we record:
- the date and time, and which link or page was opened;
- the IP address and the browser's user-agent (which tells us the browser, operating system and device type);
- the referring website or app, if the browser shares it;
- an approximate country and city, worked out from the IP address.
We use this to count clicks, show the link or page owner their statistics, spot bots and click fraud, and keep the service secure. We do not use it to build advertising profiles, and we do not sell it.
The owner of a link or page can see click details for their own links and pages in their dashboard. These details can include the visitor's IP address, approximate location, device and referrer. If you are a link owner, you are responsible for using this information lawfully.
5Why we use your data
- To provide hi4.in: create and redirect your links, show your pages, generate QR codes and keep your account working.
- To show you click and visit statistics for your own links and pages.
- To keep hi4.in safe: block phishing and scam links, stop spam, bots, fake sign-ups and password guessing, and investigate abuse reports.
- To reply to your messages and support requests.
- To send service emails, such as security alerts, password resets and important changes to your account or these policies.
- To handle billing, invoices and refunds.
- To understand how our website is used and make it better (only with analytics allowed).
- To follow the law, for example to respond to valid orders from courts or government agencies.
We will only send you marketing emails if you agree to them, and every marketing email has an unsubscribe link.
6Consent and legal basis
Under the DPDP Act we process personal data either with your consent, or for "legitimate uses" that the Act allows without separate consent (section 7). For example:
- Consent: optional analytics, marketing emails, and anything else where we ask you first.
- Legitimate uses: when you give us your details to get a service (such as an account or a reply to your message), and when the law requires us to process or keep data.
You can withdraw your consent at any time, as easily as you gave it — for example by choosing "Essential only" above, unsubscribing from emails, or writing to support@hi4.in. Withdrawing consent does not affect processing that already happened. If you withdraw consent for something the service needs, we may not be able to provide that part of the service.
8Data outside India
Some of our service providers may store or process personal data on servers outside India. We only use providers in countries that the Government of India has not restricted under section 16 of the DPDP Act, and we expect them to protect data to the standard of this policy.
9How long we keep data
We keep personal data only as long as we need it for the purposes above, or as long as the law requires.
| Data | How long we keep it |
|---|---|
| Account details | While your account is open. After you ask us to delete your account, we delete or anonymise it within 30 days, unless the law requires us to keep some of it. |
| Links, QR codes and pages | Until you delete them or your account is deleted. |
| Click and visit records | While the link or page exists, so we can show the click history your plan includes. When you delete a link, its click records are deleted with it. |
| Security and abuse records | As long as needed to protect the service and as required by law. Indian rules (such as CERT-In directions and the DPDP Rules) require some logs to be kept for a minimum period, generally up to one year. |
| Messages and support requests | Up to 2 years after your request is closed, so we can follow up and handle disputes. |
| Payment and invoice records | As long as Indian tax and accounting laws require, usually up to 8 years. |
10How we protect data
We use reasonable security safeguards, including HTTPS on every page, hashed passwords, protection against form forgery, rate limits and bot checks on log-in and sign-up, and screening of new links for scams. Read more on our Security page.
No system is perfectly secure. If a personal data breach affects you, we will tell you and the Data Protection Board of India as the DPDP Act requires, and explain what happened and what you can do.
11Your rights
Under the DPDP Act you have the right to:
- Access — get a summary of the personal data we hold about you, what we do with it, and who we have shared it with.
- Correction and updating — fix data that is wrong, incomplete or out of date. You can change most of it yourself in your dashboard.
- Erasure — ask us to delete your personal data when it is no longer needed for the purpose it was collected for, or when you withdraw consent, unless the law requires us to keep it.
- Withdraw consent — at any time, for anything that is based on consent.
- Grievance redressal — complain to us and get a response within a fixed time (see section 14).
- Nominate — name another person who can use your rights for you if you die or become unable to act.
The DPDP Act also asks Data Principals not to give false information, not to impersonate someone else and not to file false or frivolous complaints.
12How to use your rights
- Email support@hi4.in from the email address on your hi4.in account, and say which right you want to use. To nominate someone, include their name and contact details.
- We may ask you to confirm your identity before we act, so nobody else can see or delete your data.
- We will acknowledge your request within 24 hours and respond within 15 days. If we need more time, we will tell you why.
Using your rights is free.
13Children
hi4.in is not meant for children. Under the DPDP Act a child is anyone under 18. You must be 18 or older to create an account. We do not knowingly collect personal data from children without verifiable consent from a parent or guardian, and we do not track children or show them targeted advertising. If you believe a child has given us personal data, write to us and we will delete it.
14Grievance Officer
You can reach our Grievance Officer at the email below. Email: support@hi4.in.
See the Grievance officer page for response times and how to escalate. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.
15Changes to this policy
We may update this policy as hi4.in or the law changes. The date at the top shows the latest version. If a change is important, we will tell you by email or with a notice on the website before it takes effect.
Questions? Email support@hi4.in.