Privacy policy

1. About this policy

DOT-EXE INNOVATIONS PRIVATE LIMITED, trading as .executable ("we", "us" or "our"), provides creative technology products and services. This policy explains our handling of personal information across our websites, native products, mobile and desktop applications, web applications, client platforms and interactive experiences that link to it.

It covers our products, including Moments and QR.exe, and apps developed, operated or published for clients through our developer accounts on the Apple App Store, Google Play or other distribution channels. It also covers relevant support, business enquiries and project communications.

Not every product collects every type of information described here. The information used depends on the features you choose, the project configuration and our role. A product, app or campaign may provide an additional privacy notice identifying its operator, actual data practices, providers and retention arrangements. Read that notice alongside this policy. More specific information governs the processing it describes, but cannot reduce your statutory rights. This policy does not replace required notices, permission requests or consent at the point of collection.

2. Who is responsible for your information

Our own products and business activities. Where we decide why and how personal information is used, we are the responsible organisation, including a controller or data fiduciary where those concepts apply. This includes operating our own products, administering business relationships, handling support and protecting our systems.

Client projects and branded apps. A client, brand, event organiser or employer may decide the purposes of collection while we provide development, hosting, publishing, support or other processing on its instructions. In that case, the client is ordinarily the controller or data fiduciary and we act as its processor or service provider for that activity. We use that information only under authorised instructions and applicable law, and not for our independent marketing. The same project may also involve processing for which we are independently responsible, such as our own legal compliance or security administration.

Publishing an app under our developer account does not by itself determine every privacy role or transfer our app-store responsibilities to the client. The app's notice identifies the relevant client and its contact details where the client controls processing. If the role is unclear, contact us with the app or campaign name. We will explain our role and route your request appropriately. Contractual arrangements do not remove responsibilities imposed by law.

3. Information we may handle

We limit collection to information relevant to the service and disclose additional or unexpected uses before they occur. Depending on the product, information may include:

The applicable app or campaign notice explains which categories apply. Optional form fields and permissions are identified where relevant. If information is necessary to deliver a requested feature and you do not provide it, that feature may not work. Do not submit unrelated sensitive information or information about others unless you have the necessary authority and legal basis.

4. Where information comes from

Information comes from you, from your interactions with our services, and from technical requests made by your device. In client projects, an authorised client or event organiser may provide registration lists or project information. If you choose an integration, a sign-in provider or connected service may provide the information you authorise, such as an account identifier or selected files. A payment or delivery provider may supply status information.

Where information comes from another organisation, we require an appropriate basis for receiving and using it and provide any additional notice required by law. An organisation providing your information does not automatically authorise unrelated uses.

5. Why we use information

We use relevant information to provide the service you request, including account access, content creation, hosting, media delivery, participation, game functionality or redemptions. We also use it to answer enquiries, manage projects and payments, administer contracts, diagnose faults, improve service reliability, prevent abuse, maintain security and comply with legal duties.

Campaign measurement, optional analytics, personalised features and marketing apply only where disclosed for the relevant service and supported by an appropriate legal basis. We separate necessary service processing from optional promotional uses. A feature's stated purpose does not authorise indefinite retention or unrelated reuse.

6. Legal grounds and consent

The legal ground depends on the law and activity. Where EU or UK data protection law applies, grounds may include contractual necessity for objectively necessary service delivery; legitimate interests in proportionate security, service administration and responding to enquiries, balanced against your rights; legal obligations; and consent for activities that require it. We identify any additional ground needed for sensitive information before processing it.

For Indian processing, we rely on consent or another ground permitted by the applicable Indian provisions as they take effect. A legitimate-interest ground under another country's law does not create the same ground under Indian law.

Consent, where required, is specific and informed. You can withdraw it through the available service controls or by contacting us. Withdrawal does not affect earlier lawful processing. We explain if withdrawal prevents a feature that actually depends on the processing. Refusing optional marketing does not by itself prevent access to an unrelated service. Reading this policy, installing an app or accepting general terms is not blanket consent to every activity described here.

7. Camera, microphone, files and device permissions

A product may request camera access for capture, scanning or augmented reality; microphone access for recording or voice interaction; selected-photo or file access for upload and saving; or notifications for messages you choose to receive. Location, nearby-device, Bluetooth, motion or similar access is requested only for a disclosed feature that uses it.

Where required, the product explains the data, purpose and any relevant sharing before asking for permission. An operating-system permission is not a substitute for a separate disclosure or consent required by law or platform rules. You can change permissions in device settings, although a dependent feature may stop working. Background access, where a product genuinely requires it, must be separately and clearly explained. This policy is not permission for unrestricted background access, contacts access or collection of unrelated files.

8. Media, AI, avatars and face-related features

For a feature involving images, video, voice, an avatar or generative AI, the relevant notice explains whether processing takes place on your device or involves our servers or a specialist provider, what is sent and why. Cloud processing may involve selected media, prompts and related instructions. Where required, we disclose the provider and obtain permission before transmitting personal information to a third-party AI service.

You must have appropriate permission to submit identifiable images, recordings or other personal information about someone else. Submitting an image for a requested transformation does not by itself authorise us to use it in advertising, a public portfolio or unrelated AI training. We do not use identifiable customer content to train general-purpose AI models without a separately disclosed lawful basis and any required specific consent. Client instructions remain subject to applicable law.

Images, voice recordings and temporary facial measurements used for an effect can be personal information. Processing biometric information to uniquely identify or authenticate someone requires a separately assessed purpose, legal basis, safeguards and notices; it is not authorised merely by using a photo effect. Any face-related feature must describe relevant measurements or templates, purposes, disclosure, storage and deletion in its product notice before collection. We do not treat a generic camera permission as consent to biometric identification.

AI outputs can contain personal information and errors. Avoid placing confidential or unnecessary sensitive details in prompts. Any human access for support, safety or quality review must be limited to an authorised, disclosed purpose. We do not make solely automated decisions producing legal or similarly significant effects about individuals unless a particular service expressly explains the processing and legally required safeguards before it occurs.

9. Moments, QR.exe and product-specific features

Moments. This policy applies to Moments where it is identified as our product or links here. The notice in the version you use explains its enabled features, actual media handling, sharing settings and retention. A reference to Moments in this policy does not mean every version collects location, uses AI or offers public sharing.

QR.exe. In the browser-based static QR generator, the normal QR generation and logo-rendering functions process your entered payload and selected logo locally. Email verification and technical website requests are separate server communications. Verification may store a token containing an email address and expiry in browser storage. The applicable QR.exe notice describes those details. Any future hosted, dynamic or analytics feature requires its own disclosure before use.

Other products and apps. Read the notice available within the app, project or campaign for its actual configuration. A local-only feature is not automatically a cloud service, and a local-only statement for one product does not apply to the whole company.

10. Sharing, galleries and public outputs

If a feature lets you publish to a gallery, social wall, leaderboard or shared event display, its interface explains the audience and information being displayed. Do not publish someone else's information without authority. Share links, downloaded images, printed outputs and QR codes can be forwarded, photographed or copied by their recipients. QR patterns can be decoded and are not encryption.

Where a gallery uses access controls or expiry, the relevant service explains them. Deleting a source record does not recall a recipient's independent download or printed copy, although applicable removal duties still apply. Access to a private event or receipt of an output is not automatic permission for us or a client to use your image in unrelated publicity.

11. Cookies, app identifiers, analytics and advertising

Websites and apps may use cookies, local or session storage, authentication tokens and similar technologies for sign-in, security, service preferences and functions you request. App diagnostics or measurement tools may process device and usage information where included and disclosed. The relevant notice or consent controls identify optional technologies, their purposes, providers and duration where required.

We obtain consent before non-essential storage, tracking or other processing where required, unless a valid legal exception applies. You can use available privacy controls and browser or device settings to manage choices. Clearing storage can reset preferences or verification status. Optional analytics and advertising must not begin before any required permission. Cross-app or cross-site tracking also requires applicable platform authorisation. We do not bypass device privacy settings.

We do not sell personal information or share it for cross-context behavioural advertising. If a service proposes a materially different advertising practice, it must first provide the necessary updated disclosures, choices and legal safeguards. We honour legally required recognised opt-out preference signals for processing to which they apply. A browser's Do Not Track signal is not treated as a separate universal consent or withdrawal mechanism.

12. Communications and marketing

We may send verification codes, requested outputs, event information, transaction updates or support responses as part of the service. A delivery channel may involve an email, messaging, SMS, push or other provider; the service identifies the channel where relevant. Telephone, SMS or messaging communications are subject to applicable consent and communications rules.

Marketing from us or a participating brand requires an appropriate, separately disclosed permission. Joining an event, generating a photo or receiving an output does not by itself authorise every brand to market to you. You can unsubscribe from our marketing using the message's available control or by contacting us. We may retain limited suppression information to honour your choice. Essential service communications remain separate.

13. Who information is shared with

Access is limited to recipients needed for the disclosed purpose. Depending on the service, these can include authorised employees and contractors; hosting, cloud-storage, security, authentication, analytics, communication, AI, payment and support providers; and integrations you choose to use. Providers acting for us must follow appropriate contractual restrictions and safeguards. The relevant service notice identifies actual recipients or sufficiently specific recipient categories, and names providers where law or platform rules require it.

For a client-controlled project, the identified client receives information within the purposes disclosed to participants, and we process it under the agreed instructions. We do not release a participant list to unrelated sponsors simply because they sponsor the event. Where a recipient independently controls its own processing, its own notice also applies, and our disclosure must still have a lawful basis.

We may disclose necessary information to comply with law, respond to lawful requests, protect rights and safety or investigate abuse. A business restructuring or transfer may involve information subject to applicable safeguards and notice requirements. We do not treat these circumstances as unrestricted permission to disclose everything we hold.

14. International processing

We are based in India. Depending on the service and infrastructure, information may be processed in India and other countries by authorised providers. The relevant service notice provides information about actual processing locations and any restricted transfers where required. Different countries may provide different legal protections.

Where transfer rules apply, the transfer must use an applicable permitted mechanism and any necessary additional safeguards, such as approved contractual clauses, an adequacy arrangement or an applicable UK mechanism. Indian transfer restrictions and any required local storage also apply where relevant. Contact us for information about the safeguards applicable to your service and copies or descriptions where legally available. Visiting a site or accepting this policy is not consent to unrestricted international transfers.

15. Retention

We retain personal information only while needed for the stated purpose or a legal obligation. Retention depends on the service, account activity, campaign duration, output-delivery window, contractual instructions, security requirements and applicable claim or regulatory periods. The relevant product or campaign notice provides specific periods or meaningful criteria, including any shorter period for raw media, face-related information or temporary processing files.

Account data is retained while needed for the account and justified closure obligations. Event and output records follow the disclosed campaign and delivery arrangements. Support and business records are retained for resolution, administration and applicable legal periods. Consent evidence, unsubscribe records and security logs are limited to their justified compliance or protection purposes. A service's continued availability does not itself justify keeping all raw media indefinitely.

Once information is no longer needed, we delete or irreversibly anonymise it. Backups may expire on a restricted rotation schedule rather than immediately; retained copies must not be used for unrelated purposes. A legal hold can delay deletion of relevant information. For client-controlled data we follow lawful client instructions, contracted deletion arrangements and applicable duties. We explain any retention exception relevant to your request.

16. Security and incidents

We use reasonable technical and organisational measures proportionate to the risks, including appropriate access restrictions and secure handling of personal information. Required safeguards apply to our providers as well. No system or transmission can be guaranteed completely secure. Keep account credentials, verification codes and private share links confidential.

If an incident occurs, we investigate, contain it and notify affected clients, people or authorities as required by the applicable law and our obligations. Applicable notification deadlines prevail. We do not claim that a general security statement guarantees freedom from incidents or establishes a particular certification.

17. Account and data deletion

You can request deletion without reinstalling an app. Email mayank@dotexecutable.com with the subject "Privacy request - account or data deletion" and include the product or app name and the email or identifier used with it. Say whether you want to delete an account, particular data, or both. Do not send a password, OTP, payment-card number or unnecessary identity document. We ask only for proportionate verification. If email is not accessible to you, write to our postal address below.

Where an app provides account creation, use its in-app account-deletion route as well. For apps subject to platform deletion requirements, the in-app route and required external request resource must be available. Account deletion means deleting the account and associated personal information, not merely disabling access, subject to explained lawful retention exceptions. Uninstalling an app does not itself delete server-side information. Deleting an account may not cancel a separately managed app-store subscription; manage that subscription through the relevant store.

If the client controls the information, you can contact the client directly or ask us to route your request. We assist within our role and applicable law rather than requiring you to identify the responsible organisation unaided. We explain any inability to erase copies that others independently control and any available next step.

18. Your rights and response process

Depending on applicable law, you may have rights to information about processing, access, correction, deletion, portability, restriction, objection, withdrawal of consent, and complaints or appeals. Rights can have legal exceptions and do not require us to collect additional information solely to identify someone unnecessarily. We do not discriminate against you for exercising protected rights.

Send a request to mayank@dotexecutable.com, naming the service and the right you want to exercise. An authorised representative may act where permitted, subject to appropriate verification. We handle requests without a fee unless applicable law permits one. We respond within the legally required period, explain any refusal or permitted extension and provide applicable complaint or appeal options. Different laws can set different deadlines; a general procedure does not override a shorter statutory deadline.

19. Regional rights

India. We handle personal information under applicable Indian law, including relevant Information Technology Act, 2000 requirements and associated rules, and the Digital Personal Data Protection Act, 2023 and Rules as their provisions become applicable. DPDP rights, including applicable access, correction, erasure, grievance and nomination rights, apply according to their commencement and scope. Where an internal grievance process must precede a complaint to the Data Protection Board, use our contact channel first. We provide language and accessibility support where required.

EEA, UK and Switzerland. Where the relevant data protection law applies, rights may include access, correction, deletion, restriction, portability, objection and withdrawal of consent. You may object to direct marketing at any time. For requests under EU or UK GDPR, the usual response period is one month, subject to permitted extensions. You may complain to the relevant supervisory authority, including where you live, work or an alleged infringement occurred. Representative or data protection officer details are provided for services where appointment is required.

California and other US states. Where applicable state laws cover our processing, residents may have rights to access or know, correct, delete, obtain a portable copy and opt out of applicable sales, targeted advertising or specified profiling. Additional rights concerning sensitive information, authorised agents and appeals depend on the particular law. To appeal where a right applies, reply to our decision requesting an appeal; we will explain the procedure and relevant regulator route. Our no-sale and no-cross-context-advertising-sharing commitments are stated above. A required service-specific notice at collection provides applicable additional details.

Other mandatory regional privacy rights remain available where they apply. The availability of a product internationally does not mean every jurisdiction's law applies to every activity.

20. Children and age-sensitive experiences

Our general business services are intended for adults. The intended audience of each consumer product, event or app is stated in its own information. This policy does not assume that all apps have the same age limit. A family-facing, school, child-directed or mixed-audience experience requires an age-appropriate assessment, notice and safeguards before children's information is collected.

Where parental or guardian consent is required, the service must obtain and, where required, verify it before the relevant processing. We do not knowingly sell children's personal information or use it for targeted advertising. Child-directed services must meet applicable restrictions on profiling, tracking, advertising, permissions and provider use. If you believe a child's information was provided without required permission, contact us with the service details so we can investigate and take appropriate action.

21. Third parties and app stores

App stores, external websites, social networks, payment providers and other independent services can process information under their own notices. Installing through Apple or Google can involve separate store-level processing that we do not control. Using a store account does not mean we receive all the information in it.

We remain responsible for our own integrations, SDK choices and disclosures. A reference to a provider's policy does not remove our duties. App-store privacy labels, Google Play Data safety disclosures and permission explanations must accurately reflect the particular app and its third-party components alongside this policy.

22. Policy changes

We update this page when our practices or relevant requirements change and show the last-updated date. We provide additional notice for material changes where required and obtain fresh consent before a new use that requires it. Changes do not retrospectively authorise incompatible processing. Product-specific notices and store disclosures are updated when the relevant product changes.

23. Contact and complaints

For privacy questions, access or deletion requests, withdrawal of consent or a complaint, contact DOT-EXE INNOVATIONS PRIVATE LIMITED at mayank@dotexecutable.com. Include the product, app, website or client campaign name so we can identify the relevant processing. This is a general privacy contact, not a representation that the recipient holds a formally appointed statutory role.

Postal address: DOT-EXE INNOVATIONS PRIVATE LIMITED, Flat No A-303, Plot No-3, Neelachal CGHS Ltd., Sector-4, Dwarka, New Delhi, India 110078.

Where a law requires a named grievance officer, data protection officer or representative, their designated details must be provided in the applicable service notice or contact information. You may also use any regulator or other complaint channel available under applicable law.