Privacy policy

Version: 2026-11-13.1
Effective date: 13 November 2026
This policy applies from the effective date above.

At a glance

• OCR Matrix is a product of Softfire Infotech, which operates the store and is responsible for the personal information described here.
• We use account, order and payment-status information to deliver purchases and protect access. Razorpay processes payments, Brevo handles transactional email, Google Cloud hosts the store, and Cloudflare provides private file storage and demo hosting.
• We do not ask you to send a password, complete card number, CVV, bank OTP or UPI PIN to support. Payment metadata received from a provider can still contain personal information.
• A privacy request is reviewed with you; deleting a browser cookie or closing an account does not automatically erase financial records, active disputes or backup copies.
• This policy explains data handling. It is not a blanket consent request for advertising, email-open tracking or any unrelated future purpose.

1. Who is responsible and how to contact us

OCR Matrix (Optimized Code Resources) is a product of Softfire Infotech. References to “we”, “us” and “our” mean Softfire Infotech. This policy covers the store at ocrmatrix.com, our author-hosted template demonstrations and communications about them. It does not govern an independent application a purchaser builds or operates using our templates.

Consumer/privacy grievance contact: Vijay Survase, Grievance Officer
Email: contact@softfireinfotech.com
Telephone: +91 9960113442
Postal address: Softfire Infotech, 376/1, Sardewadi, Kolekar Vasti, Indapur, District Pune, Maharashtra 413106, India.

You can use the same contact for questions, correction, access, consent withdrawal or deletion requests. A store/product name does not replace the identity of the operating business.

2. Information we collect

Information you provide

Do not send live API keys, passwords, government identity documents, bank credentials or your own customers' confidential data in an ordinary support request. We will explain and minimise any verification information that is genuinely necessary for a particular case.

Information received from payment and email providers

Razorpay may provide transaction identifiers, account/order references, amount, currency, payment method, payment/refund/dispute status, timestamps and metadata such as payer contact information, a UPI identifier or masked card-related details. The exact fields depend on the payment method and provider payload. We retain relevant transaction records and authenticated webhook information; we do not treat those payloads as free of personal data merely because we do not store a complete card number.

Sensitive payment authentication is entered into the provider's payment interface or your bank/app, not a store support form. See Razorpay's buyer privacy notice for its processing.

Brevo may provide sending, delivery, bounce and other email events. When tracking is enabled, it can also report opens or clicks and related technical information. Such events can be affected by mail scanners and image proxies; they do not reliably prove that a person read a message. Website analytics choices do not automatically change a provider's email-tracking setting. You may block remote email images through your email client and contact us about tracking choices. Delivery/error information is used to operate necessary service emails.

Technical information

Our hosting, security and delivery systems can record IP addresses, request times, requested paths, browser/user-agent information, errors, authentication events and file-delivery requests. Account sessions can associate technical records with an account. Download authorisation records associate an entitlement with a file and the time a link was issued. Providers may generate their own infrastructure/security logs.

Private file links contain temporary access signatures. Treat a complete signed URL as confidential while it is valid; it is not a public document link.

3. How and why we use information

We use relevant information to:

1. Create, authenticate and secure accounts, verify email addresses and process account recovery.
2. Create and confirm orders, check provider responses, deliver licensed files and maintain your order history.
3. Send transactional messages such as verification links, password resets, receipts, access notices and important product/security communications.
4. Provide included support, answer enquiries and assess separately requested custom work.
5. Investigate failed or duplicate payments, refunds, disputes, misuse, faults and security incidents.
6. Maintain business, tax and legal records, respond to lawful requests and establish or defend legal claims.
7. Measure store use and campaign attribution as described in the cookies/measurement section, subject to applicable consent requirements.

We rely on consent where the law requires it; information voluntarily supplied for a requested service is used only for a legally permitted purpose connected with that request. Processing required by a legal duty is handled on that basis. For an optional new purpose requiring consent, we will explain it and seek that consent separately. Accepting purchase terms is not consent to unrelated marketing.

If a law applicable to you requires a particular additional legal basis, we will identify and apply that basis rather than treating a general reference to business interests as sufficient in every jurisdiction. We do not claim that every provision of every privacy statute applies identically to every visitor.

4. AI-related products and customer applications

The storefront currently sells source-code products; buying an AI-themed template does not itself submit your prompts, documents or account records to a hosted AI model. The Nodexa and FlowTask previews use demonstration functionality rather than providing a production AI service for your real data.

If a future feature sends inputs to an external model or adds a new use of personal information, its actual processing, provider and choices will be explained before that feature is used. Do not enter real customer, health, financial or other confidential information into a public demonstration.

When you deploy a purchased template, you determine the personal-data processing of your application and need your own appropriate notices and safeguards. This policy does not make Softfire Infotech the operator of every app built using the code. If you send us an end user's information for support, disclose only what is necessary and what you are authorised to share.

5. Who receives information

We do not sell your personal information or make a purchase conditional on agreeing to unrelated advertising. A service provider's involvement is not permission to use your information for an unrelated purpose. Some providers have their own legal obligations and privacy responsibilities, particularly in financial services; their notices explain that processing.

Provider information: Razorpay, Brevo, Google Cloud data processing terms and Cloudflare. Those notices do not replace our responsibilities for the store.

6. Cookies, local storage and measurement

Essential functions and preferences

The store uses cookies/storage for authenticated sessions, anti-forgery protection, security, consent choices and interface preferences. Blocking essential cookies can prevent sign-in, checkout or download authorisation.

The current account session is configured for about 120 minutes of inactivity, with expiry refreshed during use. If you choose “Remember me”, the authentication framework may set a persistent login cookie for up to 400 days, subject to browser limits and earlier sign-out or security invalidation. Signing out ends the current login; changing or clearing browser storage can also remove local preferences.

The session cookie may retain the older name softfire-templates-session; that name is a technical identifier and does not denote another business. Preference storage can include appearance, browser local storage, and sidebar settings. Appearance preferences can persist for approximately one year; browser local storage can remain until cleared. These durations are distinct from server-side financial-record retention.

Optional measurement and your choices

The store presents “Essential only” and “Allow analytics” choices. Optional session/campaign attribution uses a pseudonymous analytics identifier and campaign parameters such as UTM values when enabled. Attribution is configured for a 30-day window, but this is not a promise that every historical event is deleted after 30 days.

Your measurement choice: optional product-view, demo-click and session/campaign analytics are enabled only after you choose “Allow analytics”. Choosing “Essential only” stops these optional analytics. Necessary account, transaction, delivery and security records continue because they are required to operate and protect the service. Pseudonymous analytics identifiers are not necessarily anonymous; records can be identifiable when combined with other information.

Use the “Privacy choices” link in the website footer to change or withdraw your optional analytics choice. You may also change browser cookie/storage settings or contact us for help. Clearing account/session cookies can also sign you out. Withdrawing consent does not retrospectively make earlier lawful processing unlawful or erase records that must be retained on another valid basis. Where consent is legally required for a measurement activity, disclosure alone is not a substitute for obtaining it.

Third-party payment and external demo/provider pages may use their own technologies. A provider's independent cookies, logs or email pixels are not controlled solely by the store's website banner.

7. Author-hosted demonstrations

Our template demonstrations can run on a separate domain, currently demo.softfireinfotech.com. They use fictional records and may store demonstration sessions, preferences, form inputs or sample changes in cookies or browser storage. Their hosting provider also receives request information. Browser-stored demonstration content may remain until you clear that storage or the demo resets it.

Use only invented/sample data. Demo access is not the same as your purchasing account, and a demo sign-in does not establish ownership of a paid order. We do not claim that demo inputs can never reach a server; the particular demo may submit information to a demonstration endpoint or log a request.

8. International processing

Our business is based in India, but processing is not restricted to India. The current application server is in Google Cloud's US Central region. Cloudflare and Brevo can also process information through infrastructure or personnel in other countries, according to their services and arrangements.

We will respect restrictions and safeguards that apply to a transfer, including any relevant Indian legal or regulatory requirement. Where another applicable law requires contractual transfer safeguards or other measures, those must be addressed for the relevant processing. We do not rely on a sentence in this policy as a blanket waiver of those requirements or claim that every provider stores all data in one country.

9. Retention

Retention depends on the record and its purpose, not simply on whether a browser session is still active:

• Account and authentication information: while needed to operate and secure your account, followed by review when you request closure, become inactive or a particular security record is no longer needed.
• Orders, licences, payment/refund/dispute and accounting records: for fulfilment, continuing licence/access evidence, applicable tax/recordkeeping periods and a relevant claim or legal hold. Closing an account does not erase a valid financial record.
• Support and complaint correspondence: for the matter's handling, reasonable follow-up and applicable legal/accountability needs; unnecessary attachments and secrets should not be retained merely because they were sent to us.
• Security, access and download logs: for proportionate security, investigation and applicable legal/regulatory retention obligations. An ongoing incident or legal hold may require longer retention.
• Optional attribution and measurement: for the disclosed purpose and a proportionate review period; a 30-day attribution window is not a database-wide erasure schedule.
• Backups: protected copies may remain after a change to the live system until the applicable backup copy is retired. They are not to be used to restart unrelated processing; a restoration must take account of deletion/restriction decisions.

Erasure currently requires a reviewed process rather than an instant self-service action. We will explain which information can be erased or anonymised and which must be retained, the reason for retention and the applicable period or criteria. We do not promise that all systems and independent providers erase every copy immediately after an account request. Retention is subject to legal requirements, not an unlimited right to keep information for any future purpose.

10. Security

We use measures appropriate to the service, including HTTPS, password hashing, access-controlled accounts, private file storage, expiring download authorisations and validation of payment signatures. Certain sensitive application records, such as webhook payloads and account-email queue jobs, are encrypted. Authorised administrative/support access may be needed to investigate a problem, with access limited to that task.

No website, email system or transmission method is completely secure. We do not claim an independent security certification, perfect security or encryption of every field. If a personal-data incident occurs, we will assess it, take appropriate containment/remediation steps and make notifications required by the law applicable to that incident.

Protect your device, passwords, recovery codes and download links. Report suspected unauthorised access to contact@softfireinfotech.com. Do not send a secret as proof of an incident.

11. Your requests and choices

You may ask us to explain processing, provide access to relevant personal information, correct inaccurate details, review deletion or restriction, withdraw optional consent, or investigate a privacy complaint. Additional rights, such as a legally required portable copy, objection, nomination or complaint to a statutory authority, depend on the law and provisions applicable to your situation; this policy does not remove them.

You can edit supported profile information through your account. For other requests, email contact@softfireinfotech.com with “Privacy request” and a concise description. We may ask for proportionate proof that the request concerns you or someone you are authorised to represent. We will not ask for a password or collect an entire identity document where a less intrusive check is sufficient.

A request can be limited by another person's rights, financial-record obligations, an active dispute, security needs or another lawful exception. We will explain a refusal or partial response as far as permitted, identify a follow-up route and meet the deadline that applies. The app's “Request deletion” option directs you to support because erasure is reviewed rather than performed immediately.

Service communications needed for your account, purchase, security or a legal duty are different from optional marketing. Contact us if you no longer want an optional communication; stopping a necessary receipt or password-reset service may affect the service you requested.

12. Children

Purchasing accounts are intended for adults aged 18 or over. We do not intentionally invite children to submit personal information or create purchasing accounts. If you believe a child has provided information, contact us so we can assess the situation and take appropriate steps, including restriction or deletion where required. Do not submit a child's personal information in a public demo.

13. Privacy complaints and changes

Vijay Survase, Grievance Officer, can be contacted at contact@softfireinfotech.com, +91 9960113442 or the business address in section 1. We acknowledge consumer complaints within 48 hours and handle them within the applicable statutory period; ordinary consumer complaints are to be redressed within one month. A different mandatory privacy-request deadline will be followed where it applies. You may approach an available regulator, consumer forum or court without first surrendering that right to the store.

Updates will show a version and effective date. Material changes will be brought to your attention appropriately. A new purpose requiring consent will not be authorised merely by silently changing this page. Where personal information is retained from earlier transactions, changes will respect the rights and obligations that continue to apply to those records.