Privacy Policy
Version 2.4 • Effective for all merchants, visitors, and transaction routing users
At MyMobPay (mymobpay.tech), we treat data confidentiality and merchant isolation as core engineering principles. This Privacy Policy details how we collect, process, isolate, and safeguard data in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
1. Zero Sensitive Financial Data Guarantee (Non-Custodial Security)
We NEVER request, collect, intercept, or store sensitive banking credentials. This includes debit/credit card numbers, CVV codes, net banking passwords, UPI MPINs, or ATM PINs.
End-consumers authorize payments directly through official, NPCI-regulated UPI client applications (such as Google Pay, PhonePe, Paytm, BHIM, or Cred). Consumer banking authentication happens entirely within the bank's encrypted sandbox, completely isolated from our servers.
2. Information We Collect (Strict Data Minimization)
We practice strict data minimization. We only collect details that are essential for account verification, technical routing, and transaction validation:
A. Merchant Profile & Verified Contact Data
Business name, business email address, verified Indian mobile phone number (+91), password cryptographic salt & hash, and linked Google profile identifier (if opted).
B. Settlement Configuration & Technical Identifiers
Merchant UPI Virtual Payment Address (VPA) / Bank Account details for direct buyer payments, and merchant-specified outbound webhook URLs with HMAC signing secrets.
C. Transactional Metadata
Bill amount, merchant order reference ID, generated payment session token, 12-digit bank UTR reference number (upon credit), payment timestamp, and order status (Pending, Paid, Expired).
3. Automated Notification Forwarding & SMS Parsing Mechanics
To confirm direct bank credits without needing private bank API access, merchants utilize our automated notification listener forwarder (or incoming bank credit email forwarder):
- Targeted Extraction Only: Our verification middleware performs regex pattern parsing strictly for the credit amount and 12-digit UTR reference number matching the merchant's active orders.
- Instant In-Memory Processing: Unrelated notifications, personal SMS messages, or non-banking communications received by the forwarder are immediately ignored and purged from memory.
- No Log Retention of Private Text: Once an order transitions to
PAID, raw SMS notification payloads are scrubbed. Only the numerical amount and matched UTR are preserved in the order ledger for audit trails.
4. Purpose of Data Processing
Data collected is utilized strictly for executing legitimate operational services:
- Generating dynamic, order-locked UPI QR codes and deep-link checkout intents.
- Matching incoming bank credits via automated UTR reconciliation.
- Dispatching cryptographically signed HMAC-SHA256 webhook notifications to your backend server.
- Delivering multi-channel security OTPs (WhatsApp, Telegram, SMS) for merchant phone verification and login access.
- Preventing unauthorized platform access, fraud attempts, and abuse of API limits.
5. Absolute Non-Sale of Merchant & Customer Data
Data disclosure is strictly restricted to essential technical infrastructure providers:
- Cloud hosting and database infrastructure adhering to ISO/IEC 27001 and SOC2 standards.
- Transactional messaging providers (such as Meta WhatsApp Cloud API / Telegram Bot API) used exclusively to deliver merchant OTPs.
- Law enforcement agencies only when compelled by lawful court orders, subpoenas, or statutory obligations under Indian law.
6. Data Security, Encryption & Storage Standards
We implement enterprise security controls to ensure data integrity and confidentiality:
All traffic across merchant browsers, payment links, and backend REST APIs is protected via modern 256-bit TLS encryption.
Passwords and webhook secrets are cryptographically hashed using industry-standard hashing algorithms (bcrypt/HMAC).
7. Merchant Rights under the DPDP Act, 2023
As a merchant (Data Principal under Indian data protection law), you possess distinct rights regarding your personal information:
- Right to Access: Review your stored profile details and historical transaction logs directly within your Merchant Console.
- Right to Correction: Update outdated mobile numbers, contact emails, or UPI VPAs through your profile settings.
- Right to Erasure & Termination: Request complete account deletion and data scrubbing by contacting our privacy desk (subject to legal retention requirements for tax and accounting audits).
8. Statutory Grievance Redressal Officer
In accordance with the Information Technology Act, 2000, and rules made thereunder, as well as the DPDP Act 2023, the details of our designated Grievance Officer are provided below:
Grievance Officer: Legal & Compliance Cell
Entity: MyMobPay Technology
Email: privacy@mymobpay.tech / grievance@mymobpay.tech
Response Turnaround: Within 48 hours on business days
© 2026 MyMobPay Gateway. Secured by 256-bit TLS encryption.