Privacy Policy

This Privacy Policy applies to all personal data processed by M/S Paynancial Technology Private Limited ("Paynancial," "we," "us," or "our") in connection with our website, mobile applications, APIs, dashboards, and payment infrastructure services (together, the "Services"). It covers data belonging to our merchants, their end-customers where we act as a payment processor, website visitors, job applicants, and business contacts.

By using our Services, you agree to the collection and use of information described here. If you're interacting with Paynancial as the customer of one of our merchants (for example, completing a checkout that runs on our payment gateway), that merchant's own privacy policy also applies to how they use your data — we act as their data processor for transaction data, and this policy explains our own obligations in that role.

We collect information in three broad ways: what you give us directly, what we collect automatically, and what we receive from third parties.

Information you provide

• Account & KYC data — name, business name, PAN, GSTIN, bank account and IFSC details, director/authorised-signatory identity documents, and address proof submitted during merchant onboarding.
• Contact information — email address, phone number, and billing address.
• Transaction details — amounts, timestamps, order references, and payment method metadata processed through our gateway.
• Support communications — anything you share with us via email, chat, or phone when requesting help.

Information collected automatically

• Device & usage data — IP address, browser type, operating system, device identifiers, and pages viewed on our dashboard or website.
• Log data — API request logs, authentication events, and error logs generated as you use our Services.
• Cookies & similar technologies — see our Cookie Policy for full detail.

Information from third parties

• Card networks, banks & UPI apps that route payment confirmations back to us.
• Identity verification providers used to validate KYC submissions against government-issued ID databases.
• Credit bureaus or risk-scoring partners, where relevant to underwriting merchant accounts.

We use the data described above to:

• Process payments, payouts, settlements, and refunds accurately and on time.
• Verify merchant identity and comply with RBI-mandated KYC and anti-money-laundering obligations.
• Detect, investigate, and prevent fraud, unauthorised transactions, and platform abuse.
• Provide customer support and respond to your requests.
• Maintain and improve the reliability, security, and performance of our Services.
• Send transactional notifications (payment confirmations, settlement alerts, security notices) and, where you've opted in, product updates.
• Meet our statutory reporting, tax, and audit obligations.

Where the Digital Personal Data Protection Act, 2023 ("DPDP Act") applies, we process personal data on one or more of the following grounds: your consent, the necessity of processing to perform a contract with you, our legitimate interests in operating a secure payments platform, and compliance with legal obligations imposed by the Reserve Bank of India, the Prevention of Money Laundering Act, and other applicable financial regulation.

Where consent is the basis for processing — for example, marketing communications — you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

We do not sell personal data. We share it only in the following circumstances:

• Payment ecosystem partners — banks, card networks, UPI switches, and payment aggregators necessary to complete a transaction you've initiated.
• Service providers — cloud infrastructure, identity verification, SMS/email delivery, and analytics vendors who process data on our behalf under contractual confidentiality obligations.
• Regulators & law enforcement — where required by the RBI, courts, or other authorities under applicable law.
• Corporate transactions — in connection with a merger, acquisition, or asset sale, subject to the same protections described in this policy.

Every third party we share data with is bound by written agreements requiring them to protect it to a standard consistent with this policy.

We apply layered technical and organisational safeguards, including encryption of data in transit (TLS 1.2+) and at rest, role-based access controls, network segmentation, and continuous monitoring. Full detail on our security programme is available on our Security page.

No system is completely immune to risk. If a breach affecting your personal data occurs, we will notify affected users and the relevant authorities as required by law.

We retain personal data for as long as necessary to provide the Services and to meet our legal, accounting, and regulatory obligations. Transaction and KYC records are typically retained for a minimum of ten years from the date of the transaction, in line with RBI and PMLA record-keeping requirements. Data no longer required is securely deleted or anonymised.

Subject to applicable law, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Erase your data, where retention is not required by law.
• Withdraw consent for processing based on consent.
• Nominate another individual to exercise your rights in the event of death or incapacity, as provided under the DPDP Act.
• Grievance redressal — raise a complaint with our Grievance Officer before approaching the Data Protection Board of India.

To exercise any of these rights, write to us at hello@paynancial.com. We aim to respond within 30 days.

Our website and dashboard use cookies for authentication, security, and analytics. You can manage your preferences at any time through our Cookie Policy, which describes each category of cookie we use and how to opt out of non-essential ones.

Our Services are intended for businesses and individuals who are at least 18 years old and legally capable of entering into a contract. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected such data, we will delete it promptly.

Personal data collected in India is primarily stored and processed within India in line with RBI data localisation requirements for payment system data. Where a limited transfer outside India is necessary — for instance, to a global service provider — we ensure appropriate contractual safeguards are in place consistent with the DPDP Act.

We may update this policy from time to time to reflect changes in our practices or applicable law. Material changes will be notified via email or an in-product notice, and the "Last updated" date at the top of this page will always reflect the current version.

For any questions about this Privacy Policy or to exercise your data rights, reach our team at hello@paynancial.com.