Privacy policy

Draft for legal review. This page is a structured starting point, not legal advice. Every highlighted item must be filled in, and the whole page checked by a lawyer familiar with Indian payments and data protection law before you publish it. What you must disclose depends on what your systems actually collect and on the approvals you hold.

1. Who we are

This policy explains how Idhipay Private Limited ("IDHIPAY", "we", "us") handles personal data when you use our website, our app, our payment devices and our services.

Our registered office is PS Abacus, Unit No. 421, Plot No. IIE/23, New Town, North 24 Parganas, West Bengal – 700161, India.

For the purposes of the Digital Personal Data Protection Act, 2023, we are a Data Fiduciary for the personal data described below. [Confirm this characterisation, and state where you act only as a Data Processor for a partner bank or payment aggregator.]

2. Information we collect

[This list must match what your systems actually capture. Remove anything you do not collect and add anything missing.]

Information you give us

• Your name, mobile number and email address when you sign up.
• Business details such as trading name, address and the nature of your business.
• Documents and identifiers required to verify you, which may include PAN, GST details and KYC documents.
• The bank account details we settle your collections to.
• What you send us when you contact support.

Information created when you use the service

• Transaction records: amount, date and time, payment method and status.
• Device and app information such as device model, operating system, app version and IP address.
• Logs of how the service is used, and of errors.
• [Location data, if you collect it — say when and why.]

Information from others

• Confirmations and status from banks, payment networks and our payment partners.
• [Credit information or bureau data, if lending partners share it with you.]

We do not store full card numbers or UPI PINs. Card details are handled by our regulated partners in line with the applicable rules on card data storage and tokenisation. [Confirm with your payments team and state who stores what.]

3. How we use it

• To set you up, verify your identity and business, and keep your account running.
• To process payments and settle money to your bank account.
• To announce payments on your speaker and show them in your app.
• To provide support and respond to complaints.
• To detect and prevent fraud, misuse and money laundering.
• To meet legal, regulatory, audit and tax obligations.
• To improve the product and fix problems.
• [Marketing, if you do it — say so, and how to opt out.]

4. Your consent

Where the law requires your consent, we ask for it before we collect your data and we tell you what it will be used for. You can withdraw consent at any time by writing to us using the details below. Withdrawing consent does not affect anything we did while the consent was valid, and some data must be kept to meet legal obligations, which may mean we can no longer provide parts of the service.

[Describe how consent is actually captured in your signup flow and how withdrawal is handled operationally.]

5. When we share it

We do not sell your personal data. We share it only as set out here:

• Banks, payment aggregators and networks, so payments can be processed and settled.
• Lending partners, where you ask for a loan offer or accept one.
• Service providers who work for us, such as hosting, communications, KYC verification and analytics, under contracts limiting what they can do with it. [List the categories you actually use.]
• Regulators, law enforcement and courts, where we are required to.
• A buyer, if the business or part of it is sold or reorganised.

[If any data is stored or processed outside India, say where and on what basis.]

6. Banks and partners

Parts of our service are delivered with regulated partners, including [name the partners, for example the payment aggregator and sponsor bank] and, for loans, Easebuzz and Federal Bank. When they handle your data they do so under their own policies as well as ours. [Link to those policies.]

7. Cookies and tracking

[State what this website and the app actually set. If the site sets only what is strictly necessary, say that. If you use analytics or advertising tools, name them and explain the choices available.]

8. How we protect it

We use reasonable security safeguards to protect personal data, including encryption of data in transit, access controls, and monitoring. [Describe your actual measures: encryption at rest, role-based access, logging, penetration testing, staff training, and any certifications such as PCI DSS or ISO 27001.]

No system is completely secure. If a personal data breach occurs, we will notify affected users and the Data Protection Board as required. [Confirm your breach response process and timelines.]

9. How long we keep it

We keep personal data for as long as your account is active and afterwards for as long as we are required to by law — payment and KYC records must be retained for periods set by Indian law and by our regulated partners. [State the actual retention periods for each category of data.]

10. Your rights

Subject to the Digital Personal Data Protection Act, 2023 and the rules under it, you may:

• ask for a summary of the personal data we hold about you and how we process it;
• ask us to correct or complete data that is wrong or incomplete;
• ask us to erase data we no longer need to keep;
• nominate someone to exercise these rights if you die or become incapacitated;
• complain to us, and then to the Data Protection Board of India.

To make a request, write to our Grievance Officer using the details below. We will respond within [number] days.

The rules under the Act were notified on 14 November 2025, and the substantive obligations on notice, consent, security safeguards, breach reporting and data principal rights take effect from 14 May 2027. We are building towards those requirements, and this policy will be updated as they come into force. [Confirm your compliance timeline with your legal adviser.]

11. Children

Our services are for businesses and are not intended for anyone under 18. We do not knowingly collect personal data from children. [State what you do if you discover you have.]

12. Changes to this policy

We may update this policy. When we do, we will change the date at the top of this page, and where the change is significant we will tell you in the app or by email.

13. Contact us

For any question about this policy or about your data, contact our Grievance Officer:

If you are not satisfied with our response, see our grievance redressal page for how to escalate.