1. Introduction
RupyaSetu ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, retain, and protect your personal information when you use our mobile application, website, and related services (collectively, the "Services").
By using our Services, you consent to the collection and use of your information as described in this policy. If you do not agree, please do not use our Services.
2. Information We Collect
2.1 Personal Information
- Phone Number: Used for OTP-based authentication and account identification
- Full Name: Provided during registration for account identification
- Aadhaar Number: Required only for AEPS (Aadhaar Enabled Payment System) transactions, processed securely via authorized banking channels
2.2 Transaction Data
- Mobile and DTH recharge details (operator, amount, number)
- AEPS transaction records (withdrawal, balance enquiry, mini statement)
- UPI payment references (UTR numbers)
- Wallet transaction history (credits, debits, commissions)
2.3 Device and Usage Data
- Device type, operating system, and app version
- IP address and approximate location (for security purposes only)
- App usage patterns and session data
3. How We Use Your Information
- To provide, maintain, and improve our recharge, AEPS, and payment services
- To authenticate your identity via OTP verification
- To process transactions and manage your vendor wallet
- To calculate and credit commissions on successful transactions
- To communicate important service updates and notifications
- To detect and prevent fraud, unauthorized access, and security threats
- To comply with legal and regulatory requirements
4. Data Retention
We retain your data for specific periods based on the type of information and applicable regulatory requirements.
4.1 Transaction Records
All financial transaction records (recharges, AEPS transactions, UPI payments, wallet transactions) are retained for a minimum of 7 (seven) years from the date of the transaction, in compliance with RBI (Reserve Bank of India) guidelines, the Prevention of Money Laundering Act (PMLA), and other applicable financial regulations.
4.2 Account Information
Your personal account information (name, phone number) is retained for as long as your account remains active. Upon account deletion request, your personal identification data will be anonymized or deleted within 30 (thirty) days, except where retention is required by law.
4.3 Aadhaar Data
Aadhaar numbers provided for AEPS transactions are not stored on our servers. They are transmitted directly to the authorized banking partner (via Paysprint) using AES-128-CBC encryption and are used solely for the purpose of the specific transaction.
4.4 Device and Log Data
Device information and server logs are retained for 90 (ninety) days for security monitoring and debugging purposes, after which they are automatically purged.
4.5 Wallet and Commission Records
Wallet balance history and commission records are retained for 7 (seven) years in line with financial record-keeping requirements.
5. Data Security
- Encryption: All data in transit is protected using TLS/SSL encryption. Sensitive data such as Aadhaar numbers are encrypted using AES-128-CBC before transmission.
- Authentication: OTP-based authentication with JWT (JSON Web Token) session management
- Access Control: Strict role-based access controls for admin operations
- No Payment Storage: We do not store any bank account details, UPI PINs, or biometric data on our servers
- Admin Approval: All wallet recharges and UPI payments require admin verification
6. Information Sharing
We do not sell, trade, or rent your personal information. We share data only with:
- Paysprint: Our authorized API partner for processing recharges, DTH top-ups, and AEPS transactions
- Telecom Operators: To process mobile and DTH recharges (via Paysprint)
- Banking Partners: For AEPS transaction processing (via Paysprint)
- Legal Authorities: When required by law, court order, or government regulation
7. Your Rights
- Access: You can view your transaction history, wallet balance, and profile information within the app at any time
- Correction: You can update your name and profile details through the app
- Deletion: You can request account deletion by contacting us at support@rupyasetu.com. Personal data will be deleted within 30 days, subject to regulatory retention requirements
- Data Portability: You can request a copy of your personal data by contacting support
- Withdraw Consent: You may stop using our Services at any time. Note that withdrawing consent may affect your ability to use certain features
8. Cookies and Tracking
Our website may use essential cookies for session management and security. We do not use third-party advertising trackers. The mobile app does not use cookies.
9. Children's Privacy
Our Services are not intended for individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that we have collected data from a minor, we will take steps to delete it promptly.
10. Changes to This Policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last Updated" date. Continued use of our Services after such changes constitutes acceptance of the updated policy.
11. Contact Us
If you have any questions about this Privacy Policy or your personal data, please contact us: