Privacy Policy.

1. Introduction

PayBrill Technologies Pvt. Ltd. ("PayBrill", "we", "us" or "our") operates a white-label fintech platform that enables businesses to provide digital payment services such as mobile and DTH recharges, bill payments (BBPS), domestic money transfer, AEPS, Aadhaar Pay, QR payments, wallet services, merchant services and PAN services (collectively, the "Services").

This Privacy Policy explains what personal information we collect when you visit our website, register on or use our platform or mobile applications, or transact through the Services, and how we use, share and protect that information.

By using our website or Services, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please do not use our website or Services.

2. Information We Collect

We collect the following categories of information:

• Account & business information: your name, business name, contact details (email address, phone number), business registration details and related particulars provided at registration.
• KYC documents: as required by applicable law and our banking partners, we may collect identity proofs (such as PAN, Aadhaar or other government-issued ID), address proofs, photographs, bank account details and business documents.
• Transaction information: details of recharges, bill payments, money transfers, AEPS/Aadhaar Pay transactions, wallet balances, top-ups, commissions, settlements and dispute records.
• Technical information: IP address, device and browser type, operating system, application version, access times and system logs.
• Usage information: pages visited, features used and other interaction data that helps us improve the platform.
• Communication information: records of your support tickets, emails and calls with our support team (including call recordings for quality and training purposes, where permitted).

3. How We Use Your Information

We use the information we collect to:

• Provide, operate and improve the Services, including processing transactions and maintaining your wallet and ledger;
• Verify your identity and complete KYC requirements;
• Calculate and credit commissions, and process settlements and payouts;
• Detect, prevent and investigate fraud, misuse and suspicious activity;
• Comply with legal, regulatory and contractual obligations, including record-keeping and reporting requirements under applicable financial regulations;
• Provide customer support and respond to your queries and disputes;
• Communicate important updates about the Services, security alerts and maintenance notifications;
• Monitor and improve the performance, security and usability of our platform.

We do not use your information for purposes that are incompatible with the purposes described in this policy without your consent.

4. KYC & Regulatory Requirements

As a provider of financial services, PayBrill is required to comply with applicable Indian laws and regulations, including Know Your Customer (KYC) and Anti-Money Laundering (AML) requirements. This means we must:

• Verify the identity of businesses and users on our platform before enabling certain services;
• Maintain records of transactions for periods prescribed by law;
• Report suspicious transactions to the appropriate authorities where legally required;
• Share necessary information with our banking and payment partners for transaction processing and compliance.

5. Cookies & Similar Technologies

Our website and platform use cookies and similar technologies (such as local storage) to:

• Keep you signed in and remember your preferences;
• Understand how the website and platform are used (analytics);
• Protect the platform against fraud and abuse.

You can control or delete cookies through your browser settings. Disabling certain cookies may affect some features of the platform.

6. Data Sharing & Disclosure

We may share your information:

• With transaction partners: operators, billers, banks and payment service providers — strictly as needed to complete your transactions and provide confirmations;
• With service providers: cloud hosting, analytics, communication and support-tool vendors who process data on our behalf under confidentiality and security obligations;
• For legal reasons: to comply with applicable law, regulation, court order or lawful requests from authorities;
• With your consent: where you have given permission for a specific disclosure;
• Business transfers: in the event of a merger, acquisition or sale of assets, subject to notice to you.

We may also share aggregated, anonymized data that can no longer be linked to you for analytics and improvement purposes.

7. Data Security

We implement industry-standard technical and organizational measures to protect your information, including:

• Encryption of data in transit (TLS) and at rest;
• Role-based access control and least-privilege access to production systems;
• Comprehensive audit logging and transaction monitoring;
• Regular security reviews of our infrastructure and development practices.

However, please note that no method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If a data breach affects your information, we will notify you and the relevant authorities as required by applicable law.

8. Data Retention

We retain your information:

• For as long as your account is active and the Services are used by you;
• For additional periods as required by applicable financial and tax regulations — financial records are typically retained for a minimum of five (5) to ten (10) years;
• As necessary to resolve disputes, enforce our agreements and protect legal rights.

When retention is no longer required, we securely delete or anonymize the information.

9. Your Rights & Choices

Subject to applicable law, including the Digital Personal Data Protection Act, 2023, you have the right to:

• Request access to the personal information we hold about you;
• Request correction of inaccurate or incomplete information;
• Request erasure of your information, where retention is not required by law;
• Withdraw consent to optional processing, where applicable;
• Nominate another individual to exercise your rights in specified circumstances;
• Lodge a grievance with our Grievance Officer (see Section 12).

To exercise any of these rights, write to us at support.paybrill@gmail.com with the subject line "Data Request". We will verify your identity and respond within the timelines prescribed by applicable law. Please note that certain rights may be limited where we are legally obliged to retain the data (for example, KYC and transaction records).

10. Children's Information

Our Services are intended for businesses and individuals aged 18 years or above. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us personal information, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology or legal requirements. The "Last updated" date at the top of this page shows when it was last revised. Material changes will be communicated through the platform or by email. Your continued use of the Services after changes take effect constitutes acceptance of the updated policy.

12. Contact Us & Grievance Officer

If you have any questions, requests or concerns about this Privacy Policy or our data practices, contact us:

For grievances relating to your personal data, you may contact our Grievance Officer at support.paybrill@gmail.com with the subject line "Privacy Grievance". We acknowledge grievances within 48 hours and aim to resolve them within 30 days, in line with applicable legal requirements.