1. Scope of this Policy
This Privacy Policy applies to Zoopay ("Zoopay", "we", "us"). It covers the Zoopay website, merchant dashboard, partner/agent portal, and API, collectively the "Service". It applies to merchants, partners/agents, and their authorized users ("you"). It does not apply to the privacy practices of the underlying payment gateways we connect to, or banks, which are governed by their own policies.
2. Information We Collect
Account & verification information
When you or your business registers as a merchant or partner, we collect information needed to open and verify an account: business name and type, contact name, email, phone number, KYC documents, bank account details, and related compliance information required under applicable law.
Transaction information
To route and reconcile payments, we process transaction metadata: amount, currency, order reference, timestamp, the gateway used, status (success, failed, refunded), and settlement records. We do not control or store the underlying payment method's full account details — see Card Data & PCI-DSS.
Technical & usage information
Like most web services, we automatically log IP address, browser/device type, pages visited, and timestamps, generally for security, fraud prevention, and diagnosing issues.
Information from partners & referrals
If you're onboarded by an agent/partner through an invite link, we receive the referral relationship so commissions can be attributed correctly.
3. How We Use Information
- Operate the routing engine: selecting a gateway, detecting failures, and rerouting transactions.
- Process settlements and partner commission payouts.
- Verify identity and conduct KYC/AML checks required by law or by our banking and gateway partners.
- Detect, investigate, and prevent fraud, abuse, and security incidents.
- Provide support, send service notices, and respond to inquiries.
- Meet record-keeping, tax, and regulatory obligations.
- Improve reliability and performance of the Service.
We do not sell your personal information.
4. How We Share Information
| Recipient | Why |
|---|---|
| Connected payment gateways | To process the transaction you initiated through the gateway our routing engine selects. |
| Banking & payout partners | To settle funds to your registered bank account. |
| Your referring partner/agent | Limited account status and commission-relevant data, where a referral relationship exists. |
| Regulators, banks, and law enforcement | Where required by law, court order, or the rules of a card network or banking partner. |
| Service providers | Infrastructure, hosting, and support vendors bound by confidentiality obligations, acting only on our instructions. |
5. Card Data & PCI-DSS
Zoopay is built on a PCI-DSS compliant infrastructure. We do not store raw card numbers, CVVs, or expiry dates on our own servers. Card details entered at checkout are captured and tokenized directly by the selected payment gateway; we receive only a transaction reference and status, not the underlying card data.
6. Cookies & Tracking Technologies
We use strictly necessary cookies (for example, to keep you signed in to the merchant or partner dashboard) and may use limited analytics cookies to understand how the Service is used. You can control cookies through your browser settings; disabling essential cookies may prevent you from logging in.
7. Data Retention
We retain account and transaction records for as long as your account is active and thereafter for the period required by applicable tax, accounting, and financial-services record-keeping obligations (commonly several years after the relationship ends), or as needed to resolve disputes and enforce our agreements.
8. Data Security
All API traffic and webhooks are enforced over TLS 1.2+, and webhooks are cryptographically signed so recipients can verify authenticity. Access to production systems is restricted to authorized personnel. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
9. Your Rights & Choices
Subject to applicable law, you may request access to, correction of, or deletion of your personal information, or object to certain processing. Because we retain records required for financial compliance, some requests (for example, deleting settled transaction records) may not be possible while a legal retention obligation applies. To exercise these rights, contact us using the details in Section 13.
10. Children's Privacy
The Service is intended for use by businesses and individuals who are at least 18 years old and legally able to enter into a merchant or partner agreement. We do not knowingly collect information from children.
11. International Transfers
We primarily operate and store data within India. Where information is processed by a service provider located elsewhere, we take reasonable steps to ensure it receives an equivalent level of protection.
12. Changes to This Policy
We may update this Policy from time to time. Material changes will be reflected by updating the "Last updated" date above, and where appropriate, notified to registered merchants and partners.
13. Contact & Grievance Officer
Questions about this Policy, or requests relating to your personal information, can be sent to [email protected].
Our Grievance Officer can also be reached at [email protected], as required under applicable data protection and intermediary guidelines.