PayWallet (“the app”) is built and operated by PayWallet Private Limited (“PayWallet”, “we”, “us”), with its registered office at 1st Floor, MBM Grandeur, 35th Main Rd, Dollar Scheme Colony, 1st Stage, BTM 1st Stage, Bengaluru — 560068. This policy explains what data we collect when you use PayWallet, why we collect it, and what we do with it.
This policy is issued in accordance with the Information Technology Act 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011, the Digital Personal Data Protection Act 2023, and the applicable RBI / NPCI directions for UPI and BBPS applications.
Information we collect
When you sign up and use PayWallet, we collect:
- Account information: mobile number, name (as it appears on your bank account), and the UPI ID(s) you link.
- KYC information: Aadhaar number (masked), PAN, and any documents required by RBI / NPCI to verify your identity. KYC data is encrypted at rest and processed only by RBI-licensed entities.
- Transaction data: the date, amount, payee, biller, recharge operator, travel partner, or gift-card brand involved in each transaction you make through the app.
- Device & usage data: device model, OS version, IP address, app version, language, and the screens you visit inside the app — used to diagnose errors and improve the product.
- Support correspondence: messages you send us by email or in-app chat, so we can help you and audit support quality.
We do not collect or store your bank account password or your UPI PIN. Those are entered into your bank’s own UPI screen during a payment and never reach our servers.
How we use your information
- To process the payments, recharges, bills, travel bookings, and gift cards you initiate.
- To send you transaction receipts, due-date reminders, and customer-support replies.
- To prevent fraud, comply with anti-money-laundering laws, and meet RBI / NPCI / BBPS reporting obligations.
- To improve PayWallet — understand which features are used, fix bugs, and design better ones.
We do not sell your personal data. We do not use it for behavioural advertising.
Who we share information with
We share only what’s necessary, with the following categories of partners:
- Payment networks: NPCI (for UPI), BBPS (for bill payments), and your bank — to execute transactions you authorise.
- Service partners: our recharge, travel-booking, and gift-card aggregators — only the details needed to fulfil the specific service you requested.
- Cloud & infrastructure providers: our hosting, analytics, and customer-support vendors, under written contracts that bind them to confidentiality.
- Regulators & law enforcement: when required by a valid legal order or to comply with statutory obligations.
Data retention
We keep transaction records for the period required by RBI — typically 8 (eight) years from the date of the transaction. KYC documents are retained as required by AML/CFT laws. All other personal data is retained only for as long as needed to operate the app and provide support, after which it is securely deleted.
Account deletion
You can delete your PayWallet account anytime:
- Open the app, go to Settings → Privacy → Delete account.
- Confirm with your mobile OTP.
- We remove your personal data within 30 days, retaining only the records we are required to keep by RBI/AML law.
You can also email contact@paywalletupi.com from your registered email address with the subject “Delete my account”.
Your rights
Under the DPDP Act 2023 you have the right to:
- Access the personal data we hold about you.
- Correct or update inaccurate data.
- Withdraw consent (where processing is based on consent).
- Request deletion of your data, subject to legal retention requirements.
- Nominate someone to exercise these rights on your behalf in case of incapacity.
To exercise any of these rights, email contact@paywalletupi.com. We respond within statutory timelines.
How we protect your data
- All data is encrypted in transit (TLS) and at rest.
- Access to production data is restricted, logged, and audited.
- Sensitive operations (payments, KYC) ride on India’s regulated UPI and BBPS rails — bank-side cryptography and PIN authorisation apply.
- We run periodic security reviews and patch vulnerabilities promptly.
Cookies & trackers
The PayWallet website uses a small number of strictly necessary cookies to remember your preferences (such as language) and to measure aggregate traffic. We do not use third-party advertising cookies. You can clear cookies at any time from your browser settings.
Children’s data
PayWallet is intended for users aged 18 and above. We do not knowingly collect personal data from anyone under 18. If you believe a minor has signed up, please contact us and we will remove the account.
Changes to this policy
If we make material changes, we will notify you in the app at least 7 days before the change takes effect. The “Last updated” date at the top of this page always shows the most recent revision.
Contact & grievance officer
For any privacy question, complaint, or rights request:
- contact@paywalletupi.com
- 080 2255 2541 080 2255 2542 080 2255 2543 080 2255 2544
- 1st Floor, MBM Grandeur, 35th Main Rd, Dollar Scheme Colony, 1st Stage, BTM 1st Stage, Bengaluru — 560068
Our Grievance Officer is appointed under Rule 5(9) of the SPDI Rules 2011 and Section 13 of the DPDP Act 2023. We acknowledge every complaint within 48 hours and endeavour to resolve it within 30 days. If a payment-related complaint is not resolved to your satisfaction, you may also approach your bank’s grievance cell or the RBI Ombudsman through the RBI Complaint Management System at cms.rbi.org.in.