Comprehensive Privacy Policy & Data Charter

1. Identification of the Data Fiduciary

In accordance with Section 2(i) and Section 6 of the Digital Personal Data Protection Act, 2023, the designated Data Fiduciary responsible for determining the purpose and means of processing digital personal data is:

• Data Fiduciary Name: Harsh Pandey
• Designated Platform Operations Contact: +91 6388050042 (exclusively dedicated to this website)
• Primary Website URL: https://upigateway.web.app
• Jurisdiction: Republic of India

2. Categories of Digital Personal Data Collected

Under the strict doctrine of Data Minimization (Section 6(1) of the DPDP Act 2023), the Platform collects and processes solely the minimum data fields necessary to provide identity authentication, dynamic order generation, and payment matching:

2.1. Identity & Account Information: When authenticating via Google OAuth (Firebase Authentication), we receive: (a) Merchant primary email address, (b) Merchant full name or display pseudonym, and (c) Google user profile image URL. We do NOT receive or store your Google account password.

2.2. Financial Reconciliation Telemetry: For the singular purpose of matching and verifying UPI transactions via automated email monitoring, the engine processes:

• The 12-digit Unique Transaction Reference (UTR / UPI Ref Number).
• The transaction timestamp recorded by the issuing bank.
• The exact payment amount (including fractional paise offsets).
• The sender's name or masked UPI ID as supplied within the bank notification email.

2.3. Prohibition on Sensitive Financial Instruments: The Platform strictly NEVER requests, accesses, intercepts, or retains any credit card numbers, debit card numbers, expiration dates, CVVs, netbanking login passwords, ATM PINs, or UPI MPINs. All actual monetary transfers take place directly within the Data Principal's own banking applications over the National Payments Corporation of India (NPCI) Bharat UPI network.

3. Email Notification Processing & Matching Engine Methodology

3.1. Restricted Scope of Email Parsing: The matching worker threads parse ONLY inbound messages with specific subject headers and sender domains matching verified banking alert nodes (e.g. alerts@paytm.com, notifications@fampay.in, merchant-alerts@phonepe.com). Personal, non-banking, promotional, or draft emails are completely ignored and never stored in any persistent ledger.

3.2. Zero Scopes Compromise: Under our Google OAuth authentication platform, sensitive Gmail permissions are strictly excluded from client sign-in to protect merchant confidentiality. IMAP connections, where utilized, operate under merchant-configured dedicated App Passwords.

4. Non-Refundable Subscription Policy & Fee Acknowledgment

4.1. Irrevocable Finality of Payment: In alignment with Section 5 of the Master Terms of Service, all subscription payments made for software provisioning, API access, server slots, and dynamic QR generation licenses are 100% strictly final, non-refundable, and non-prorated under any circumstances.

4.2. No Chargebacks: By consenting to this Privacy Policy and completing any transaction, the Merchant explicitly acknowledges that the computational resources are delivered instantly upon payment confirmation, and waives any chargeback rights or claims for reimbursement based on non-usage, domain errors, or unsupported email alert structures.

5. Statutory Rights of Data Principals under DPDP Act 2023

Every user located within India possesses the following guaranteed statutory rights under Chapter III (Sections 11 through 14) of the DPDP Act 2023:

• Right to Access Information (Section 11): The Data Principal is entitled to obtain a summary of digital personal data being processed by the Data Fiduciary and the identities of any Data Processors with whom such data has been shared.
• Right to Correction & Erasure (Section 12): The Data Principal has the right to demand the correction of inaccurate data, the completion of incomplete entries, and the erasure of personal data that is no longer necessary for the purpose for which it was collected.
• Right to Grievance Redressal (Section 13): The Data Principal has the right to ready redressal of grievances through the designated Grievance Officer Harsh Pandey (+91 6388050042).
• Right to Nominate (Section 14): The Data Principal may nominate an individual to exercise rights under the Act in the event of death or incapacity.

Statutory Exception on Financial Audits: In accordance with applicable taxation and financial regulations (including GST and RBI anti-money laundering frameworks), records of verified payment transactions, invoice hashes, and associated UTR records cannot be deleted prior to the expiration of the statutory 7-year audit retention window.

6. Security Safeguards & Data Sovereignty

6.1. Cryptographic Protection: All data transmitted between the customer checkout Stand, the Merchant Portal, the Admin Control Room, and the API backend is encrypted in transit using industry-standard TLS 1.3 / HTTPS (256-bit encryption).

6.2. Data Residency: The primary databases, in-memory caches, log stores, and worker processes are located within sovereign, compliant data centers that adhere to the territorial sovereignty requirements of the Republic of India.

7. Designated Grievance Redressal Officer

Pursuant to Section 13(2) of the DPDP Act 2023 and Rule 5(9) of the IT Rules 2011, any inquiries, complaints, or notifications of data rights execution should be formally lodged with:

If a grievance is not resolved to your satisfaction within thirty (30) business days, you maintain the statutory right to escalate the matter before the Data Protection Board of India established under Section 18 of the DPDP Act 2023.