Privacy Policy

1. Introduction

This Privacy Policy explains how OK Pay(“we”, “us”), based in Pune, India, collects, uses, shares, and protects your personal data when you use our payment services or visit our website.

We comply with the Digital Personal Data Protection Act, 2023 (“DPDPA”) and applicable Reserve Bank of India (“RBI”) rules governing payment aggregators, where our processing relates to customers and data in India.

2. Information We Collect

From merchants (account holders):

• Identity data: name, PAN, GST number, business registration documents, directors' IDs
• Contact data: email, phone, registered business address
• Financial data: bank account details, transaction history, settlement records
• Verification data: KYC documents, signatures, photographs where required
• Compliance data: AML/CFT screening results, sanctions-list checks

From end-customers (payers):

• Payment data: payment-instrument details (tokenised where applicable), UPI VPA, card BIN, transaction amount and currency
• Device data: IP address, browser, device fingerprint (used for fraud prevention)
• Contact data: name, email, phone, where provided to the merchant

Automatic data:

• Usage data: page views, click events, API call logs
• Cookies and similar technologies (see Section 10)

3. How We Use Your Data

We process personal data to:

• Provide and operate the payment services
• Verify identity (KYC) and onboard merchants
• Process transactions and settlements
• Detect and prevent fraud, money laundering, and financial crime
• Comply with legal and regulatory obligations
• Communicate with you about your account and service updates
• Improve, develop, and secure our services
• Send marketing communications (with consent where required)

4. Google User Data (Gmail bank-alert confirmation)

A merchant may choose to connect a Gmail inbox so that the credit alerts their bank emails to that inbox can confirm the merchant’s pending payments automatically. This is optional and only happens when the merchant connects the inbox themselves from their dashboard and grants access on Google’s consent screen.

What we access

• Permission requested: read-only access to Gmail (https://www.googleapis.com/auth/gmail.readonly), plus the account's email address. We never send, delete, label or modify any email.
• For each new email we first read only its sender address. The rest of the message is fetched only when the sender is a bank alert address on our published list and the merchant has linked an account at that bank. All other email is never downloaded or stored.

How we use it

• Solely to confirm the merchant's own payments: from a bank credit alert we read the amount, the last digits of the receiving account, the transaction reference (UTR) and the time, and match them to the merchant's pending payment.
• We check the bank's email signature (DKIM) so a forged or forwarded alert cannot confirm a payment.
• We do not use Gmail data for advertising, for building user profiles, for training AI or machine-learning models, or for any purpose other than the payment confirmation the merchant turned on.

What we store, and for how long

• Only bank alert emails as described above: sender, subject, received time, the plain text of the alert and the parsed fields (amount, account digits, reference, result).
• The plain text is deleted automatically after the retention period (30 days by default); the parsed fields are kept with the payment record for reconciliation and dispute handling.
• The Google access credential is stored encrypted (AES-256-GCM) and is never shown to anyone, including our staff.

Sharing and human access

• We do not sell, rent or transfer Gmail data to anyone, and do not share it with advertisers or data brokers.
• The confirmed payment (not the email) is reported to the merchant in their dashboard and through the merchant's own webhooks.
• No person at OK Pay reads Gmail data, except where the merchant asks us to for support, where needed for security (for example investigating abuse), or where required by law.

Disconnecting and deletion

A merchant can disconnect an inbox at any time from Dashboard → Bank email inboxes → Disconnect, which stops all reading immediately and revokes our access at Google. Access can also be removed at myaccount.google.com/permissions. To have stored bank-alert data deleted, email connect@luwaktech.com; we complete deletion within 30 days, except records we must keep by law.

OK Pay’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. OK Pay Sensor Android App

Merchants may install the OK Pay Sensor app on a phone that receives their bank’s SMS and payment-app notifications. With the merchant’s permission it reads only messages from banks and payment apps, extracts the amount and reference of incoming credits, and sends them to OK Pay to confirm the merchant’s payments. It does not read personal conversations, contacts, photos or files, and the merchant can unpair or uninstall it at any time.

6. Legal Basis for Processing

Under the DPDPA, we process data based on:

• Consent, where required by law
• Performance of a contract with you
• Compliance with legal obligations (including RBI rules and tax laws)
• Legitimate interests, including fraud prevention, service security, and lawful business operations

7. Sharing of Information

We share personal data with:

• Banks, payment networks, and card schemes (Visa, Mastercard, RuPay, UPI/NPCI) to process transactions
• Regulators, law-enforcement agencies, and courts where required by law
• KYC and AML service providers for identity verification
• Service providers (cloud hosting, analytics, fraud detection, communications) under written agreements that require equivalent data-protection standards
• Successors in case of merger, acquisition, or restructuring (with notice)
• Merchants — limited end-customer data necessary to process or reverse a transaction

We do not sell personal data.

8. International Transfers

Some service providers operate outside India. We transfer data internationally only to jurisdictions notified by the Government of India as permitted, and only under appropriate contractual safeguards. RBI's payment-data localisation rules continue to apply — payment-related data is stored in India.

9. Data Retention

• We retain personal data for the duration of your account and for 8 years after termination, as required by RBI Payment Aggregator rules
• We may retain data longer where required for legal claims, fraud investigation, or regulatory inquiry
• Aggregated and anonymised data may be retained indefinitely for analytics and product improvement

10. Cookies and Tracking

Our website uses:

• Essential cookies — for authentication, security, and session management. These are required for the service to function.
• Analytics cookies — to understand usage patterns and improve the service. You can disable these in your browser.

11. Your Rights

Under the DPDPA, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Erase data, where legally permissible (note: financial and KYC records must be retained per RBI rules)
• Withdraw consent, where consent is the basis for processing
• Nominate a person to exercise your rights in case of death or incapacity
• Raise a complaint with us (see Section 15)

To exercise your rights, email connect@luwaktech.com. We will respond within the timelines prescribed by law.

12. Security

We implement administrative, technical, and physical safeguards including:

• Encryption in transit (TLS 1.2+) and at rest
• Tokenisation of card and bank data
• PCI-DSS controls for cardholder data
• Access controls, audit logs, and intrusion detection
• Periodic security audits and penetration testing
• Employee training on data protection

No system is completely secure. In the event of a personal-data breach, we will notify affected users and the Data Protection Board of India as required by law.

13. Children's Privacy

Our services are not directed at individuals under 18. We do not knowingly collect personal data from minors. If you believe we have collected data from a minor, contact us at connect@luwaktech.com and we will delete it.

14. Changes to This Policy

We may update this Policy from time to time. Updated versions will be posted on this page with a revised “Last updated” date. Material changes will be communicated to merchants by email.

15. Contact

For privacy questions and general queries, contact us at: