Paisaजी
Legal & Compliance Hub/Privacy & Data Protection

Privacy Policy

Effective: 2026-10-24Last Updated: 2026-10-24Version 2.0 • Active Statutory Framework

Statutory Framework & Regulatory Purpose

Governing Law: India

Data fiduciary disclosures, categories of data collected, security safeguards, and user rights under DPDP framework.

Overview & Scope

At PaisaJi (operated by PaisaJi Technologies Private Limited), your financial privacy and data integrity are paramount. This Privacy Policy sets out how we collect, process, store, encrypt, and safeguard your personal and financial information when you interact with our mobile application, web properties (https://paisaji.com), and APIs.

This Privacy Policy complies with:

The Digital Personal Data Protection Act, 2023 (DPDP Act)
The Information Technology Act, 2000 and Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011
RBI Guidelines on Digital Lending and Payment Aggregator Master Directions

1. Categories of Personal Data We Collect

We collect only the minimum necessary data required to deliver secure financial intermediary services:

1. Identity & Profile Information:
Full legal name, mobile telephone number, email address, date of birth.
Government identification numbers (such as PAN or Aadhaar offline XML/Virtual ID verification) strictly where mandatory for KYC and regulatory reporting.
2. Device & Telemetry Data (Strictly Purpose-Bound):
Unique device hardware IDs, device model, operating system version, IP address, SIM slot state, and biometric hardware availability (used strictly for device binding and multi-factor session authentication).
*Notice:* In accordance with RBI guidelines, PaisaJi never accesses your personal photo library, media storage, private chat logs, or continuous background GPS location without explicit contextual user trigger.
3. Financial & Transactional Records:
Recharge order records, BBPS utility bill consumer IDs (e.g., electricity account number, DTH subscriber ID).
Payment method type (UPI ID, masked bank account number, card network). We never store your secret UPI PIN, debit card ATM PIN, or card CVV.
4. Customer Communication & Support Data:
Support tickets, chat correspondence with support agents, and voice recordings of grievance escalations for quality assurance and regulatory audit.

3. Data Sharing, Disclosures & Third Parties

PaisaJi operates on a strict Zero-Monetization Policy: We never sell, rent, or lease your personal financial data to unverified data brokers or commercial advertisers.

We share data strictly on a need-to-know basis with:

1. Regulated Infrastructure Entities: National Payments Corporation of India (NPCI), Bharat BillPay Central Unit (BBPCU), and telecom operators to complete recharges and bill settlements.
2. Authorized Payment Aggregators & Banks: Escrow account banks and RBI-authorized payment processors (e.g., Razorpay, Cashfree, Axis Bank) to facilitate UPI transfers.
3. Regulated Lending Partners (NBFCs/Banks): When you explicitly request loan or credit card matchmaking, your demographic and financial profile is shared with partner financial institutions upon your explicit OTP-authenticated consent.
4. Law Enforcement & Judicial Authorities: Strictly when mandated by a legally binding court order, summons, or statutory warrant under Indian law.

4. Data Security, Cryptography & Storage Standards

Encryption in Transit: All traffic between client apps and PaisaJi servers is encrypted using modern TLS 1.3 cryptographic suites with strict HSTS enforcement.
Encryption at Rest: Sensitive identifiers and KYC credentials are encrypted in production databases using AES-256 standards with hardware-backed key vaults.
Data Localization: In full compliance with RBI data localization directives, all core transaction data, user credentials, and communication logs are stored and processed exclusively within AWS Mumbai (ap-south-1) data centers located within the territorial borders of India.

5. Data Retention & Erasure Policies

Transaction records and tax invoices are retained for a minimum period of 5 years from the date of the transaction to fulfill obligations under the PMLA and GST regulations.
Upon account deletion or consent withdrawal, non-mandatory personal data is purged or irrevocably anonymized within 30 business days, subject to pending disputes or statutory audits.

6. Your Rights Under DPDP Act, 2023

As a Data Principal, you possess statutory rights:

1. Right to Access Information: Request a summary of personal data held and processed by PaisaJi.
2. Right to Correction & Erasure: Update inaccurate personal data or request deletion of outdated records.
3. Right to Grievance Redressal: Lodge complaints directly with our Data Protection Officer (DPO).
4. Right to Nominate: Nominate an individual to exercise data rights in the event of death or incapacity.

To exercise these rights, submit a signed request to privacy@paisaji.com.

⚖️ Questions, Account Inquiries or Policy Clarifications?

Contact our operations desk for transaction disputes, or our Data Protection Officer for account erasure & privacy rights.

✉️ support@paisaji.com•🔒 privacy@paisaji.com (Account Deletion)
Nodal Escalation Desk