Privacy Policy
What we collect, why we collect it, how long we keep it, and what you can ask us to do with it.
This policy explains how MehaiPay Fintech Pvt. Ltd. (“MehaiPay”, “we”, “us”) handles personal data when you use our website, our agent application or any service offered through our retailer and distributor network. It is published under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and is read together with the Digital Personal Data Protection Act, 2023.
1. Scope of this policy
This policy covers two groups of people:
- Agents — retailers, distributors and super distributors who hold a MehaiPay account.
- Customers — members of the public who use a service at an agent's counter, such as an AEPS withdrawal or a money transfer.
For agent data we act as the data fiduciary. For customer data we act partly as a fiduciary and partly as a processor on behalf of our sponsor bank and the relevant payment system operator, because the transaction is theirs to settle.
2. Information we collect
From agents
- Identity and KYC records — name, photograph, Aadhaar number, PAN, date of birth and address.
- Business details — shop name, shop address, GSTIN where applicable and the settlement bank account.
- Contact details — mobile number and email address.
- Usage data — transactions processed, wallet movements, commission earned, login timestamps, device model, app version and IP address.
From customers at a counter
- The Aadhaar number or bank account number needed to route the transaction.
- Mobile number, used to send the transaction receipt.
- Beneficiary details for a money transfer — name, account number and IFSC.
- Transaction metadata — amount, timestamp, bank response and reference number.
3. Aadhaar and biometric data
Aadhaar numbers used for a transaction are stored in masked form. We show only the last four digits in any screen, receipt or report. Full Aadhaar numbers captured during agent KYC are held in encrypted storage and used solely to complete verification with the authorised KYC User Agency.
Customer consent for Aadhaar authentication is captured on screen before every transaction, in the language the agent has selected, and the consent record is retained alongside the transaction log.
4. How we use information
- To complete, settle and reconcile the transactions you and your customers initiate.
- To verify identity and meet KYC, anti-money-laundering and RBI obligations.
- To calculate and pay commission, and to produce TDS and GST records.
- To detect fraud, misuse of limits and suspicious transaction patterns.
- To provide support, investigate disputes and respond to chargebacks.
- To send service messages — settlement alerts, limit changes, downtime notices.
- To improve the product, using aggregated statistics that do not identify anyone.
We do not sell personal data, and we do not share it with advertisers or data brokers.
5. When we share information
We share only what is needed, and only with:
- Sponsor banks and payment system operators — NPCI, BBPS, the beneficiary bank and card networks, so a transaction can be authorised and settled.
- Service providers — KYC agencies, SMS and email gateways, cloud hosting and audit firms, each bound by contract to confidentiality and to use the data only for the service they provide to us.
- Insurers, travel partners and billers — where you have chosen to use that service and the partner needs the detail to issue the policy, ticket or receipt.
- Regulators and law enforcement — where we are required to by law, by a court order or by a regulatory direction.
All data is stored on servers located in India, as required by the Reserve Bank of India's payment data storage direction.
6. How long we keep it
| Record | Retention period | Reason |
|---|---|---|
| Transaction records | 10 years | PMLA record-keeping |
| KYC documents | 5 years after closure | RBI KYC Master Direction |
| Consent logs | 10 years | Dispute and audit trail |
| Support tickets | 3 years | Service quality and disputes |
| Website analytics | 26 months | Product improvement |
When a retention period ends we delete the record or anonymise it so that it can no longer be linked to a person.
7. How we protect it
- TLS 1.2 or higher on every connection between the app, the website and our servers.
- AES-256 encryption at rest for KYC documents, Aadhaar numbers and bank details.
- Role-based access, so staff see only the records their job requires, with every access logged.
- Annual penetration testing and a PCI-DSS aligned control environment for card data.
- An incident response plan under which we notify the Indian Computer Emergency Response Team and affected users of a reportable breach within the statutory timelines.
No system is perfectly secure. Keep your login credentials and device PIN to yourself, and tell us immediately if you suspect your account has been used by someone else.
8. Your rights
Subject to our legal retention duties, you may ask us to:
- confirm what personal data of yours we hold, and give you a summary of it;
- correct data that is inaccurate, incomplete or out of date;
- erase data that we no longer need for a legal or contractual purpose;
- withdraw a consent you gave earlier, where processing was based on that consent;
- nominate another person to exercise these rights if you die or become incapacitated.
Write to the Grievance Officer using the details in section 12. We respond within thirty days. Where we cannot act on a request — for example because a record must be kept under the Prevention of Money Laundering Act — we will tell you why.
9. Cookies and analytics
This website uses a small number of cookies. Strictly necessary cookies keep your session alive and protect forms against cross-site request forgery; these cannot be turned off. Analytics cookies tell us which pages are read and where visitors leave, in aggregate. You can block or delete cookies in your browser settings; the site will keep working, though a logged-in session will not persist.
We do not use cookies for advertising or cross-site tracking.
10. Children
Our services are not offered to anyone under eighteen. Agents must be adults, and we do not knowingly collect data from a child. If you believe a child's data has reached us, write to the Grievance Officer and we will delete it.
11. Changes to this policy
We update this policy when the law, our partners or our services change. The date at the top always reflects the current version. A material change is notified in the agent app and by email at least fifteen days before it takes effect, and continuing to use the services after that date means you accept the revised policy.
12. Contact the Grievance Officer
For any question about this policy, a data request, or a complaint about how your data has been handled:
Grievance Officer — MehaiPay Fintech Pvt. Ltd. BHILWARA ROAD, KOYAD,RAJSAMAND,RAJASTHAN 313324 INDIA
Email: mehaipaybiz@gmail.com
Phone: +91 80030 70100 · Monday to Saturday, 10:00–19:00 IST
If you are not satisfied with our response you may escalate to the Data Protection Board of India, or, for a payment-related complaint, to the RBI Ombudsman under the Reserve Bank – Integrated Ombudsman Scheme, 2021.
Related: Terms of Service · Refund Policy · Grievance redressal process