This Privacy Policy explains how ZopPay Technologies Pvt. Ltd. (“ZopPay”, “we”) collects, uses, shares, and protects information in the course of providing the ZopPay payment orchestration platform (the “Service”). It applies to both the marketing site (zoppay.in) and the authenticated application.
1. Who we are
ZopPay is a technology orchestrator for payments. Where you connect your own gateway account, we do not acquire, settle, or hold customer funds: your payment instructions are routed to downstream payment gateways that you maintain direct commercial relationships with.
2. What we collect
2.1 Information you provide
- Account information: name, business name, work email, password (stored only as a hash) or, if you sign in with Google, the name and email address on your Google account, and role.
- Billing information: organisation name, billing email, billing address, and a tax ID such as a GSTIN or VAT number.
- Gateway credentials: API keys and signing secrets you provide so we can call downstream gateways on your behalf. These are stored encrypted (AES-256-GCM envelope encryption). Secret fields are masked in the dashboard after you save them.
- Support and enquiry data: any information you submit via our contact form or support channels.
2.2 Information we generate in the course of providing the Service
- Transaction metadata: payment IDs, order references, amounts, currency, status, timestamps, gateway identifiers, and fee breakdowns.
- Customer details: your customer's name, email address and phone number, where you or your checkout supply them, and, for saved cards, the card brand, the last four digits and the gateway's card token. Raw card numbers and CVVs never reach our servers.
- ePayLater identity details: when a customer pays with ePayLater, the ePayLater checkout steps collect the customer's PAN and/or Aadhaar number and a one-time password. These pass through our servers to ePayLater so the payment can be completed.
- Operational logs: request logs, webhook delivery logs, audit events, and observability data required to run the Service.
2.3 Information we collect automatically on the marketing site
- Basic device and browser information (IP address, user agent) for security and abuse prevention.
- We do not currently run analytics or advertising trackers on the marketing site. The site loads its fonts from Google Fonts, so your browser connects to Google's servers when you visit.
3. How we use information
- To provide, maintain, secure, and improve the Service.
- To authenticate requests, prevent abuse, and detect fraud against the platform.
- To reconcile transactions with downstream gateway reports and produce merchant dashboards and invoices.
- To respond to support enquiries, communicate about service changes, and (with appropriate consent) send product updates.
- To comply with our legal, tax, and accounting obligations.
4. Legal bases
Where applicable under data-protection laws such as the GDPR or India's DPDP Act, we rely on the following bases to process information: (a) performance of a contract with you; (b) our legitimate interests in running a secure, reliable platform; (c) compliance with a legal obligation; and (d) your consent, where required — for example, for non-essential marketing communications.
5. Who we share information with
- Downstream payment gateways that you have connected — we relay the information required to execute the transactions you authorise.
- Cloud infrastructure providers (currently Google Cloud) that host the Service under standard data-processing terms.
- Professional advisors such as auditors and legal counsel, bound by confidentiality obligations.
- Authorities, when legally required, and only to the extent required.
We do not sell personal data. We do not share transaction-level merchant data for advertising.
6. International transfers
The Service is hosted on Google Cloud in the United States, so your data is processed there. Data is also sent to the gateways you connect, some of which operate outside India. Where data is transferred to jurisdictions with differing data-protection regimes, we rely on contractual safeguards — including Standard Contractual Clauses where applicable — to protect it.
7. Retention
We retain account, transaction, and log data for as long as your account is active and for a reasonable period thereafter, consistent with our legal, accounting, and reconciliation obligations. On account closure, you may request an export of your data; we will then delete or anonymise information that is no longer required.
8. Your rights
Depending on your jurisdiction, you may have the right to access, correct, or delete your personal data, to object to or restrict certain processing, and to data portability. To exercise a right, email privacy@zoppay.in. We will respond within the timelines required by applicable law.
9. Security
We follow industry-standard practices to protect information entrusted to us, including TLS in transit, AES-256-GCM envelope encryption of gateway credentials and webhook secrets at rest, scoping of every record to its organisation, SHA-256 hashing of API keys, bcrypt hashing of passwords, and logging of staff access. No system is perfectly secure; we recommend that you also implement reasonable controls on your side.
10. Children
The Service is intended for use by businesses and is not directed at children. We do not knowingly collect personal information from individuals under the age of eighteen.
11. Changes
We may update this Privacy Policy to reflect changes in the Service or the legal environment. Material changes will be announced via the dashboard and by email to account administrators.
12. Contact
Email privacy@zoppay.in for any privacy question or request. If you are in the EU or UK and believe we have not addressed your concern, you may contact your local data-protection authority.