Privacy Policy

1. Who we are

Arupama Pay is operated by Digital Arupama OPC Private Limited, a company incorporated in India. We act as the data fiduciary for the personal data described in this policy.

We handle your personal data in accordance with applicable Indian law, including the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023.

Questions about this policy: support@arupama.in.

2. What we collect

We collect only what we need to run a payments service and to meet our legal obligations:

• Account and identity data — your name, mobile number, email address, date of birth and address, provided when you register.
• KYC data — your PAN, Aadhaar details and images of the identity documents you submit, including any selfie or photograph. Indian law requires us to verify your identity before you can transact.
• Financial data — your Arupama wallet balance, recharge and bill payment history, transaction records, and the bank account or UPI details you give us for payouts and refunds.
• Device and technical data — device model and identifiers, operating system, app version, IP address, push notification token, and diagnostic or crash logs.
• Location — only if you grant permission, and only to detect your telecom circle so that recharge plans shown to you are correct. You can refuse and select your circle manually; the app continues to work.
• Contacts — only if you grant permission, and only so you can pick a number from your phonebook instead of typing it. See section 3.
• Camera — only when you capture a KYC document or scan a QR code. Images are used for that purpose only.
• Biometrics — if you enable fingerprint or face unlock, the check is performed by your device. We never receive, see or store your biometric data.

3. What we do not do

To be explicit about the things people most often worry about:

• We do not sell or rent your personal data to anyone.
• We do not display third-party advertising in Arupama Pay, and we do not share your data with advertising networks or data brokers.
• We do not upload your contact list. When you grant contacts permission, your contacts are read on your device to populate the picker and are never transmitted to or stored on our servers.
• We do not store your App PIN, TPIN, card number or UPI PIN in readable form.
• We do not use your data to build advertising profiles.

4. How we use your data

• To provide the service — process recharges, bill payments, wallet top-ups, transfers and refunds.
• To verify your identity and meet KYC, anti-money-laundering and other regulatory obligations.
• To calculate and pay commissions and rewards you have earned.
• To detect, investigate and prevent fraud, abuse and unauthorised access.
• To provide customer support and resolve disputes you raise.
• To send you service communications, such as transaction alerts and status updates.
• To keep records we are legally required to keep, and to respond to lawful requests from regulators, courts and law enforcement.

We rely on your consent, the performance of our contract with you, and our legal obligations as the basis for this processing.

5. Who we share it with

We share personal data only where it is needed to deliver the service or where the law requires it:

• Recharge and bill payment partners — we pass the mobile number or account number, the operator and the amount needed to fulfil the transaction you asked for.
• Payment and UPI partners — to let you add money and to settle transactions. Where you enter payment credentials with a gateway, those credentials are handled by that gateway under its own privacy policy, not by us.
• Google (Firebase Cloud Messaging) — your device push token, so we can deliver notifications to your device.
• Cloud hosting providers — our servers and encrypted backups are hosted with Amazon Web Services, which stores data on our behalf under contract.
• Regulators, courts and law enforcement — where we are legally required to disclose.
• Professional advisers and auditors — under confidentiality obligations.
• A successor entity — if our business is merged, acquired or reorganised, subject to this policy continuing to apply.

6. How long we keep it

• Account and transaction records — for as long as your account is open, and afterwards for the period we are required to retain them by law.
• KYC records — retained for at least five years after the end of our relationship with you, as required under India’s anti-money-laundering rules.
• Diagnostic and log data — retained for a short period for security and troubleshooting, then deleted or anonymised.

When you ask us to delete your data, we delete or anonymise it except where we are legally required to retain it. We tell you when that applies.

7. Your rights, and how to use them

You can ask us to:

• Give you a copy of the personal data we hold about you.
• Correct data that is wrong or out of date.
• Delete your account and your personal data, subject to the legal retention above.
• Withdraw a permission you previously gave — you can turn off location, contacts, camera and notification permissions at any time in your device settings.

To make any of these requests, email support@arupama.in from the address registered on your account, or raise a ticket from Help & Support inside the app. We respond within 30 days.

8. Account and data deletion

You can request deletion of your Arupama Pay account at any time by emailing support@arupama.in or by raising a request from Help & Support in the app.

On deletion we remove your profile, contact details and device identifiers, and we disable your login. Transaction and KYC records that we are required by law to retain are kept for the periods in section 6 and are not used for any other purpose.

Please withdraw any remaining wallet balance before you request deletion: a balance left on a deleted account is forfeited, and deletion cannot be undone. Full details, including what is removed and what is retained, are at https://portal.arupama.in/account-deletion.

9. How we protect your data

• Data in transit is protected with TLS.
• Passwords, your App PIN and your TPIN are stored only as one-way salted hashes — we cannot read them, and neither can our staff.
• Sensitive operational credentials are encrypted at rest.
• KYC documents are held in private storage and are accessible only through short-lived, access-controlled links.
• Backups are encrypted and taken daily.
• Access to production data is restricted to staff who need it.

No system is perfectly secure, but we work to protect your data and to review our practices. Please never share your password, App PIN, TPIN or OTP with anyone — including anyone claiming to be from Arupama. We will never ask you for them.

10. Children

Arupama Pay is intended for users aged 18 and over. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us data, contact support@arupama.in and we will delete it.

11. Changes to this policy

We may update this policy as the service changes. The current version is always published at https://portal.arupama.in/privacy with the date it took effect. Where changes are material, we will tell you in the app.

12. Grievance Officer

If you are unhappy with how we have handled your data or your request, you can contact our Grievance Officer:

• Digital Arupama OPC Private Limited
• Address: AT/PO - Salijanga, P.S - Kalinga Nagar, Dist - Jajpur, PIN - 755026, Odisha, India
• Email: support@arupama.in

We acknowledge grievances within 24 hours and aim to resolve them within 30 days, in line with Indian law.