Privacy Policy

1. Scope of this policy

This Privacy Policy explains how InstaUPI ("InstaUPI", "we", "us" or "our") collects, uses, shares and protects personal data when you visit our website, contact us, create an account or use our QR-based payment collection services (together, the "Services").

By using the Services, you agree to the practices described here. If you do not agree, please do not use the Services.

2. Information we collect

Information you provide

• Contact details such as your name, email address, phone number and company name when you fill in our contact form or create an account.
• Business details such as your business name, website or app URL, and the information required to set up payment collection for your account.
• Communications you send us, including support requests and feedback.

Information generated when you use the Services

• Transaction-related data such as order references, amounts, timestamps and payment status associated with QR codes created through your account.
• Integration data such as API usage logs and webhook delivery records.

Information collected automatically

• Technical data such as IP address, browser type, device information, pages visited and the date and time of access.
• Cookies and similar technologies, as described in section 6.

3. How we use your information

• To provide, operate and maintain the Services, including generating QR codes and sharing payment status updates with your integration.
• To create and manage your account and verify your identity where required.
• To respond to enquiries and provide customer support.
• To send service-related messages such as account notices, security alerts and changes to our terms.
• To monitor, secure and improve the Services, and to detect and prevent fraud or misuse.
• To comply with applicable laws, regulations and lawful requests from authorities.
• To send product updates or marketing communications, where you have agreed to receive them. You can opt out at any time.

4. How we share information

We do not sell your personal data. We share it only in the following situations:

• Service providers who help us run the Services, such as hosting, email, analytics and customer support providers, under obligations to protect your data.
• Payment ecosystem participants, where sharing is necessary to process or confirm a transaction you or your customer have initiated.
• Legal and regulatory requirements, when required by law, court order or a lawful request from a government authority.
• Protection of rights, to protect the rights, property or safety of InstaUPI, our users or others.
• Business transfers, in connection with a merger, acquisition or sale of assets, subject to this policy continuing to apply.

5. Data retention

We keep personal data only for as long as needed for the purposes described in this policy, including to meet legal, accounting and reporting requirements. When data is no longer required, we delete or anonymise it securely.

6. Cookies

We use cookies and similar technologies to keep the website working properly, remember your preferences and understand how visitors use our site. You can control or delete cookies through your browser settings. Blocking some cookies may affect how parts of the website work.

7. How we protect your data

We use reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse or alteration. These include access controls, encrypted connections and limited internal access. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

8. Your rights

Subject to applicable law, including the Digital Personal Data Protection Act, 2023, you may:

• Request access to the personal data we hold about you.
• Ask us to correct, complete or update inaccurate data.
• Ask us to erase data that is no longer needed, subject to legal retention requirements.
• Withdraw consent where processing is based on consent.
• Nominate another person to exercise your rights in the event of death or incapacity.
• Raise a grievance with us, and escalate it to the relevant authority if it is not resolved.

To make a request, email support@instaupi.in. We may need to verify your identity before acting on it.

9. Children's data

The Services are intended for businesses and are not directed at individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

10. Third-party links and apps

Our website may link to third-party websites or services, and your customers will use their own UPI apps to make payments. Those parties have their own privacy policies, and we are not responsible for their practices.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will change the "Last updated" date at the top of this page and, for significant changes, notify account holders by email or through the Services.