1. Commitment to Privacy & Regulatory Compliance
SMB UPI ("we", "our", or "smbupi.com") is dedicated to maintaining the confidentiality, integrity, and security of all personal and commercial data entrusted to us. This Privacy Policy details our data governance practices under the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and UIDAI data retention standards.
2. Information We Collect
We collect only the minimum data essential to provide our software integration services and comply with anti-fraud mandates:
- Merchant Identity & Business Data: Merchant's full name, registered mobile number, email address, company or trading name, business category, and website URL.
- KYC Documents & Verification Records: Permanent Account Number (PAN), demographic information verified via DigiLocker (masked UID, name, DOB, gender, registered address, and official photo), and Live Video KYC timestamped confirmation logs.
- Transaction Metadata: Merchant Order IDs, amounts, bank UTR numbers, payment status, provider identifiers, and buyer UPI handles when transmitted by banking switches.
- SoundBox & Notification Data: Notification preferences, selected audio language, device pairing tokens, and payment announcement event timestamps. No customer voice recordings are captured or stored.
- Audit & Security Logs: IP addresses, browser user-agents, device fingerprints, and API request timestamps for cyber defense, fraud detection, and rate limiting.
3. 8-Month Internal KYC Retention Policy
To ensure robust anti-fraud protection and enable swift resolution of commercial payment disputes:
INTERNAL 8-MONTH RETENTION POLICY:
Eligible verification records, document validation timestamps, and merchant verification statuses are retained for eight (8) months from the date of verification completion under SMB UPI's internal risk management and recordkeeping policy. Please note that this 8-month timeframe represents SMB UPI's own internal operational policy rather than a statutory government requirement. Retention beyond 8 months may occur where specifically mandated by applicable law, ongoing regulatory inquiries, fraud investigations, or active chargeback dispute resolution.
4. How We Use Data
Collected information is used exclusively to:
- Generate dynamic, secure UPI payment QR codes and checkout intent links.
- Automate webhook delivery to notify merchant applications of completed payments.
- Authenticate merchant access, prevent brute-force API attacks, and enforce rate limits.
- Validate merchant legitimacy and prevent fraudulent actors from exploiting the payment infrastructure.
5. Zero Custody of Banking Credentials
SMB UPI NEVER asks for, records, or stores sensitive consumer banking secrets such as UPI PINs, ATM Card PINs, CVV codes, Net Banking passwords, or OTPs. All payment authorizations occur entirely on the consumer's own device within their authorized UPI apps (PhonePe, Google Pay, Paytm, CRED) or banking applications.
6. Law Enforcement & Statutory Disclosures
We do not sell, rent, or trade merchant or customer data to marketing agencies. However, we will disclose relevant records to verified Indian law enforcement agencies, Police Cyber Cells, the Enforcement Directorate, or Judicial Courts upon receipt of a lawful requisition under Section 91 CrPC or equivalent judicial order.
7. Data Privacy & Grievance Contact
For any data protection inquiries, audit requests, or privacy concerns, please contact our Data Governance Officer:
Data Protection Officer: Compliance & Privacy Desk — SMB UPI
Address: smbupi.com / West Bengal, India