Privacy Policy

PAYFLUX is a UPI collection toolkit for Indian merchants. This policy explains what we collect, why we collect it, and how long we keep it. It is a practical summary for our product — not formal legal advice. If you need region-specific compliance (for example DPDP Act counsel), please get independent review.

• Account: name, business name, email, password hash (via our auth provider), optional recovery email and passkeys / 2FA factors.
• Payment setup: Fam or Paytm UPI ID, project name, webhook URL, and for Fam — Gmail address plus App Password (encrypted at rest).
• Orders: amount, status, timestamps, optional customer email / note, UTR when available.
• Contact form: name, email and message you send us.
• Security signals: Cloudflare Turnstile tokens (verified server-side only) and basic rate-limit data to stop spam.
• Analytics: if Google Analytics is active, aggregated usage (pages viewed, rough location, device type). See GA’s own policy for their processing.

Gmail App Passwords are encrypted with AES-256-GCM before storage and only decrypted in memory by the verification engine to read payment-related mail. We do not use that access for marketing, and we never show the password back in the dashboard.

To verify payments, fire webhooks, show merchant analytics, bill plans, prevent abuse, and answer support requests. We do not sell personal data. Ad placements on public pages may use their own cookies when an admin enables them.

Essential cookies keep you signed in and remember preferences (for example theme or cookie notice). Analytics cookies run only when GA is configured. You can clear site data in your browser anytime. The cookie notice on the site is a simple acknowledgement, not a full consent management platform.

The contact form uses Cloudflare Turnstile to reduce bots. Your browser talks to Cloudflare; we only send the one-time token to Cloudflare’s siteverify API from our server. We do not store the token after verification.

Orders and webhook logs stay while the merchant account is active. Contact messages are kept as long as needed to reply. Email singhrajnish52741@gmail.com to request account or credential deletion; we aim to complete requests within 30 days.

You may request access, correction, export or deletion of your merchant data. For auth-provider-held records we will coordinate where technically possible.

Privacy questions: singhrajnish52741@gmail.com. Support hours Mon–Sat, 10:00–19:00 IST.