Last updated: September 8, 2026

This Privacy Policy is issued by Mobifintree Services Private Limited ("Company", "We", "Us", or "Our") and describes how We collect, use, store, share, and protect Personal Data in connection with the Indyapay application and related services ("Service"), in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), together with other applicable law in India.

Under the DPDP Act, You are a Data Principal and the Company is a Data Fiduciary in respect of the Personal Data processed through the Service. By using the Service, You acknowledge that You have read and understood this Privacy Policy.

Mobifintree Services Private Limited

Registered/Communication Address: 2-25/1, 3rd Floor, Rajarajeswari Nilayam, Kakatiya Nagar, Habsiguda, Hyderabad – 500007, Telangana, India.

Email: info@indyapay.com

Grievance Officer / Data Protection Officer contact: 

Ch. Jayanth Reddy

Mobile: 818589898

Email: jayanthreddy@indyapay.com

•        “Account” means a unique account created for You to access the Service.

•        “Application” means the Indyapay software application provided by the Company.

•        “Consent Manager” means a person registered with the Data Protection Board of India who enables a Data Principal to give, manage, review, and withdraw consent through an accessible, transparent, and interoperable platform, in accordance with Section 6(7)-(9) of the DPDP Act.

•        “Data Principal” means the individual to whom the Personal Data relates, i.e., You.

•        “Data Fiduciary” means the Company, which determines the purpose and means of processing Personal Data.

•        “Data Processor” / “Service Provider” means any person who processes Personal Data on behalf of the Company.

•        “Personal Data” means any data about an individual who is identifiable by or in relation to such data.

•        “Personal Data Breach” means any unauthorized processing of Personal Data or accidental disclosure, acquisition, sharing, use, alteration, destruction, or loss of access to Personal Data that compromises its confidentiality, integrity, or availability.

•        “Processing” means any operation performed on Personal Data, including collection, storage, use, sharing, and erasure.

 

3.1 Data You Provide

•        Full name, email address, and phone number

•        Address, City, State, and ZIP/Postal Code

•        Profile picture

•        Information required to process mobile, DTH, utility, and other bill payment and recharge transactions initiated by You (e.g., recharge/bill account or subscriber number, biller, and operator selected)

•        Limited identity/contact verification information, where required by Our payment aggregator, bank, or NBBL/BBPS partner to process a transaction

3.2 Data Collected Automatically (Usage Data)

•        IP address, browser type and version, device identifiers

•        Pages visited, time and date of visit, time spent on the Service

•        Mobile device type, operating system, and diagnostic data

3.3 Data Collected With Your Specific Permission

The following categories are accessed only after You are shown a specific, itemised consent request at the time of collection, and only where necessary for a clearly identified function of the Service:

•        Location/GPS information

•        Phonebook/contact list

•        Camera, photos, and videos

•        Device identifiers required for a specific feature

You may decline any such request; doing so may limit Your access to the specific feature that depends on that data, but will not affect Your access to the rest of the Service.

3.4 Payment Instrument Data

We do not store Your card number, CVV, UPI PIN, or net-banking credentials. Payments are processed through RBI-authorised payment aggregators, banks, or the Bharat Bill Payment System (BBPS) ecosystem, who independently collect and secure payment instrument data in accordance with RBI's Payment Aggregator/Payment Gateway and BBPS directions and applicable PCI-DSS standards. We receive only the transaction status, amount, and a reference/transaction ID from these partners.

In accordance with Section 5 and Section 6 of the DPDP Act, before or at the time of requesting consent, We will provide You an itemised notice, in clear and plain language, specifying:

•        the Personal Data to be collected and the specific purpose of processing;

•        the manner in which You may exercise Your rights under Section 6(4) and Section 13 of the DPDP Act; and

•        the manner in which You may make a complaint to the Data Protection Board of India.

Consent for each purpose is collected separately and is free, specific, informed, unconditional, and unambiguous, with a clear affirmative action. Consent for essential Service functions is sought separately from consent for optional features (such as marketing communications), and declining optional consent will not affect Your access to essential functions.

Withdrawal of consent: You may withdraw consent at any time, with an ease comparable to how it was given, by writing to us at info@indyapay.com or through the in-app privacy settings. Withdrawal takes effect prospectively and does not affect the lawfulness of processing carried out before withdrawal. Following withdrawal, We will cease the relevant processing within a reasonable time unless retention is otherwise required or permitted by law.

Consent Manager: Where You choose to manage Your consent through a Consent Manager registered with the Data Protection Board of India, We will give effect to consent given, managed, reviewed, or withdrawn through that platform.

Legitimate uses without consent: In limited circumstances specified under Section 7 of the DPDP Act — such as where You have voluntarily provided data for a specified purpose, for compliance with law, for responding to a medical emergency, or for purposes related to employment — We may process Personal Data without separate consent, strictly to the extent permitted under that Section.

•        To create and manage Your Account and provide the Service

•        To process Your recharge and bill payment transactions and route them to the relevant operator, biller, or BBPS participant

•        To verify Your identity where required by Our payment aggregator, bank, or BBPS partner under applicable RBI directions

•        To confirm transaction status, issue receipts, and resolve failed or disputed transactions

•        To send Service, security, and transaction-related communications

•        To send promotional communications, only where You have separately consented

•        To detect, prevent, and investigate fraud, unauthorised access, or misuse of the Service

•        To conduct internal analytics and improve the Service

•        To comply with legal, regulatory, and law-enforcement obligations

We do not use Personal Data for any purpose beyond what is specified at the time consent is sought, except where permitted under Section 7 of the DPDP Act.

We share Personal Data only as reasonably necessary, and, unless otherwise permitted under Section 7, with Your consent, in the following circumstances:

•        With Data Processors / Service Providers (e.g., Firebase, Google Play Services, Google Analytics, Firebase Crashlytics) who process Personal Data on Our behalf under a written contract that binds them to confidentiality and security obligations at least equivalent to this Policy;

•        With the operator, biller, payment aggregator, bank, and BBPS/NBBL participants necessary to complete Your recharge or bill payment, and with regulators where required or permitted by RBI directions;

•        With Our Affiliates (entities under at least 50% common ownership or control), bound to handle Personal Data under equivalent safeguards;

•        In connection with a merger, acquisition, or sale of business assets, subject to the transferee being bound by materially equivalent privacy obligations;

•        Where required by an order of a court or a government agency legally empowered to make such a request, or as otherwise required by applicable law;

•        With Your specific consent, for any other purpose.

We do not sell Personal Data to third parties for their independent marketing purposes.

Consistent with Section 16 of the DPDP Act, the Company may transfer Personal Data outside India, except to any country or territory that the Central Government has restricted by notification. Where Personal Data is transferred outside India, We require the recipient to maintain a standard of protection substantially equivalent to that required under this Policy and the DPDP Act, and any sector-specific data localisation requirement applicable to financial data (including any RBI mandate that certain payment data be stored only in India) will be complied with regardless of this clause.

In accordance with Section 8(7) of the DPDP Act and Rule 8 of the DPDP Rules, We retain Personal Data only as follows:

•        For the period necessary to fulfil the specified purpose for which it was collected;

•        For as long as retention is required under applicable law — recharge and bill payment transaction records are retained for a minimum of five years from the date of the transaction, and any identity/verification data obtained for a transaction is retained for five years from the end of the relevant business relationship, in each case in accordance with the RBI Master Direction on KYC and the Prevention of Money Laundering (Maintenance of Records) Rules, 2005, or longer where a proceeding is pending;

•        Where You have not used the Service or engaged with Us for the retention period specified in the applicable notice, We will notify You before erasing Your Personal Data, as required under Rule 8, unless retention is otherwise required by law;

•        Usage Data not required for security, fraud prevention, or legal compliance is retained for a shorter, defined operational period.

On expiry of the applicable retention period, We erase or anonymise Personal Data, except where continued retention is required to comply with a legal obligation.

In accordance with Section 8(5) of the DPDP Act and Rule 6 of the DPDP Rules, We implement reasonable technical and organisational safeguards appropriate to the nature of the Personal Data processed, including encryption, access controls, audit logging, and contractual security obligations on Service Providers. No method of electronic transmission or storage is completely secure, and We cannot guarantee absolute security; however, this does not limit Our statutory obligations under the DPDP Act in the event of a Personal Data Breach.

In the event of a Personal Data Breach, and in accordance with Section 8(6) of the DPDP Act and Rule 7 of the DPDP Rules, the Company will:

•        notify the Data Protection Board of India without delay, and provide a further updated report, including the circumstances, mitigation measures taken, and findings regarding the person responsible (where known), within 72 hours of becoming aware of the breach, or such longer period as the Board may allow on a written request;

•        notify affected Data Principals without undue delay, in clear and plain language, describing the nature and extent of the breach, the likely consequences, the measures implemented by the Company, safety measures the Data Principal may take, and a contact point for further information.

Subject to the DPDP Act and the terms of consent given, You have the following rights:

•        Right to Access: to obtain a summary of the Personal Data We hold about You, the processing activities undertaken, and the identities of Data Processors with whom it has been shared (Section 11).

•        Right to Correction and Erasure: to request correction, completion, or updating of inaccurate or misleading Personal Data, and to request erasure of Personal Data that is no longer necessary for the purpose for which it was processed, unless retention is required by law (Section 12).

•        Right to Grievance Redressal: to have Us respond to Your grievance in a reasonable and time-bound manner, before approaching the Data Protection Board of India (Section 13).

•        Right to Nominate: to nominate another individual to exercise Your rights under the DPDP Act in the event of Your death or incapacity (Section 14).

•        Right to Withdraw Consent: as described in Section 4 above.

To exercise any of these rights, contact Us at info@indyapay.com or the Grievance Officer named in Section 1. We will respond within the timelines prescribed under applicable law and may take reasonable steps to verify Your identity before actioning a request.

Under Section 15 of the DPDP Act, You are required to: not impersonate another person when providing Personal Data; not suppress material information while providing Personal Data for a document issued by the State; not register a false or frivolous complaint with the Company or the Data Protection Board; and provide only authentic and verifiable information when exercising the right to correction or erasure.

Under the DPDP Act, a “child” is an individual who has not completed the age of 18 years. The Service is not intended for use by children, and We do not knowingly process the Personal Data of a child except with verifiable consent of the parent or lawful guardian, obtained in the manner prescribed under Rule 10 of the DPDP Rules. We do not undertake tracking, behavioural monitoring, or targeted advertising directed at children. Where We process the Personal Data of a person with disability who has a lawful guardian, We will obtain verifiable consent of such lawful guardian in the prescribed manner.

The Service may contain links to third-party websites or services not operated by Us. We are not responsible for the privacy practices of such third parties, and we encourage you to review their privacy policies independently.

We may update this Privacy Policy to reflect changes in Our practices or applicable law. Material changes affecting the purpose or scope of processing will be notified to You, and, where such changes relate to processing for which Your consent was obtained, We will seek fresh consent where required under the DPDP Act. Non-material changes take effect upon posting of the revised Policy with an updated “Last updated” date.

To the maximum extent permitted by applicable law, the Company's aggregate liability arising out of or relating to the processing of Your Personal Data under this Policy — other than liability arising from the Company's failure to comply with its mandatory statutory obligations under the DPDP Act (including breach notification and reasonable security safeguards) — shall be limited to direct damages and shall not extend to indirect, incidental, or consequential loss. Nothing in this clause limits any right or remedy available to You under the DPDP Act or excludes any liability that cannot lawfully be excluded.

This Privacy Policy is governed by the laws of India. Any dispute arising out of or in connection with this Policy that is not resolved through Our grievance redressal process shall first be referred to arbitration by a sole arbitrator appointed by the Company, in accordance with the Arbitration and Conciliation Act, 1996, with the seat and venue of arbitration at Hyderabad, Telangana, and the proceedings conducted in English. This clause does not affect Your right to approach the Data Protection Board of India or a consumer forum under applicable law, where such right cannot be excluded by agreement.

If any provision of this Privacy Policy is held invalid or unenforceable under the DPDP Act or other applicable law, that provision will be limited or eliminated to the minimum extent necessary, and the remaining provisions will continue in full force and effect.

Grievance Officer: Ch. Jayanth Reddy

Mobile: 818589898

Email: jayanthreddy@indyapay.com

Company: Mobifintree Services Private Limited, 2-25/1, 3rd Floor, Rajarajeswari Nilayam, Kakatiya Nagar, Habsiguda, Hyderabad – 500007, Telangana, India.

If You are not satisfied with Our response, You may file a complaint with the Data Protection Board of India.

For any question, request, or complaint regarding this Privacy Policy, contact:

Mobifintree Services Private Limited

2-25/1, 3rd Floor, Rajarajeswari Nilayam, Kakatiya Nagar, Habsiguda, Hyderabad – 500007, Telangana, India.

Email: info@indyapay.com