The short version
- We collect what it takes to run your wallet: your mobile number, the details of each payment and some technical data about your device.
- We use it to complete payments, protect your account and meet our legal duties.
- We never sell your personal data.
- You can ask to see, correct or delete your information at any time.
Who we are and what this covers
This Privacy Policy explains how DonePay Wallet (“DonePay”, “we”, “us”, “our”) collects, uses, shares, stores and protects personal data when you use our website donepaywallet.com, the web wallet at app.donepaywallet.com and our mobile apps (together, the “Service”).
We are the data fiduciary for the personal data described here. By using the Service you agree to the practices in this policy. Please read it together with our Terms of Use and Cookie Policy.
Information we collect
What you give us
| Type | Examples | When |
|---|---|---|
| Account details | Name, mobile number, email address, date of birth, profile picture | When you register or update your profile |
| Address details | Address, city, state, PIN code | When a service or check needs it |
| Payment details | Recipient mobile number, consumer or subscriber ID, bank account number, IFSC, amount, chosen biller | Every time you pay |
| KYC information | Officially valid identity documents and verification results, where regulations require them | Only when verification is triggered |
| Support messages | What you write to us, complaint details, attachments | When you contact support |
What is collected automatically
- Usage data — screens and pages viewed, features used, time and date of access, visit length and referring pages.
- Device and technical data — IP address, device type and model, device identifiers, operating system, browser type and version, language and network information.
- Diagnostic data — crash reports and performance logs that help us find and fix problems.
- Cookies and similar technologies — see Cookies and similar tools below and our Cookie Policy.
What we receive from others
Payment Partners, banks, Billers, KYC verification agencies and fraud-prevention providers may share information with us — for example, the status of a payment or the result of a verification check.
What we never store We do not store your full card number, your CVV or your internet-banking password. Card and banking credentials are handled by our licensed Payment Partners on their own secure systems. Your transaction PIN is kept only as an irreversible hash — we cannot read it.
How we use it
- To run the Service — open and maintain your account, process recharges, bills, transfers and top-ups, and show your transaction history.
- To confirm it is you — send OTPs, verify your identity and protect your account from unauthorised access.
- To keep you informed — send payment confirmations, service updates, security alerts and replies to your support requests.
- To prevent fraud and abuse — watch for unusual patterns, investigate suspicious activity and enforce our Terms.
- To meet legal duties — fulfil KYC, anti-money-laundering, tax, accounting and record-keeping obligations, and respond to lawful requests from authorities.
- To improve DonePay — understand which features are used, diagnose technical issues and build new ones.
- To run rewards — manage cashback, referral and promotional schemes and, with your consent where needed, tell you about offers.
We do not sell your personal data, and we do not share it with third parties for their own marketing.
Our legal grounds
We process personal data on one or more of these grounds:
- Contract — processing needed to provide the services you have asked for under our Terms.
- Consent — for example, optional marketing messages or non-essential cookies. You can withdraw consent at any time.
- Legal obligation — where a law, regulation or regulator requires us to collect, verify, keep or disclose information.
- Legitimate interests — such as securing the platform, preventing fraud and improving our services, where those interests are not outweighed by your rights.
How long we keep it
We keep personal data only as long as we need it for the purposes in this policy, and after that for as long as we must to:
- meet legal, tax, accounting and regulatory record-keeping duties — financial and KYC records are typically kept for at least five to eight years under Indian law;
- resolve disputes and enforce our agreements; and
- protect against fraud and abuse.
Usage data is generally kept for a shorter time, unless we use it to strengthen security or improve the Service, or the law requires us to keep it longer. When we no longer need data, we delete it or anonymise it so it cannot identify you.
How we protect it
- All traffic between your device and our servers is encrypted with TLS.
- Sensitive fields are encrypted at rest, and transaction PINs are stored only as irreversible hashes.
- Inside DonePay, access to personal data is limited to those who need it, and that access is logged.
- High-value actions need an OTP on your registered mobile number as well as your PIN.
- We monitor our systems for anomalies and keep an audit trail of every credit and debit.
No system is perfect We use commercially reasonable safeguards, but no method of sending or storing data over the internet is completely secure, and we cannot guarantee absolute security. Please protect your credentials — we will never ask for your PIN or OTP by phone, email or message.
Your rights and choices
Subject to applicable law, you can:
- see the personal data we hold about you;
- correct anything inaccurate or out of date — much of it directly in your account settings;
- delete your account and ask us to erase your personal data;
- withdraw consent you gave earlier, without affecting processing already done;
- opt out of marketing at any time, using the unsubscribe link in our emails or by writing to us; and
- complain to us, or to the relevant authority, about how we handle your data.
To use any of these rights, write to support@donepaywallet.com from your registered email address. We may need to confirm your identity first, and we will respond within the time the law requires.
Some information cannot be deleted because the law requires us to keep it — for example, records of completed financial transactions.
Children
The Service is not aimed at children, and we do not knowingly collect personal data from anyone under 18. If you are a parent or guardian and believe your child has given us personal data, please contact us and we will remove it and close the account.
Processing outside India
Your information is processed in India and wherever the service providers involved in processing it are located. Some of them may be outside India, where data-protection laws can differ.
When personal data is transferred outside India, we take reasonable steps — including contractual safeguards with the recipient — to keep it protected as this policy describes. By giving us your information, you agree to such transfers.
Other websites
The Service may link to websites and apps we do not run. This policy does not cover them, and we are not responsible for their content or their privacy practices. Please read the privacy policy of any site you visit.
Changes to this policy
We may update this policy from time to time. The new version applies from the date it is published here, and the effective date at the top will change. For significant changes we will put a clear notice in the Service or email you before they take effect.
Grievance officer
Under the Information Technology Act, 2000 and the rules made under it, you can contact our Grievance Officer about how your personal data is processed. Complaints are acknowledged within 48 hours and resolved within 30 days of receipt.
- Grievance Officer
- DonePay Wallet
- Escalation process
- Grievance Redressal