Privacy Policy

Your privacy and transactional confidentiality are foundational to our platform. This Privacy Policy outlines the comprehensive protocols governing the collection, utilization, storage, and defense of personal and financial data across all our APIs and gateway services.

01 Categories of Information We Collect

To facilitate automated payment verification, invoice creation, and merchant account authentication, we collect:

• Merchant Identity: Full legal name, business email, authorized phone number, and brand name.
• API Credentials: Public application keys, cryptographic secret tokens, and server IP whitelisting.
• Transaction Metadata: Transaction IDs (TrxID), amounts, timestamps, sender numbers, and gateway identifiers.
• System Telemetry: HTTP request headers, webhook response codes, IP logs, and system error traces.

02 Purposes of Data Processing

All collected telemetry is utilized strictly for necessary technical and regulatory operations:

• Real-time automated transaction reconciliation and payment verification.
• Dispatching secure webhook callback events to merchant server endpoints.
• Preventing fraudulent TrxID reuse, automated payment forgery, and duplicate claims.
• Providing downloadable merchant audit ledgers and accounting summaries.
• Delivering technical customer support and operational alert notifications.

04 No Third-Party Data Selling

We maintain a strict zero-monetization policy on user data. We will never sell, rent, lease, or distribute your merchant records or customer transaction history to third-party ad networks, marketing brokers, or external analytics firms.

05 Network Infrastructure & Encryption Standards

All API requests and checkout sessions utilize high-grade 256-Bit SSL/TLS Cryptographic Encryption. Database storage is protected by role-based access control, hashed secrets, and isolated server environments preventing unauthorized introspection.

06 Essential Security Cookies

We utilize strictly functional, cryptographic session cookies to authenticate merchant dashboard navigation and thwart Cross-Site Request Forgery (CSRF). No behavioral advertising or invasive tracking cookies are deployed on our infrastructure.

07 Statutory Compliance & Disclosure

Information may only be disclosed if formally mandated by law enforcement bodies or regulatory courts of Bangladesh to comply with financial crime investigations, counter-terrorism compliance, or anti-fraud legal proceedings.

08 Merchant Rights & Data Control

Merchants have the perpetual right to review their stored account details, update business profiles, revoke and regenerate compromised API keys, or request full account deactivation by contacting our verified support channels.