1. Who this covers
This document was prepared to match how the Cashvya platform actually behaves, but it has not been reviewed by a lawyer. Collecting money on behalf of other businesses is a regulated activity in India. Have a qualified advisor review this page, and confirm what authorisation your settlement model requires, before onboarding merchants you do not personally know.
Every highlighted placeholder must be replaced with your real details.
Cashvya is a UPI payment gateway operated by [Legal entity name] ("Cashvya", "we"). This policy covers the Cashvya website, the merchant dashboard, the hosted checkout and payment link pages, and the APIs.
Two different kinds of people appear in this policy:
- Merchants — businesses that sign up to accept payments through Cashvya.
- Customers — people who pay a merchant through a Cashvya checkout. For customer data, the merchant is the primary data controller and Cashvya processes that data in order to take and verify the payment.
2. What we collect
From merchants
| Data | Why |
|---|---|
| Business name, category, website | Identify the account and brand the checkout |
| Contact email and mobile number | Sign-in, verification, settlement and security alerts |
| Password | Stored only as a PBKDF2-SHA512 hash with a per-password salt; never in plain text |
| Bank account holder name, account number, IFSC and UPI ID | Compulsory, because this is where your daily settlement is paid. Stored encrypted. |
| API keys and webhook signing secret | Authenticate your server and sign webhooks |
From customers at checkout
| Data | Why |
|---|---|
| Name, email, mobile number | Identify the payer, send the receipt, let the merchant reconcile the order |
| One-time passcode | Confirm control of the mobile number. Stored encrypted and erased once used or expired. |
| Payment amount, order reference, UPI reference (UTR) | Create and verify the payment, and let the merchant match it to an order |
| Device and browser characteristics | Bind a payment session to the device that started it, so a payment link cannot be continued elsewhere mid-session |
| IP address | Rate limiting and abuse prevention |
Cashvya does not collect, process or store card numbers, CVVs or UPI PINs. You approve a UPI payment inside your own bank or UPI app. Cashvya only learns that a payment of a certain amount arrived, and its UPI reference number.
3. How payment confirmation works
This deserves saying plainly, because it is unusual and it is central to how Cashvya works.
Cashvya confirms that a payment arrived by reading the payment notifications sent to the operator's own bank channels — the SMS alerts on an operator-controlled phone and the email alerts in an operator-controlled mailbox. A notification is matched to an open payment by amount, time window and UPI reference.
- Only the operator's own bank alerts are read. Cashvya does not read a customer's or a merchant's messages or mail.
- The connected mailbox is authorised by the operator through Google's consent screen, with read-only scope, and the access token is stored encrypted.
- From each notification Cashvya keeps only the fields needed to attribute the payment: amount, timestamp, reference number and the sender's name as the bank reported it.
4. Why we use it
We use the data above to take payments, confirm them against the bank, show merchants their transactions, calculate the platform fee, pay out daily settlements, send receipts and security alerts, prevent fraud and abuse, and meet our legal and accounting obligations.
We do not sell personal data, and we do not use customer data to advertise to them.
6. How long we keep it
- One-time passcodes — minutes. Deleted as soon as they are used or expire.
- Payment and settlement records — retained for as long as required for accounting, tax and dispute resolution, which in India is ordinarily at least eight years.
- Merchant account records — kept while the account is open, then retained for the period above.
- Audit and security logs — retained for operational and investigative purposes.
Closing an account does not delete records we are required to keep.
7. How it is protected
Summarised here, with the detail on the Security page: traffic is served over HTTPS; passwords are stored as salted PBKDF2-SHA512 hashes; bank details, passcodes and OAuth tokens are encrypted at rest with AES-256-GCM; secrets are compared in constant time; admin access requires an access key plus an authenticator code; and webhooks are signed with HMAC-SHA256.
No system is perfectly secure. If you believe your account or your data has been compromised, write to [email protected] immediately.
8. Your choices
You can ask us to give you a copy of your data, correct it, or delete what we are not required to keep. Merchants can see and edit most of their own data in the dashboard directly, and can turn off WhatsApp receipts there.
If you paid a merchant and want your data removed, contact that merchant first, since they are the controller of your order. You can also write to us and we will help.
To make a request, email [email protected] from the address on the account. We may ask you to confirm your identity before acting.
10. Changes
If this policy changes materially we will update the date at the top and, for merchants, send notice to the account email. Continuing to use Cashvya after a change means you accept the updated policy.
11. Contact
Questions about this page, or a request about your data, go to [email protected]. We aim to reply within 5 working days.
| Operator | [Legal entity name] |
|---|---|
| Registered address | [Registered address, city, state, PIN] |
| Grievance officer | [Name] · [Email] · [Phone] |
| Support email | [email protected] |