Privacy Policy

This Privacy Policy describes how Balaji Services, operated by Balaji Services ("we", "us", "our"), collects, uses, stores and protects your personal data when you use our website, mobile application and related services (collectively, the "Services").

1. Information we collect

We collect the following categories of personal data:

• Identity data — full name, date of birth, gender, photograph.
• Contact data — mobile number, email address, residential address.
• KYC data — Aadhaar reference id (never the raw 12-digit number after the eKYC step), PAN, business registration where applicable.
• Transactional data — beneficiary details, transaction history, IP address, device fingerprint.
• Technical data — browser type, operating system, time-zone, session and cookie identifiers.

2. How we use your information

We process your data for the following purposes:

• Providing the Services and processing transactions you initiate.
• Fulfilling KYC and AML obligations under RBI, UIDAI and DPDP-2023 rules.
• Securing your account (device binding, smart-lock re-auth, fraud detection).
• Customer support and dispute resolution.
• Service improvement and aggregated analytics.

3. Sharing with third parties

We share data only with: (a) regulated payment partners we use to settle transactions; (b) KYC verification providers operating under contract; (c) cloud-hosting infrastructure providers; and (d) law enforcement or regulators where compelled by law.

4. How we protect your data

Passwords and MPINs are stored as bcrypt hashes — we never see the plaintext. OTPs are encrypted in your session with AES-256-GCM and never written to disk. All HTTP traffic is served over TLS. Sessions are bound to device fingerprint, browser user-agent and (optionally) IP address. Bad-MPIN attempts trigger automatic lock-outs.

5. Your rights under DPDP-2023

You may exercise the following rights at any time:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate or incomplete data.
• Erasure — request deletion subject to retention obligations.
• Grievance redressal — contact our Grievance Officer (see Contact below).
• Withdrawal of consent — for processing that depends on consent.

6. Cookies

We use first-party session cookies strictly necessary to operate the Services (login, CSRF protection, theme preference). We do not run third-party advertising or cross-site tracking cookies.

7. Data retention

Transaction records are retained for the period mandated by RBI (presently 10 years from transaction date). KYC documents are retained for 8 years after account closure. Audit logs are retained for 7 years. Inactive non-KYC accounts are purged after 18 months.

8. Contact us

Grievances and privacy questions: please use our contact form.