Privacy Policy

Last updated 22 October 2026

Draft template, not legal advice. This text is a starting point for the company to review with a lawyer before publishing. Replace every [bracketed placeholder] and check each clause against how the app and your payment and BBPS partners actually work.

1. Who we are

[Company legal name], [Registered office address, City, State, PIN] ("we", "us") runs the SmartEasyPay app and this website. This policy explains what personal data we collect, why, and the choices you have. It should be read with our Terms & Conditions. We process personal data in line with applicable Indian law, including the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, as they apply to us. [Lawyer to confirm applicable law and any notices required.]

2. What we collect

Data	When	Why
Mobile number	Sign-up and every login	Your account ID; we send the one-time password (OTP) to it. There is no password.
First and last name, email address	Sign-up	To identify you, address you in the app, and send receipts or account messages.
Address and pincode	Sign-up	To confirm you are in an area where registration is open, and for our records.
Phone location (latitude, longitude and accuracy) and the state it falls in	Once, at sign-up	To check that registration is open where you are. We do not track your location after sign-up.
Referral code you entered, and your own referral code	Sign-up	To give referral coins.
Device name, device ID, app version, sign-in times and IP address	Each login and session	To show your signed-in devices, let you sign them out, keep sessions secure and fix problems.
Push notification token	When the app starts	To send transaction, coin and offer notifications to your phone.
OTP requests (mobile number, time, IP address)	Each OTP	To limit repeated requests and prevent misuse.
Transaction and payment records: service, operator or biller, the number or account you paid, plan or bill details, amount, status, reference numbers from our partners and the payment gateway, refunds, and the IP address used	Each payment	To complete the payment, show your history, handle refunds and complaints, prevent fraud, and meet legal record-keeping duties.
Reward coin history (coins earned, used, reversed or expired, with dates)	When coins change	To run the reward programme and show your balance.
Messages you send to support	When you contact us	To answer you.

3. What we do not collect

Card and bank details. You enter these with our payment gateway, not with us. We receive only the payment status and reference numbers.
A wallet balance. The app has no wallet. Refunds go back to the account, card or UPI ID you paid from.
Passwords. You sign in with an OTP only.
Your contact list, photos or messages. The app does not ask for permission to read them.
Ongoing location. Location is read once at sign-up only.

4. How we use your data

To create and secure your account and sign you in.
To carry out recharges and bill payments, fetch bills, and process refunds.
To give, show and adjust reward coins.
To send you notifications about your transactions, coins and offers. You can turn off notifications in your phone's settings.
To answer support requests and complaints.
To detect and prevent fraud and misuse, and to meet legal and regulatory duties.

We do not sell your personal data. [State whether data is used for marketing emails or SMS and how users opt out.]

We share only what each party needs to do its job:

Payment gateway [name]: the amount and order details, so you can pay.
Recharge and BBPS partners, operators and billers [names]: the number or account you pay, the amount and the operator, to complete the payment or fetch your bill.
SMS provider [name]: your mobile number and the OTP.
Google Firebase Cloud Messaging: your push token and the notification text.
Hosting provider [name, data location]: stores our servers and database.
Authorities: where the law requires it, or to protect our users and the Service.

6. How long we keep it

Account details: while your account is open, and for [period] after it is closed.
Transaction, payment and coin records: for as long as the law and our partners require us to keep them [period, e.g. as required for financial records], even after the account is closed.
Session and device records: until you sign out or the session ends, then for [period].
OTP request logs: [period].

7. Security

We use reasonable security measures, including encrypted connections (HTTPS), OTP sign-in, session tokens that you can revoke from any signed-in device, and limited staff access to personal data. No system is fully secure, so please keep your phone locked and never share an OTP.

8. Your rights and choices

See your profile, transactions, coins and signed-in devices in the app at any time.
Ask us to correct or update your details.
Ask us to close your account and erase data we no longer need to keep by law.
Withdraw consent for optional processing, such as notifications.
Raise a grievance with our grievance officer (below). [Add the right to nominate and the right to complain to the Data Protection Board, if applicable.]

To make a request, write to [support@yourdomain.in] from your registered email, or contact us from your registered mobile number.

9. Children

The Service is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has signed up, contact us and we will close the account.

10. Changes to this policy

We may update this policy. We will change the date at the top and, for important changes, tell you in the app before they take effect.

11. Grievance officer and contact

[Grievance officer name], Grievance Officer
[Company legal name]
[Registered office address, City, State, PIN]
Email: [grievance@yourdomain.in]

General support: [support@yourdomain.in] · [+91 XXXXX XXXXX]