This policy explains what personal data [registered business name] (“PalmPay”, “we”) collects, why, who we share it with and your rights, under the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.
What we collect
- Account details: name, mobile number, email (optional), your family members and how they're related, and whether a family member is under 18.
- Your palm template: a mathematical description of your palm made by the scanner — not a photo. It's biometric data and we treat it with the greatest care (see below).
- Your PIN: stored only in a scrambled (hashed) form; nobody at PalmPay or the store can see it.
- Payments and orders: what you bought, where, when, how you paid, your balance, top-ups and refunds; delivery addresses you give for app orders.
- Payment methods: card and UPI details are handled by our payment partner Razorpay; we keep only a reference, never your full card number.
- Technical data: sign-in records and security logs. We use only essential cookies (to keep you signed in and remember settings) — no advertising cookies.
Why we use it
- To identify you at stores (palm + PIN) and take your payments and orders.
- To run your balance, family limits, refunds and receipts, and send you codes and receipts on WhatsApp.
- To prevent fraud and keep accounts secure.
- To meet our legal duties, such as tax and accounting records.
We rely on your consent, which you give when you create your account (or, for a child, their parent or guardian gives). You can withdraw it at any time by closing your account; we'll then stop processing your data except where the law requires us to keep it.
Your palm data
- It's used only to recognise you at PalmPay machines. We never sell it or use it for anything else.
- It's encrypted on our servers and on the machines, with keys the machines keep in secure hardware.
- It's deleted when you remove your palm or close your account.
Children
Children under 18 can use PalmPay only when their parent or legal guardian adds them and gives consent. We don't track or monitor children's behaviour or show them targeted advertising. The parent or guardian can see their activity, set limits, and ask us to correct or delete their data at any time.
Who we share it with
- The store where you shop: your name, what you bought and a masked phone number — never your balance before you enter your PIN, and never your PIN.
- Service providers who work for us under contract: Razorpay (payments), our WhatsApp messaging provider, email and hosting providers.
- Authorities, when the law requires it.
We don't sell your personal data.
How long we keep it
We keep your account data while your account is open. Payment and tax records are kept for as long as Indian law requires (generally 8 years). Palm data is deleted when you remove it or close your account.
Your rights
- See a summary of the data we hold about you and how we use it.
- Correct or update it, and ask us to delete it (subject to records the law makes us keep).
- Nominate someone to exercise your rights if you can't.
- Complain to our Grievance Officer, and if you're not satisfied, to the Data Protection Board of India.
Security
We use encryption, hashed PINs, two-factor checks for every payment (palm and PIN), locks after wrong attempts, signed and identified POS machines, and audit records of changes.
Grievance Officer
[Grievance Officer's name] · [grievance email] · [registered business name], [registered address]. We acknowledge within 48 hours and resolve within 30 days.
Changes
If we change this policy in a way that matters, we'll tell you in the app before it takes effect.