Last Updated: October 28, 2026

Privacy Policy

How PayNit collects, uses, and protects your data, account credentials, and two-factor authentication securely.

1. Introduction

PayNit ("we," "our," "us") is committed to protecting your personal information and digital identity. This Privacy Policy explains how we collect, use, disclose, and safeguard your data when you use our payout platform, merchant portals, APIs, and enhanced security mechanisms including Two-Factor Authentication (2FA).

2. Information We Collect

Personal Information

  • Full name, registered email address, and mobile number.
  • KYC documents: Aadhaar number, PAN number, and uploaded document credentials (in accordance with RBI and regulatory AML directives).
  • Business entity name, website URL, registration proofs, and compliance classifications.
  • Beneficiary bank account details and UPI IDs for payout disbursement routing.

Two-Factor Authentication (2FA) & Security Data

  • Time-Based One-Time Password (TOTP) Shared Secrets: When you enable Google Authenticator or an RFC 6238-compliant authenticator app, a cryptographic secret key is generated. The secret is securely stored and never exposed in plain text to third parties.
  • Email OTP Verification Tokens: Temporary, single-use 6-digit numeric codes generated for login verification. Codes are salted and cryptographically hashed (bcrypt), expire automatically after 10 minutes, and are purged upon successful authentication.
  • Authentication Defense Telemetry: To prevent credential stuffing and brute-force attacks, we record failed attempt counters, rate-limiting windows (maximum 5 email OTPs per hour), and temporary lockout intervals (15 minutes).
  • Session & IP Device Fingerprinting: Originating IP address and user-agent details during 2FA events, used to dispatch automated security alerts upon detection of logins from unrecognized locations.

Technical Information

  • IP addresses, browser type, operating system, and device identifiers.
  • Login timestamps, session durations, authentication events, and audit logs.
  • API request metadata, signature headers, and payout execution payloads.

3. How We Use Your Information

  • To verify identity, complete KYC/AML compliance, and authenticate account ownership.
  • To authenticate access via Two-Factor Authentication (2FA) and safeguard against unauthorized account takeover.
  • To transmit transactional and security alerts, including new IP login notifications, 2FA credential changes, and OTP verifications.
  • To process payout disbursements accurately and securely via IMPS and UPI banking rails.
  • To detect, mitigate, and prevent fraud, unauthorized API calls, automated dictionary attacks, and malicious exploits.
  • To comply with legal obligations and banking audits mandated by applicable Indian financial law.

4. Data Security & Cryptographic Standards

We maintain industry-standard physical, electronic, and procedural safeguards to protect your personal and authentication data:

  • Transport Security: 256-bit TLS/SSL encryption for all data in transit across web portals and API endpoints.
  • At-Rest Storage: AES-256 encrypted storage for sensitive documents and one-way cryptographic hashing for passwords, OTPs, and security keys.
  • Multi-Factor Authentication (MFA): Zero-knowledge architecture where OTP tokens are verified against one-way hashes and discarded immediately after use.
  • Automated Defense: Automatic 15-minute lockout triggers upon 5 consecutive failed 2FA verification attempts to neutralize automated brute-force scripts.
  • IP Whitelisting & Isolation: Dedicated API key isolation, rate limits, and IP restriction controls for merchant accounts.

5. User Control & 2FA Management

You have full autonomy over your security settings through your Merchant Dashboard:

  • You can choose between Google Authenticator (TOTP) or Email OTP verification at any time.
  • You can regenerate your authenticator secret key or switch methods, authenticated by your account password.
  • You can disable 2FA at your discretion with password re-authentication, though maintaining active 2FA is strongly advised for payout security.
  • If you lose access to your authenticator device or email, account recovery is subject to identity verification by our security team to prevent social engineering.

6. Contact & Grievances

If you have any questions, security concerns, or account recovery inquiries regarding this Privacy Policy, please contact our Security & Grievance team at:
Email: support@paynit.in