Privacy Policy

Last updated: September 5, 2026

UPIDrop ("we", "our", "us") operates the website upidrop.roori.in and the UPIDrop payment gateway platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

1. Information We Collect

1.1 Information from Google Sign-In

When you sign in using Google, we receive and store:

• Email address — used as your account identifier
• Display name — shown in your merchant dashboard
• Profile picture URL — displayed as your avatar
• Google account ID (sub) — for unique identification

We do not access your Google contacts, Gmail content, Google Drive, calendar, or any other Google services beyond basic profile information required for authentication.

1.2 Information You Provide

• Business details — legal name, business name, business category, website URL
• PAN number — stored as a SHA-256 hash and masked format only; we never store the full PAN
• Mobile number — for communication and verification
• GSTIN — optional, for GST-registered businesses
• UPI VPA — your bank UPI address where payments are received
• Webhook URL — your server endpoint for payment notifications

1.3 Transaction Data

• Payment order details (amount, customer name, email, item description)
• UPI transaction references (UTR numbers)
• Payment status and timestamps
• SmartTrack reconciliation data

1.4 Automatically Collected Data

• IP addresses (for rate limiting and security)
• Browser type and version
• Pages visited and features used
• Cloudflare analytics (anonymized)

2. How We Use Your Information

• Provide the Service — process UPI payments, generate QR codes, deliver webhooks
• Authentication — verify your identity via Google Sign-In and 2FA (TOTP)
• KYC/Verification — verify your business identity and UPI VPA ownership
• SmartTrack — automatically match incoming bank credits to pending orders
• Security — detect fraud, prevent abuse, enforce rate limits
• Communication — send service notifications and updates
• Legal compliance — comply with Indian financial regulations (RBI, NPCI guidelines)

3. Data Storage and Security

• Data is stored on Cloudflare D1 (SQLite) and Cloudflare KV — both encrypted at rest
• All API communications use TLS 1.3 encryption
• API keys and webhook signatures use HMAC-SHA256
• PAN numbers are hashed with SHA-256 before storage
• Two-factor authentication (TOTP) is enforced for all accounts
• We do not store payment card numbers, bank account numbers, or UPI PINs

4. Data Sharing

We do not sell your personal information. We share data only in these cases:

• With your customers — order status, merchant name, and UPI VPA are shown on the payment page
• Webhook delivery — payment data is sent to your configured webhook URL
• Infrastructure providers — Cloudflare (hosting, CDN, database) processes data as a sub-processor
• Legal requirements — if required by Indian law, court order, or regulatory authority

5. Google API Services — Limited Use Disclosure

UPIDrop's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, we:

• Only request access to your basic profile (email, name, picture) — the minimum needed for sign-in
• Do not use Google data for advertising or marketing purposes
• Do not transfer Google data to third parties except as needed to provide the service
• Do not use Google data for training AI/ML models

6. Data Retention

• Account data — retained while your account is active; deleted within 90 days of account deletion
• Transaction records — retained for 7 years as required by Indian tax and financial regulations
• Rate limiting data — automatically expires after 60 seconds
• Webhook logs — retained for 90 days

7. Your Rights

Under the Digital Personal Data Protection Act, 2023 (India), you have the right to:

• Access — request a copy of your personal data
• Correction — update or correct your information via Settings
• Erasure — request deletion of your account and associated data
• Grievance redressal — raise complaints about data processing

8. Cookies

We use localStorage (not cookies) to store your session token and theme preference. No third-party tracking cookies are used. The Google Sign-In widget may set its own cookies as per Google's Privacy Policy.

9. Children's Privacy

UPIDrop is not intended for users under 18 years of age. We do not knowingly collect data from minors.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of the service constitutes acceptance of the revised policy.

11. Contact Us

For privacy-related queries, data access requests, or grievances:

• Email: rohitmore3192@gmail.com
• Data Protection Officer: Rohit More
• Address: Mumbai, Maharashtra, India