Last updated: 17 September 2026
This policy explains what Payredoo collects, why, how long it is kept and
what you can ask us to do with it. It describes how the service actually
behaves rather than listing every category we could conceivably collect.
Who we are
Payredoo operates a multi-currency wallet and payments service. For the
purposes of data protection law we are the data controller for the information
described here. You can reach us at the support address published on our
website and in the app.
What we collect
Information you give us
- Account details — your name, email address, mobile
number, the handle you choose, and (for business accounts) your company
name, entity type and registration details.
- Contact and address — address line, city, state, postal
code and country, where you provide them.
- Identity verification (KYC) — when you verify your
account we collect your full legal name, date of birth, the type of
identity document, images of the document and a selfie. For business
accounts we also collect registration and tax identifiers and details of
the authorised signatory.
- Payment details — bank account and UPI identifiers for
the beneficiaries you save, and the payment references you enter when you
top up.
- Support messages — anything you send us through the
contact form or a support ticket.
Information created by your use of the service
- Transactions — top-ups, withdrawals, transfers,
conversions and their amounts, currencies, counterparties, timestamps and
status. Financial records are kept as an append-only ledger.
- Security and sign-in — the time and IP address of your
last sign-in, failed PIN attempts, and whether two-factor authentication
is enabled.
- Device and preferences — your language, light or dark
theme, notification preferences, and a push notification token if you
allow notifications.
What we deliberately do not store
- Full identity document numbers. We store only the last
four characters plus a one-way hash, which lets us detect a duplicate
submission without keeping the number itself.
- Your password or payment PIN. Both are stored only as
one-way hashes and cannot be read back by us.
- Card numbers. The service does not take card payments.
Permissions the app asks for
- Camera — to scan payment QR codes and to photograph your
identity documents during verification. Images are captured only when you
start one of those actions.
- Photos and media — so you can upload an existing document
image or a profile picture instead of taking a new photo.
- Biometrics — to unlock the app with your device's
fingerprint or face. The biometric itself never leaves your device and is
never sent to us; the device only tells the app whether the check passed.
- Internet — to reach our servers.
Why we use it
- To provide the wallet: holding balances, moving money, showing history.
- To verify who you are, which we are legally required to do before
certain services are available.
- To detect and prevent fraud, money laundering and abuse.
- To notify you about activity on your account, and to answer you when you
contact support.
- To meet our legal, tax and regulatory obligations, including responding
to lawful requests from authorities.
Who we share it with
We do not sell your personal information, and we do not share it for
advertising. We share it only with:
- Payment and banking partners that settle the money you
send or receive.
- Identity verification providers, where used to check the
documents you submit.
- Infrastructure providers that host the service and
deliver our email and push notifications, acting on our instructions.
- Authorities and regulators, where the law requires it.
How long we keep it
Financial and verification records are kept for as long as the law requires
after your account closes — for regulated payments this is typically several
years, and it applies even if you ask us to delete your account. Information
that is not subject to those obligations is deleted or anonymised once it is no
longer needed.
Your rights
You can ask us to give you a copy of your information, correct it, delete it,
or restrict how we use it. Some requests we cannot fully honour — we cannot
delete a transaction record we are required to retain — and where that is the
case we will tell you plainly which parts we kept and why. To make a request,
contact us at the support address published on our website.
Security
Traffic between the app and our servers is encrypted in transit. Passwords
and payment PINs are stored as one-way hashes. Access to production systems is
restricted to staff who need it. No system is perfectly secure, and we will tell
you without undue delay if a breach affects your information.
Children
The service is not for anyone under 18, and we do not knowingly collect
information from children.
Changes
If we change this policy we will update the date above and, where the change
is significant, tell you in the app or by email.