Introduction & Scope
Welcome to CASHPAY MITRA (accessible via https://cashpaymitra.com and the CASHPAY MITRA Mobile Application). This Privacy Policy explains our practices regarding the collection, storage, processing, transfer, and protection of information when retailers, distributors, partners, and individual customers use our digital financial, banking, and utility recharge platform.
By accessing or using CASHPAY MITRA services—including AEPS (Aadhaar Enabled Payment System), Aadhaar Pay, DMT (Domestic Money Transfer), BBPS (Bharat Bill Payment System), Mobile/DTH Recharges, UTI/NSDL PAN Services, SoundBox, and Micro-ATM—you consent to the data practices outlined in this policy.
Information We Collect
To provide digital financial services, maintain regulatory compliance, and prevent fraud, we collect the following categories of information:
Full Legal Name, Father's Name, Date of Birth, Gender, Mobile Number, Email Address, Residential and Business Shop Address, Shop Name, Photo/Selfie, and Government ID proofs (such as PAN Card and Aadhaar Card as mandated for eKYC onboarding).
Bank Account Numbers, Bank Name, IFSC code, Cancelled Cheque/Passbook copy, UPI IDs, virtual wallet balances, ledger entries, settlement accounts, and transaction records.
Details of transactions performed on the portal: Recharge Mobile Numbers, DTH Consumer IDs, Bill CA Numbers, Transfer Amounts, Beneficiary Details, RRN (Retrieval Reference Number), Operator Transaction IDs, Date & Timestamps, and Status (Success/Pending/Failed).
IP address, Device IMEI/ID, Hardware Model, Operating System version, Biometric RD (Registered Device) Service metadata (Mantra/Morpho/Startek connectivity), and precise GPS Geolocation coordinates (mandatory per NPCI regulations for merchant AEPS/Micro-ATM cash dispensing).
How We Use Your Information
Service Execution
Processing AEPS withdrawals, domestic money remittances, recharges, bill payments, and payouts instantly.
eKYC & 2FA Authentication
Verifying retailer merchant credentials, managing two-factor authentication, and ensuring compliance with NPCI merchant rules.
Fraud Prevention & Risk Control
Detecting unusual activity, preventing unauthorized access, velocity checks, and avoiding financial chargebacks.
Customer Support & Disputes
Assisting retailers with transaction disputes, RRN tracking, refunds, commission queries, and portal operations.
Biometric & AEPS Data Policy
For transactions involving the Aadhaar Enabled Payment System (AePS) and Two-Factor Authentication (2FA), biometric data (fingerprint or iris scans) is captured exclusively via UIDAI-approved Registered Device (RD) Service applications.
CASHPAY MITRA NEVER stores, caches, retains, or has access to raw biometric templates or fingerprint images on its servers. The biometric data is encrypted at the hardware level by the OEM device (Mantra/Morpho/Startek), transmitted directly to the authorized sponsor bank and UIDAI/NPCI Central Identities Data Repository (CIDR) for matching, and immediately discarded from device memory.
Data Security & Storage
We employ robust multi-layer enterprise security standards to safeguard your sensitive information:
256-bit SSL
End-to-end encrypted HTTPS transmission
Secure Data Centers
Hosted in India with strict firewall rules
2FA Protection
Mandatory OTP & Biometric daily authentication
Your Rights & Choices
As a registered user or merchant of CASHPAY MITRA, you have the right to:
- Access and review your profile details and transaction histories via your dashboard.
- Request correction of inaccurate or incomplete personal or banking data.
- Opt-out of promotional communications by contacting our support desk.
- Request deletion of your account and associated personal credentials as described below.
Account & Data Deletion Policy
Users and retailers have the right to request permanent deletion of their CASHPAY MITRA account. In accordance with Google Play Store Developer Guidelines and data privacy laws, you can submit an account deletion request directly through our portal or app.
Want to delete your account or data?
Review the statutory retention criteria and submit your request.
Grievance Redressal Officer
In accordance with the Information Technology Act 2000 and the Rules made thereunder, the name and contact details of the Grievance Officer are provided below: