Privacy Policy

1. Introduction & Overview

Welcome to ZayanPay ("Platform", "we", "our", or "us"). We operate an innovative online payment automation platform engineered to enable merchants, online shops, and digital businesses across Bangladesh to receive instant Mobile Financial Services (MFS) payments such as bKash, Nagad, Rocket, Upay, and other approved gateways.

This Privacy Policy describes our practices regarding the collection, storage, utilization, and disclosure of information when you access our website (https://zayanpay.com), register as a merchant, utilize our automated checkout APIs, or install our Android Companion synchronization application.

2. Information We Collect

To provide reliable transaction automation, security checks, and anti-fraud verification, we collect the following categories of information:

A. Merchant Account Information

• Personal Identity: Owner full name, business or brand name, official contact phone number, and verified email address (@gmail.com, @yahoo.com, @outlook.com).
• KYC & Verification Documents: Encrypted digital scans of National Identity Cards (NID Front & Back) provided during onboarding to satisfy regulatory anti-money laundering (AML) and know-your-customer (KYC) guidelines.
• Security Credentials: Passwords encrypted using industry-standard bcrypt hashing algorithms. We never store or transmit plain-text credentials.

B. Android Companion Mobile App Data

To automate real-time verification of incoming MFS transactions, merchants install the official ZayanPay Android Companion App on their dedicated Android device.

• SMS Transaction Parsing: The Companion app scans incoming SMS strictly from authorized telecom provider senders (e.g., bKash, NAGAD, 16216, 16259). It parses financial parameters: Transaction ID (TrxID), received amount, and timestamp.
• Privacy Isolation: The application does not read, upload, or process private conversations, personal contacts, gallery images, or messages from non-financial senders.
• Device State: Battery level, network connectivity status, and app heartbeat are transmitted to notify merchants if their device goes offline.

C. Transaction & Webhook Logs

• Invoice numbers, transaction reference IDs, billed amounts, payment gateway slugs, and IP addresses of checkout shoppers.
• Callback webhook transmission logs and verification status (completed, pending, or expired).

3. How We Use Collected Data

We use the collected information solely for the following legitimate commercial purposes:

1. Instant Automated Reconciliation: Matching incoming customer TrxIDs with corresponding order invoices within seconds.
2. Fraud & Duplicate Shield: Preventing multiple orders from claiming the same TrxID and protecting merchants from duplicate payment exploits.
3. Account Management & Billing: Managing your subscription plan, API tokens, webhook endpoints, and invoice generation.
4. System Reliability & Notifications: Sending critical operational alerts, OTP verification codes, and security login notifications.

4. Data Security & Encryption

Security is foundational to ZayanPay. We employ rigorous technical and organizational measures:

• Transport Layer Security (TLS): All communications between merchants, checkout pages, mobile companion apps, and our servers are encrypted using modern TLS 1.3 / HTTPS.
• Storage Protection: KYC documents are stored in protected, restricted directories with randomized unique hashes to prevent unauthorized access.
• Database Isolation: Multi-tenant isolation safeguards merchant data and prevents cross-tenant access.
• Bot & DDoS Protection: Protected by Cloudflare network shields and intelligent rate-limiting algorithms.

5. Data Disclosure & Third Parties

We never sell, rent, or trade merchant or customer data. Information is only shared under the following limited circumstances:

• Legal & Regulatory Compliance: If required by Bangladesh law, court summons, or official regulatory directives from financial authorities.
• Service Providers: High-reputation cloud hosting, transactional email delivery (SMTP), and security verification partners bound by strict confidentiality terms.

6. Your Rights & Choices

As a registered merchant on our platform, you hold the right to:

• Access, review, and update your profile information from the merchant dashboard.
• Request removal or de-registration of connected Android companion devices.
• Request account closure and data archival by contacting our compliance desk.

7. Contact Us Regarding Privacy

If you have questions, feedback, or data privacy concerns, please contact our Data Protection Officer: