Privacy Policy

1. Who we are and the scope of this policy

This Privacy Policy is issued by [LEGAL ENTITY NAME] ("Nodal Pay", "we", "us"), with its registered office at [REGISTERED OFFICE ADDRESS]. It covers personal data processed in connection with this website and the Nodal Pay mobile application, which is currently under development and not yet available for download.

Because the app has not launched, parts of this policy describe processing that is planned or expected rather than processing that happens today. We draft in that spirit deliberately: it lets you see, in advance, how the platform is designed to handle personal data. A finalised version of this policy will be published before launch.

This policy is prepared with reference to the Digital Personal Data Protection Act 2023, the Information Technology Act 2000 and rules made under them, together with applicable RBI regulations, as applicable law. It should be read alongside our Terms of Use, Cookie Policy and Data Retention and Deletion Policy.

2. Data we collect today, through this website

This website is an informational, pre launch site. You do not need an account to use it, and we currently collect very little through it:

• Notify form. The "Notify Me" form on this site is a preview of a planned waitlist. It does not currently store or send anything you type into it. When the waitlist is activated closer to launch, the form will say so clearly and this policy will be updated first.
• Server and log data. Like most websites, our hosting infrastructure may record standard technical logs, such as IP address, browser type, pages requested and timestamps, used for security monitoring and troubleshooting.
• Cookies and similar technologies. These are described separately in our Cookie Policy.

If you write to us at [SUPPORT EMAIL], we will receive whatever information you choose to include in your message and will use it to respond to you.

3. Data the app is expected to collect at launch

When the Nodal Pay app launches, we expect to collect the categories below. The final list will depend on the product as launched, applicable law, and the requirements of the regulated payment partners we work with. The final payment and fund handling structure will likewise depend on applicable law and those partners.

Category	Examples
Identity and contact details	Name, mobile number, email address
KYC related information	Identity or address verification details, where required by law or by our regulated payment partners
Deal and transaction records	Deal terms agreed between buyer and seller, deal status, payment references, communications within a deal
Device and log data	Device model, operating system, app version, IP address, crash and diagnostic logs

We plan to collect only what a given feature genuinely needs, and to explain each request for data at the point it is made in the app.

4. Purposes for which data will be used

Personal data is expected to be used to:

• create and maintain your account and verify your identity where required;
• set up, record and complete protected deals between buyers and sellers;
• process payments through regulated payment partners;
• prevent, detect and investigate fraud, misuse and violations of our Acceptable Use Policy and AML and Prohibited Activities Policy;
• handle disputes under our Dispute Resolution Policy and grievances under our Grievance Redressal Policy;
• provide customer support and service communications;
• meet legal, regulatory and tax obligations; and
• improve the reliability, safety and usability of the platform.

5. Consent and legal bases

Where consent is the applicable basis under the Digital Personal Data Protection Act 2023, we plan to seek it through clear, specific notices before or at the time of collection, and to make withdrawing consent as straightforward as giving it. Withdrawing consent will not affect processing already carried out, and some processing, such as record keeping required by law or by regulated payment partners, may continue on other grounds recognised by applicable law, such as legal obligation or certain legitimate uses.

6. How data will be shared

We do not sell personal data, and we do not plan to. Data is expected to be shared only:

• with regulated payment partners, to the extent needed to process payments and meet their onboarding and compliance requirements;
• with service providers who support the platform (for example hosting, analytics, customer support tooling), under contracts that restrict their use of the data;
• with the counterparty to your deal, limited to the information needed to set up and complete that deal;
• where required by law, regulation, court order or a lawful request from a government authority; and
• in connection with a corporate restructuring, subject to safeguards required by applicable law.

7. Data retention

We plan to keep personal data only for as long as it is needed for the purposes above, or for the periods that applicable law and our payment partners require, certain financial and KYC records must be retained for statutory periods even after an account is closed. Planned retention periods and the deletion process are set out in our Data Retention and Deletion Policy.

8. Your rights and how to exercise them

Subject to applicable law, you are expected to have the right to:

• access a summary of the personal data we hold about you;
• request correction or updating of inaccurate or incomplete data;
• request erasure of data that we are not required to retain;
• withdraw consent you have previously given; and
• raise a grievance and have it addressed within defined timelines.

You will be able to exercise these rights through in app controls where available, or by writing to [SUPPORT EMAIL]. We may need to verify your identity before acting on a request, and we will explain if a legal retention requirement prevents us from fulfilling part of it.

9. Children

Nodal Pay is intended for users aged 18 years and above. The app is not designed for children, and we do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, please contact [SUPPORT EMAIL] so we can take appropriate action.

10. Security practices

We are designing the platform to follow reasonable security practices and procedures consistent with applicable law, including encryption of data in transit, access controls, and logging and monitoring of key systems. These measures will be reviewed as the product develops.

No system can be made completely secure, and we do not claim absolute security. If you believe you have found a security issue in our website or, after launch, in our app, please report it to [SECURITY EMAIL] as described in our Security Disclosure Policy.

11. Cross border processing

Some of our service providers may process data on infrastructure located outside India. Any cross border processing will be carried out in accordance with the Digital Personal Data Protection Act 2023 and any restrictions notified under it, and financial records will be handled in line with the requirements of applicable law and our regulated payment partners.

12. Grievance officer

In line with applicable Indian law, we will designate a grievance officer before launch:

• Name: [GRIEVANCE OFFICER NAME]
• Email: [GRIEVANCE EMAIL]

Details of how grievances are acknowledged, escalated and resolved, including planned timelines, are set out in our Grievance Redressal Policy.

13. Changes to this policy

Because Nodal Pay is under development, this policy will change as the product takes final shape. We will update the "Last updated" date whenever we revise it, and a finalised version will be published before launch. For significant changes after launch, we plan to give notice through the app or by email before the changes take effect. Questions about this policy can be sent to [SUPPORT EMAIL].