Privacy Policy

1. Scope of this policy

This Privacy Policy explains how Zelo ("we", "us") collects, uses, shares, and protects information about you when you create an account, complete KYC verification, redeem coupons, transfer funds, request settlements, or otherwise interact with the Platform.

2. What we collect

We collect only the data we genuinely need to operate your account and meet our compliance obligations.

Account information — full name, email address, mobile number, hashed password, and the unique 11-digit account number assigned to you.
KYC documents — government-issued ID, a live selfie, and a recent address proof. These are stored in a private, encrypted bucket accessible only via short-lived signed URLs.
Profile details — date of birth, gender, occupation, PAN number, and full residential address (when provided).
Transactional data — coupons redeemed, transfers sent and received, settlement requests, fees, and ledger balances.
Security data — your TOTP secret (encrypted), hashed backup codes, and timestamps of recent verifications.
Technical data — IP address, user agent, device information, and timestamps required for audit logging and fraud detection.

3. How we use it

To verify your identity and meet anti-money-laundering and counter-terrorism-financing obligations.
To operate your wallet, process redemptions, transfers, and settlements.
To detect, investigate, and prevent fraud, abuse, or other security incidents.
To send important account notices, security alerts, and respond to support requests.
To analyse aggregated usage in order to improve the Platform — never to profile individual users for advertising.

4. Legal basis for processing

We process your personal data on the basis of (a) contract — to provide the Platform you have signed up for; (b) legal obligation — to meet AML/KYC and tax-related requirements; (c) our legitimate interests — to keep the Platform secure and free of abuse; and (d) your consent, where required (such as marketing communications, which you can withdraw at any time).

Only authorised Zelo staff with a job-related need may access your KYC documents, and every access is logged. Your transaction history is visible to you and to administrators reviewing requests. We do notsell, rent, or trade your personal data with third parties for advertising or marketing.

We may disclose information to (a) regulators, courts, or law-enforcement agencies where required by law; (b) trusted service providers (hosting, email delivery, fraud screening) bound by strict confidentiality obligations; and (c) successors in the event of a merger, acquisition, or business transfer.

6. How we protect your data

Data is encrypted at rest and in transit (TLS 1.2+). Database access is governed by row-level security policies so users only see their own rows. KYC files are accessed only via short-lived signed URLs. Sensitive admin operations require two-factor authentication and are written to an immutable audit log.

7. Retention

We retain account and transaction records for as long as your account is active, and for a defined period afterwards as required for accounting, dispute resolution, and regulatory recordkeeping. KYC documents are retained for the period mandated by applicable AML rules. After the retention period expires, data is securely deleted or anonymised.

8. Your rights

Subject to applicable law, you have the right to:

Access the personal data we hold about you;
Correct inaccurate or incomplete information;
Request deletion of your data (subject to records we are required to retain);
Object to or restrict certain processing;
Withdraw consent at any time where consent is the legal basis;
Lodge a complaint with the data-protection authority in your jurisdiction.

To exercise these rights, email care@zelopay.online. We will respond within 30 days.

9. Cookies and similar technologies

We use a small set of strictly necessary cookies for authentication, session management, and CSRF protection. We do not run third-party advertising trackers, social-media pixels, or behavioural analytics tools. A simple cookie notice appears on your first visit.

10. Children

The Platform is not intended for children under 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us so we can remove it.

11. International data transfers

Where data is transferred outside your country of residence, we rely on appropriate safeguards such as standard contractual clauses or equivalent protection mechanisms. We minimise cross-border transfers wherever possible.

12. Changes to this policy

We may update this policy from time to time. Material changes will be communicated by email or in-app notice at least 14 days before they take effect.

13. Contact

For privacy questions or to exercise any of your rights, write to care@zelopay.online.