Privacy Policy & DPDP Act 2023 Compliance

1. Introduction

This Privacy Policy explains how FamGateway collects, uses, encrypts, and protects your information when you access our payment gateway, API dashboards, or website at https://famgateway.in.

2. Information We Collect

To provide automated payment processing services, we collect only necessary developer and account data:

• Account Details: Name, email address, password hash (salted and hashed via bcrypt), and unique Merchant ID.
• Payment Configuration: Your public FamPay UPI ID (e.g. username@fam) to generate QR codes.
• Email Verification Credentials: Dedicated single-purpose Google App Passwords provided by you for automated transaction receipt matching.
• Transaction Metadata: Order amounts, timestamps, transaction statuses (Paid/Pending/Expired), and customer IP logs for anti-fraud detection.

3. Cryptographic Architecture & Credential Protection (AES-256)

FamGateway adheres to a rigorous defense-in-depth cryptographic model designed to protect merchant credentials against database breaches, unauthorized access, and pattern analysis:

1. 256-Bit Symmetric Encryption with Dynamic IVs: All sensitive credentials (including 16-character Google App Passwords) are encrypted using 256-bit Advanced Encryption Standard (AES-256) prior to storage in our database. Every encryption call dynamically generates a cryptographically secure 16-byte pseudorandom Initialization Vector (IV) via openssl_random_pseudo_bytes(16). Because no two database records ever share the same IV, ciphertext pattern analysis and rainbow-table attacks are mathematically impossible.
2. Server-Level Key Separation (Database Isolation): The master 256-bit encryption key is stored strictly within server-level environment configuration files (env.php) protected by restricted Linux filesystem permissions. The encryption key is never stored in the MySQL database. In the event of a raw database dump or SQL compromise, an adversary obtains only scrambled ciphertexts that cannot be decrypted without the isolated server environment key.
3. Stateless In-Memory Volatile Processing: Incoming FamPay transaction emails are inspected strictly in transient, volatile server memory (RAM) during active polling. The execution lifecycle lasts under 5 milliseconds: as soon as the Bank UTR and payment amount are matched against an active order, the memory buffer is immediately flushed. Email contents, sender personal messages, and inbox archives are never written to disk, database, or persistent logs.
4. Zero Primary Password Access: FamGateway strictly prohibits and never requests your primary Google account password. Only isolated, single-purpose 16-character Google App Passwords generated specifically for mail access are utilized.
5. Unilateral Merchant Revocation Rights: Because merchants utilize Google App Passwords rather than account credentials, you retain absolute, real-time control. You can revoke access in one click directly inside your Google Account Security Settings at any second. Revoking the password at Google instantly renders the encrypted database entry completely inert, even before updating your FamGateway dashboard.
6. Defense-in-Depth Infrastructure: All data in transit is protected using TLS 1.3 encryption with strict HSTS headers. Database access is restricted to localhost socket connections, and backend application execution is monitored in real time via Sentry for unauthorized anomaly detection.

4. Non-Custodial Architecture: No Financial Data Storage

FamGateway is an automated software bridge. We do not store credit card numbers, debit card PINs, CVVs, or bank net-banking credentials. 100% of the financial transaction occurs over the secure, encrypted NPCI UPI network directly into your personal account.

5. How We Use Collected Information & Lawful Basis (DPDP Act, 2023 — Section 6)

Under Section 6 of the DPDP Act, 2023, personal data may only be processed for specified, lawful purposes based on unambiguous consent or certain legitimate uses. FamGateway processes personal data under the following lawful bases:

6. Information Sharing, Data Processors & Cross-Border Transfer (DPDP Act, 2023 — Section 16)

We do not sell, rent, trade, or share your personal data with third-party advertisers or data brokers under any circumstances.

Information is processed strictly within the following boundaries:

• Data Processors: We engage verified cloud infrastructure providers (Aryanispe Host, operating within India) under formal Data Processing Agreements (DPAs) in compliance with Section 8(2) of the DPDP Act. Data processors act solely on our instructions and maintain equivalent technical safeguards.
• Zero Cross-Border Data Transfer: All FamGateway servers, database instances, and backups are hosted exclusively in tier-3/tier-4 data centers physically located within the sovereign territory of the Republic of India. In strict compliance with Section 16 of the DPDP Act, 2023, no personal data of Indian Data Principals is transferred to blacklisted jurisdictions or stored outside Indian borders.
• Statutory Disclosures: Information may be disclosed only if mandated by applicable Indian Law, court order, or authorized government agencies pursuant to valid, verified legal process under Section 7 of the DPDP Act.

7. Statutory Data Principal Rights (DPDP Act, 2023 — Sections 11, 12, 13 & 14)

FamGateway fully upholds all statutory rights granted to Data Principals (merchants and registered developers) under Chapter III of the DPDP Act, 2023:

• Right to Access Information (Section 11): You have the right to obtain a summary of your personal data being processed, details of data shared with any third party, and any other information prescribed by DPDP Rules.
• Right to Correction & Updating (Section 12(1)): You have the right to correct inaccurate personal data, complete incomplete records, or update registration details directly via your merchant dashboard or by contacting our Grievance Officer.
• Right to Erasure & Data Scrubbing (Section 12(2)): You have the right to request the complete erasure of your personal data once the specified processing purpose is fulfilled. Upon account deletion, all encrypted App Passwords, webhook logs, and contact details are permanently purged from database tables within 30 days.
• Right to Withdraw Consent (Section 6(4)): You may withdraw consent at any time with the same ease with which it was given. Disconnecting Gmail or revoking the Google App Password inside your Google Security settings instantly halts all email verification sessions.
• Right of Grievance Redressal (Section 13): You have the right to readily available grievance redressal provided by our designated Grievance Officer, with guaranteed statutory response timelines.
• Right to Nominate (Section 14): You have the right to designate a nominee who can exercise your data rights in the event of death or incapacity, by submitting a formal nomination to our Grievance Officer.

8. Data Retention Policy & Automatic Data Scrubbing (DPDP Act, 2023 — Section 8(7))

Pursuant to Section 8(7) of the DPDP Act, 2023, a Data Fiduciary must erase personal data as soon as the purpose for which it was collected has been served, unless retention is required under statutory law:

• Active Merchant Accounts: Profile data and encrypted API credentials are retained for the lifetime of the active account.
• Closed Accounts: All personal credentials (encrypted App Passwords, phone numbers, email linkages) are irrevocably deleted within 30 calendar days of account termination.
• Transaction Audit Logs: Payment verification metadata (UTR, order ID, amount, timestamp) is retained for 180 days for reconciliation and dispute resolution, after which it is anonymized.
• IMAP Volatile Processing Buffer: Incoming email content is held in memory for less than 5 milliseconds and wiped immediately upon regex match. Zero email data persists to disk.

9. Personal Data Breach Notification Protocol (DPDP Act, 2023 — Section 8(6))

Under Section 8(6) of the DPDP Act, 2023 and DPDP Rules, 2025, in the unlikely event of a personal data breach affecting merchant records:

• FamGateway will notify the Data Protection Board of India in the form and manner prescribed by statutory rules.
• Every affected Data Principal (merchant) will receive an immediate, transparent notification via registered email and dashboard alert detailing the nature of the breach, affected data categories, remedial actions taken, and recommended safety steps (such as cycling API keys or revoking App Passwords).

10. Protection of Children & Minors (DPDP Act, 2023 — Section 9)

FamGateway is a B2B payment gateway infrastructure service designed for registered merchants, developers, and business owners who have attained the age of majority (18 years) in India. FamGateway does not knowingly collect personal data of children under 18 years of age without verifiable parental consent, nor do we engage in behavioral tracking or targeted advertising directed at minors, in strict adherence to Section 9 of the DPDP Act, 2023.

11. Cookies & Session Security

FamGateway uses strict, secure session cookies (configured with HttpOnly, SameSite=Strict, and Secure flags) exclusively to maintain authenticated merchant sessions. We do not use third-party advertising cookies, retargeting pixels, or behavioral tracking scripts.

12. Grievance Officer & Data Protection Contact (DPDP Act, 2023 — Section 13)

13. Escalation to the Data Protection Board of India (DPDP Act, 2023 — Section 18)

If your grievance is not resolved by our Grievance Officer within 30 days, or if you are unsatisfied with the resolution, you have the statutory right under Section 18 of the DPDP Act, 2023 to file a formal complaint with the Data Protection Board of India — the statutory body established by the Central Government to adjudicate non-compliance and enforce data privacy standards across the nation.

14. Changes to This Privacy Policy

FamGateway reserves the right to update this Privacy Policy to reflect evolving technical practices or amendments to statutory DPDP Rules. Material changes will be communicated via dashboard announcement and registered email notification. The effective date of this version is October 1, 2026.

Back to Homepage →