PRIVACY POLICY

Last Updated: August 10, 2026

Mythri Smart Bazaar Private Limited (“Company,” “we,” “us,” or “our”) operates the website https://mythrismartbazaar.com (the “Site”), the Q-Pay Customer Application, and the Q-Pay Merchants Application (collectively, the “Services”). We are committed to protecting the privacy and security of the personal and financial data of our retail customers (“Customers”) and business partners (“Merchants”).

This Privacy Policy explains how we collect, use, process, disclose, store, and protect your information in compliance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, the Digital Personal Data Protection (DPDP) Act, 2023, and the Prevention of Money Laundering Act, 2002 (PMLA) of India.

By registering for, accessing, or using the Q-Pay Customer App, Q-Pay Merchants App, or Site, you consent to the data practices described in this policy.

1. Information We Collect

We collect information necessary to deliver offline shopping facilitation, payment processing, rewards management, and regulatory compliance.

A. Information Collected from Customers (Users)

  • Personal & Identity Data: Full name, mobile phone number, email address, date of birth, VPA ID’s and identity verification documents (e.g., Aadhaar, PAN, or voter ID) when required for Know Your Customer (KYC) verification.
  • Transaction & Usage Data: Purchase histories at partner merchant stores, discount/cashback rewards balance, payment amounts, timestamps, and store locations.
  • Financial & Billing Data: Encrypted UPI IDs, bank account details, and billing information used to facilitate payments or process cashbacks.
  • Technical & Device Information: IP address, device model, operating system version, unique device identifiers, and location data (to show nearby partner merchants).

B. Information Collected from Merchants (Shop Owners)

  • Business & Identity Data: Business owner name, trade name, physical storefront address, email address, mobile number, Government-issued IDs, PAN, and GSTIN (where applicable).
  • Financial & Settlement Data: Bank account numbers, IFSC codes, UPI details, and settlement transaction logs necessary to transfer bill amounts collected via Q-Pay Static QR Codes.
  • Storefront & Branding Information: Shop signage images, shop categories, product/service descriptions, and promotional material consent for display within the Q-Pay app directory and on physical storefronts.

2. How We Use Your Information

We use the collected information for the following specific purposes:

  1. Service Delivery: Onboarding Customers and Merchants, verifying accounts, issuing Static QR Codes, facilitating instant UPI payments, and crediting rewards or cashbacks.
  2. KYC & Regulatory Compliance: Verifying identities, ensuring age eligibility (18+), and fulfilling obligations under Indian financial, tax (GST), and Anti-Money Laundering (PMLA) regulations.
  3. Real-Time Fraud Prevention: Monitoring transactions continuously in real time to detect, prevent, and respond to unauthorized access, money laundering, fraud, or security breaches.
  4. Communication: Sending transaction notifications, service updates, administrative alerts, and advance notifications regarding changes to our Terms or Privacy Policy.
  5. Platform Improvement & Marketing: Analyzing aggregate usage trends, improving application performance, and displaying relevant partner merchant discounts or store promotions.

3. Data Protection & Security Practices

In accordance with the IT (Reasonable Security Practices) Rules, 2011, and financial industry standards:

  • Encryption: All payment credentials, billing details, and sensitive personal data are encrypted in transit (using SSL/TLS) and at rest using industry-standard cryptographic algorithms.
  • Access Controls: Strict role-based access controls and authentication mechanisms ensure that only authorized personnel have access to sensitive data.
  • Data Integrity: We implement robust firewalls, real-time intrusion monitoring, and routine security assessments to safeguard against unauthorized access, loss, or alteration of data.
  • User Precautions: While we enforce enterprise-grade security, users and merchants are responsible for safeguarding their login credentials, security PINs, and mobile devices.

4. Disclosure & Sharing of Information

We do not sell, rent, or trade your personal data to third parties. We may share information only under the following strictly defined conditions:

  • Between Customers & Merchants: Minimal transaction details (such as payment status and bill amount) are shared between the Customer and the respective Merchant to verify and complete store purchases.
  • Service Providers & Partners: We may share data with trusted third-party technology providers, payment gateways, or cloud hosting infrastructure partners who assist in operating our Services under strict confidentiality agreements.
  • Legal & Regulatory Authorities: We reserve the right to disclose personal, financial, or transaction records to Indian law enforcement, tax authorities (GST), financial intelligence units (under PMLA), or judicial bodies when required by law, subpoena, or court order.
  • Business Transfers: In the event of a merger, acquisition, restructuring, or sale of assets, user data may be transferred as part of the business assets, subject to the buyer agreeing to respect this Privacy Policy.

5. Data Retention & Deletion

  • Retention Period: We retain your personal and transaction data only as long as your account remains active or as necessary to fulfill the purposes outlined in this policy.
  • Statutory Requirements: Transaction logs, financial records, and KYC documentation will be retained for a mandatory minimum period (typically 5 years) as mandated under Indian Anti-Money Laundering (PMLA) laws and tax statutes, even after account closure.
  • Account Deletion: You may request account deletion by emailing support@mythrismartbazaar.com. Upon verification, we will delete or anonymize your personal data, except where statutory retention laws require us to retain specific financial records.

6. Your Rights (DPDP Act, 2023)

Under applicable Indian data protection laws, you have the right to:

  • Access & Review: Request a summary of the personal data we hold about you and details of processing activities.
  • Correction & Erasure: Request the correction of inaccurate, incomplete, or outdated data, or the deletion of data (subject to legal retention obligations).
  • Withdraw Consent: Withdraw consent for optional processing (e.g., marketing communications) at any time, without affecting the lawfulness of processing based on consent prior to withdrawal.
  • Grievance Redressal: Seek prompt resolution of any concerns regarding your personal data through our designated Grievance Officer.

7. Third-Party Links & Merchant Services

Our Site or App directory may contain links to third-party websites or independent merchant storefronts. Mythri Smart Bazaar Private Limited is not responsible for the privacy practices, return policies, or content of external websites or independent shop owners. We encourage you to review the privacy policies of any third-party platform you visit.

8. Updates to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our legal obligations, technology, or business operations. Any updates will be notified in advance via email or in-app notifications, along with an updated “Last Updated” date on this page. Continued use of Q-Pay Services after such notice constitutes your acceptance of the revised Privacy Policy.

9. Grievance Officer & Contact Information

In accordance with the Information Technology Act, 2000 and rules made thereunder, the name and contact details of our Grievance Officer are provided below for any data privacy concerns, grievances, or queries: