Privacy Policy
Privacy Policy
NotePay is committed to protecting your privacy. This policy outlines how we collect, handle, and protect your personal information and financial records.
✓ No data monetization: We do not sell or lease user information to third parties
✓ No third-party advertisements or behavioral tracking networks
✓ Encrypted cloud storage and role-based data isolation
1. Information We Collect
Authentication Details: Your mobile phone number is collected solely to issue SMS one-time passwords (OTP) for secure account authentication.
Profile Information: Your full name and optional gender selection are used to identify your activity across authorized event ledgers.
Event & Financial Records: Contribution entries, expenditure logs, category classifications, and custom metadata fields you create are securely stored in cloud databases.
Payment Identifiers: Organizers provide their UPI ID and Registered Name to generate payment routing QR codes and enable automated receipt verification.
Transaction Receipt Images: Payment proof screenshots uploaded via public contribution pages are processed temporarily to verify transaction parameters.
Device Notification Identifiers: Upon receiving explicit user permission, we store an anonymized Firebase Cloud Messaging (FCM) device registration token to dispatch operational alerts.
2. Purposes of Processing
To authenticate user sessions and safeguard account access.
To synchronize event records, ledger entries, and custom columns in real time across authorized team devices.
To perform automated optical character recognition (OCR) verification on transaction receipts.
To deliver critical operational notifications, including contribution confirmations, expense records, delegation changes, milestone achievements, and weekly financial digests.
3. Real-Time Communications & Notification Controls
NotePay utilizes Web Push and Firebase Cloud Messaging (FCM) to deliver operational notices under a strict utility-first and silence-by-default policy:
Operational Scope: Push notifications are restricted to event financial transactions, member administration, milestone achievements, and scheduled weekly summaries. Promotional broadcasts and advertising campaigns are never dispatched.
Multi-Device Token Management: Distinct device tokens are maintained per authorized device and are invalidated upon user sign-out or permission revocation.
User Revocation: You can enable, modify, or revoke push notification permissions at any time through your browser settings, mobile operating system settings, or the in-app Notification Center.
4. Information Sharing & Sub-Processors
We do not sell, rent, or trade your personal data. Information is shared solely under the following operational boundaries:
Authorized Event Members: Your profile display name and ledger contributions are accessible only to verified organizers, collectors, and participants of events you join. Public events display ledger records openly as configured by event organizers.
Cloud Infrastructure Sub-Processors: Encrypted data storage and notification payloads are processed through enterprise cloud infrastructure providers (including Google Cloud and Firebase).
Legal Compliance: We may disclose information if required by applicable law, regulatory request, or enforceable governmental order.
5. Artificial Intelligence & Vision Processing
NotePay integrates enterprise artificial intelligence models (such as Google Gemini) to provide @ai chat analysis and automated receipt verification:
Scoped Processing: Only the specific receipt screenshot or ledger calculation prompt is securely transmitted to the AI engine for real-time inference.
No Public Model Training: Under enterprise terms of service, your uploaded receipts, financial records, and queries are strictly prohibited from being utilized to train public machine learning models.
6. Data Security & User Rights
Security Standards: We implement administrative, technical, and physical safeguards, including encryption in transit (TLS 1.3) and encryption at rest, to prevent unauthorized data access or loss.
Data Subject Rights: You may request account closure, personal data export, or ledger purging at any time through the Help & Support section within your Profile settings.