Growzy Payment Gateways ("Growzy", "we", "our", or "us"), operated under GrowzyLabs, provides digital wallet accounting and programmatic payment routing infrastructure. This Privacy Policy describes our practices regarding the collection, use, and protection of information when you access or integrate with our platform.

1. Information We Collect

To provide reliable fintech infrastructure, we collect information across these categories:

• Account Identification: Full name, email address, password hash (Argon2id), mobile phone number, and IP address upon registration.
• Financial & Transaction Records: Deposit references, 12-digit bank UTR numbers, withdrawal UPI VPAs, transaction amounts, timestamps, and double-entry ledger journals.
• Developer Credentials: Public API keys (key_id), encrypted secret hashes (AES-256-CBC), webhook target URLs, and request payload signatures.
• Technical Telemetry: HTTP user agents, IP addresses, request latency, idempotency tokens, and cryptographic nonce markers used exclusively for fraud detection and replay prevention.

2. How We Use Information

We process collected data under the following legitimate financial and operational grounds:

• Executing double-entry balance credits, holds, payouts, and immutable ledger operations.
• Generating dynamic 5-minute UPI QR payment sessions and matching bank UTR submissions.
• Dispatching signed HMAC-SHA256 webhook notifications to your configured endpoints.
• Enforcing rate limits, SSRF prevention, IP bans, and preventing financial fraud.
• Fulfilling Indian financial, tax, and cyber regulatory compliance mandates.

3. Data Protection & Encryption

We deploy military-grade security controls. All merchant API secrets and webhook signing keys are stored in encrypted form using AES-256-CBC. All communications over public networks require TLS 1.3 encryption. Passwords are salted and hashed using Argon2id with high memory-cost parameters.

4. Data Sharing & Third Parties

We do not sell, rent, or trade merchant or end-user data. Data is shared strictly with banking partners and UPI settlement networks as necessary to verify UTRs and complete withdrawal payouts, or when mandated by a court of competent Indian jurisdiction.

5. Data Retention & Ledger Immutability

In accordance with financial record-keeping standards, immutable ledger journals and transaction history are maintained for compliance and audit reconciliation purposes. Account holders may request profile anonymization upon settlement of all open balance obligations.

6. Contact Privacy Team

For inquiries regarding your personal data or this policy, please reach out via our Contact Page or write to privacy@growzylabs.in.