ClearFinTech, operated by MYRJ Business and Culture Promotion Private Limited (“we”, “us”, or “our”), is committed to upholding the highest standards of data security and privacy. We strictly comply with the Reserve Bank of India (RBI) Master Directions for Payment Aggregators (PAs), the Digital Personal Data Protection Act (DPDP Act, 2023), and RBI Card Tokenization guidelines.
1. Scope and Applicability
This Privacy Policy governs the processing of personal and transactional data collected when institutional merchants, educational bodies, and individual payees use the ClearFinTech Payment Gateway, checkout interfaces, merchant portals, and REST API interfaces.
2. Information We Collect
- Merchant Identification Data: Registered Business Name, PAN, GSTIN, Bank Account details, Certificate of Incorporation, and authorized signatory KYC documents.
- End-User Transaction Metadata: Order Reference ID, payer email address, payer mobile number, transaction amount, currency (INR), and IP address.
- Card Vault & Payment Attributes: In accordance with RBI Card-on-File Tokenization (CoFT) rules, ClearFinTech assigns unique surrogate tokens (
wc_...) for registered cards. Plaintext card PANs are masked (First 6 and Last 4 digits) across all database records and audit logs.
3. Strict Cardholder Data Exclusions (Zero Plaintext Card Storage)
Zero Storage of Sensitive Authentication Data (SAD): ClearFinTech strictly prohibits the storage of Card Verification Value (CVV / CVC / CID) numbers or Cardholder PINs. CVVs entered during checkout are transmitted solely in volatile memory to the certified acquiring switch (SuperVendor / HDFC SmartGateway) for real-time 3DS authorization and are immediately purged (*** [REDACTED]).
4. Purpose of Data Processing
We process collected data for legitimate operational and compliance purposes:
- Routing card, UPI, and NetBanking authorizations to upstream acquiring switches.
- Executing instant IMPS/NEFT disbursals to verified beneficiary accounts.
- Preventing financial fraud, detecting unauthorized chargebacks, and anti-money laundering (AML) screening under the Prevention of Money Laundering Act (PMLA).
- Providing merchants with real-time settlement ledgers, invoice reconciliations, and downloadable CSV statements.
5. Data Sharing & Third-Party Disclosures
ClearFinTech does not sell, rent, or trade merchant or customer personal data. Data is shared exclusively with:
- Certified Acquiring Switches: SuperVendor / Spaid upstream processing rails and member banks for clearing and settlement.
- National Payments Corporation of India (NPCI): For UPI and IMPS switch routing.
- Regulatory Authorities: Reserve Bank of India, Financial Intelligence Unit (FIU-IND), and statutory law enforcement agencies pursuant to valid court warrants.
6. Cryptographic Security Standards
ClearFinTech deploys enterprise-grade technical safeguards including:
- Transport Encryption: Forced TLS 1.3 encryption across all public and internal API endpoints.
- Vault Storage: OpenSSL AES-256-GCM symmetric encryption for card credentials and merchant secret keys.
- Session Authenticity: HMAC-SHA256 signed session tokens with short-lived expiration windows to mitigate Insecure Direct Object References (IDOR).
7. Data Retention & Disposal
In compliance with RBI Master Directions, payment transaction logs, settlement UTRs, and merchant KYC documentation are retained securely for a minimum of ten (10) years from the transaction date. Following this statutory period, archived data is cryptographically expunged.
8. Data Protection & Grievance Officer
For inquiries regarding your personal data rights under the DPDP Act or to request data corrections, contact our designated Data Protection Officer: