Sapthan Pay — Privacy Policy
1. Who we are
Sapthan Pay is an app for people in Europe. It brings your European bank accounts together in one place and lets you pay by SEPA, with every payment approved at your own bank.
The app is operated by Sapthan AI and IT Solutions Private Limited ("Sapthan Pay", "we", "us").
Registered office: H.No. 5-3-28/244, Plot-244, Sai Nagar Colony, Boduppal, Ghatkesar, Hyderabad, Telangana 500092, India
Company number (CIN): U62099TS2026PTC219322
Under the EU General Data Protection Regulation (GDPR), and the UK GDPR where it applies, we are the data controller for the personal data described here.
Contact: business@sapthan.com
1.1 Our representative in the EU
Because we are established outside the European Economic Area and offer the service to people inside it, we appoint a representative under Article 27 GDPR. You may contact them instead of us on any matter relating to your data.
EU representative: to be appointed before the live service opens
2. What we collect, and why
2.1 Information you give us
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Name | Your account identity, shown on statements | Contract |
| Email address | Signing in, verification codes, account recovery, service emails | Contract |
| Google account name, email and profile picture, if you sign in with Google | Signing in | Contract |
| Home country and country of residence | Showing the banks and services available to you | Contract |
| Payees you pay: name, IBAN, reference, amount | Making the SEPA payments you ask for, and saving payees you choose to keep | Contract |
| Bills, loan references and budgets you add | Reminders, bill tracking and spending insights you asked for | Contract |
| Mobile numbers you top up | Delivering the top-up you asked for | Contract |
| Messages you send us | Answering you | Contract / legitimate interests |
2.2 Information from your bank
Only after you authorise it on your own bank's page, and only for the accounts you choose: the bank name, account holder name, IBAN or masked account number, balance and transaction history. We use it to show you your money in one place, sort your spending into categories, find recurring bills and subscriptions, and produce statements you download.
Bank connections are made through Salt Edge, a provider regulated in the EU to access account information and initiate payments. You authorise each bank on that bank's own page, opened in your phone's browser rather than inside our app. We never receive your banking password, PIN or one-time code, and we never store them.
You may withdraw a bank authorisation at any time — in the app (remove the bank), and with your bank. Authorisations also expire under the rules of the European open-banking framework (PSD2), usually after 180 days, and you can renew them.
2.3 Information collected automatically
| Data | Why | Legal basis |
|---|---|---|
| A pseudonymous account identifier | Linking your data to your account | Contract |
| An app-scoped device identifier | Keeping your account active on one phone at a time, so a stolen password alone cannot be used from another phone | Legitimate interests (security) |
| App and device integrity signals (Google Play Integrity, Firebase App Check) | Checking that requests come from the genuine app on an unmodified device before money can move | Legitimate interests (fraud prevention) |
| Push notification token | Payment results, bill reminders and security alerts | Contract |
| App version, screens used, feature usage, crash reports | Fixing faults and understanding which features are used | Legitimate interests |
Our app analytics are designed to exclude personal data. We record event names and safe details — which screen, which feature, success or failure, the currency — and never your email, phone number, IBAN, balance or payment amounts. Crash reports may incidentally contain technical information about the state of the app when it failed.
2.4 Phone permissions
| Permission | What it is used for |
|---|---|
| Camera (optional) | Scanning the payment QR code on an invoice, so the payee, IBAN, amount and reference fill in for you. Images are read on your phone and not uploaded. |
| Contacts (optional) | Showing the saved name for a single number you are topping up. Looked up one number at a time; we never copy, store or upload your address book. |
| Notifications (optional) | Payment results, bill reminders and security alerts. |
Each permission is optional and can be withdrawn in your phone's settings at any time.
3. Notifications and marketing
Service messages — a payment result, a bill falling due, a verification code, a security alert — are part of the service. You can turn push notifications off in your phone's settings.
We will not send you marketing without your consent. If you join the waitlist on our website, we use your email only to tell you when Sapthan Pay opens; you can ask us to remove it at any time.
4. Fraud and legal screening
We monitor accounts and activity for fraud and misuse, and apply payment limits. This is our legitimate interest in protecting you and us, and a legal obligation where the law requires it (GDPR Art. 6(1)(c) and 6(1)(f)). It may cause a payment to be refused or an account to be restricted. Where we are allowed to tell you why, we will.
We do not make decisions about you that have legal or similarly significant effects based solely on automated processing.
5. Who we share it with
We do not sell your personal data, and we do not use it for advertising.
We share it only with providers who process it on our instructions. These are the providers we use in pre-release testing; the list for the live service is confirmed before it opens:
- Google (Firebase and Google Cloud) — sign-in, database, servers, notifications, app analytics, crash reports and app integrity checks.
- Salt Edge — connecting your banks, fetching account data and initiating the SEPA payments you approve.
- Reloadly — delivering mobile top-ups you request.
- Our email provider — sending verification codes and service emails.
- Vercel and Formspree — hosting this website and receiving waitlist sign-ups.
Each provider is bound by a data processing agreement and may use your data only to provide its service to us. The list is kept at sapthanpay.com/subprocessors, and we update it before a new provider starts processing your data.
We may also disclose data where the law requires it — for example a court order or a request from a regulator or law enforcement that we are obliged to answer.
6. Where your data is processed
Your data is stored and processed on Google Cloud in the European Union: the database in Google's multi-region Europe location and the servers in Belgium. For a short transition period one copy of a single service that receives payment-status messages from Salt Edge still also runs in Google's Mumbai, India region; it will be removed. Our company is established outside the EEA, and some providers also process data in other countries. Where personal data is accessed from or transferred to a country without an EU adequacy decision, transfers of personal data from the EEA and UK are made under the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum), with the technical protections in section 8. You can ask for a copy of these safeguards at business@sapthan.com.
7. How long we keep it
| Data | How long |
|---|---|
| Account and profile data | While your account is open; erased within 30 days of closing it or a valid erasure request, subject to the next row |
| Records of completed payments | For the period financial record-keeping and anti-money-laundering law requires, then deleted. When you delete your account, the payee's name and IBAN and your account details are removed from these records; the amount, currency, date and status remain. |
| Bank authorisation records | For the life of the authorisation, plus any period the open-banking rules require |
| Short-lived security records (verification attempts, rate limits, bank-link sessions) | Between minutes and 7 days, deleted automatically |
| Emails we send you (including one-time codes), while waiting to be delivered | 7 days, deleted automatically |
| Security event log (sign-ins, refused requests, security alerts) — no bank credentials, no full IBANs | 13 months, deleted automatically; kept for fraud and incident investigation |
| Security alert counters | 90 days, deleted automatically |
| App analytics and crash reports | Up to 14 months |
| Website analytics (only if you accept) | Up to 14 months |
| Waitlist email | Until we launch and tell you, or until you ask us to remove it |
| Push notification tokens | Removed when you sign out or uninstall |
8. How we protect it
- We never receive your bank credentials — see section 2.2. Every payment is confirmed with your bank's own strong customer authentication.
- Data on your phone is encrypted using your phone's own security hardware, and data is encrypted in transit.
- The app blocks screenshots and screen recording, and keeps your balance out of the recent-apps preview, on devices behaving normally.
- App lock uses your phone's fingerprint, face, pattern or PIN, and re-locks after a short time in the background.
- Your account is active on one phone at a time; signing in on another signs the old one out.
- Access is scoped so one user cannot reach another user's data, and payment limits cannot be changed from a phone.
No security measure is absolute, and we do not claim otherwise. We review these protections and strengthen them over time.
9. Your rights
Under the GDPR you may access your data, have it corrected or erased, restrict or object to processing, receive it in a portable format, and withdraw consent where consent is what we rely on.
You can delete your account from the Profile screen in the app. For a copy of your data, or any other request, email business@sapthan.com. We respond within one month, extendable where the law allows, and we tell you if we need more time.
What deletion means. We erase your identity and profile data and disconnect your banks. Records of completed payments that the law requires us to keep are retained, restricted and used only for that purpose, then deleted when the period ends.
Complaints. You can complain to the data protection authority in the EU country where you live or work, or, in the UK, to the Information Commissioner's Office. We would appreciate the chance to put things right first.
10. Cookies on this website
The app does not use cookies. This website uses no cookies unless you choose to allow analytics.
If you click Accept on the cookie banner, we load Google Analytics to count visits and see which pages are useful. It sets cookies (_ga, _ga_*) for up to 14 months. If you click Reject, or ignore the banner, Google Analytics is not loaded at all. Your choice is remembered in your browser, and you can change it any time with Cookie settings at the bottom of each page.
11. Children
Sapthan Pay is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has given us data, contact business@sapthan.com and we will delete it.
12. Accessibility
We aim to meet WCAG 2.1 level AA in the app and on this website. If anything is hard to use, tell us at business@sapthan.com.
13. Changes
We post changes on this page and update the version and date above. Material changes are notified in the app before they take effect.
14. Contact
Sapthan AI and IT Solutions Private Limited
H.No. 5-3-28/244, Plot-244, Sai Nagar Colony, Boduppal, Ghatkesar, Hyderabad, Telangana 500092, India
business@sapthan.com · sapthan.com