1. Who we are
For merchant and account data we decide how the data is used. For data about a merchant’s customers, we process it to provide the payment service to that merchant.
2. Data we collect
Account holders
- Username, email address, and a hashed password. We never store your password in readable form.
- Email verification records: when a code was sent and how many attempts were made. Only a keyed hash of the code is stored.
Merchant applicants
- Business details: name, type, category, website, description, address, registration and tax numbers.
- Applicant details: name, guardian name, date of birth, mobile number, address, identity document type, number, and expiry.
- Documents you upload, such as CNIC, passport or licence images, a selfie, a signature, proof of address, and business registration.
- Settlement details: JazzCash and Easypaisa numbers, IBAN, and USDT (BEP20) address.
Customers paying a merchant
- For wallet payments: email address and mobile number, which the payment provider needs to process the payment.
- For QR payments: email address.
- For USDT payments: the sending blockchain address and transaction hash, which are public on the blockchain.
- Payment amount, status, merchant reference, and timestamps.
Technical data
- IP address and browser information in security logs, rate-limit records, and audit events.
- Session cookies (see section 5).
3. How we use it
- To create and secure accounts, including sending verification codes and security notices.
- To review merchant applications, verify identity, and meet our provider’s and legal know-your-customer requirements.
- To process payments, keep the merchant ledger, settle funds, and send withdrawals.
- To send account notices: application decisions, payment and withdrawal updates, API key and webhook changes.
- To prevent fraud and abuse and to investigate security incidents.
- To comply with legal obligations and lawful requests.
We do not sell personal data and we do not use it for third-party advertising.
4. Who we share it with
- Our payment service provider receives the payment and payout details needed to process PKR wallet and QR payments and payouts.
- The merchant a customer pays sees that customer’s payment record in their dashboard.
- Hosting and email providers that run GetPay’s servers and deliver our emails, only to provide those services.
- Authorities when the law requires it or to protect against fraud.
USDT transactions are recorded on a public blockchain by design. GetPay cannot remove them.
5. Cookies
GetPay uses only the cookies needed to run the site: a session cookie that keeps you signed in, and a security token that protects forms against cross-site request forgery. We do not use advertising or analytics cookies. Blocking these cookies will prevent you from signing in.
6. Security
Identity documents are stored on private storage that is not reachable from the website, and only authorised staff can open them; every staff view is logged. Passwords, verification codes, and API secrets are stored as hashes. Connections use HTTPS. No system is perfectly secure, so please protect your own credentials too.
7. How long we keep it
We keep account and merchant data while your account is open. Payment, ledger, and audit records are kept after an account closes for as long as financial record-keeping, fraud prevention, and legal obligations require. Verification codes expire after ten minutes.
8. Your choices
You can see and update your account details in your account. To request a copy of your data, a correction, or deletion of data we are not required to keep, email [email protected]. We may need to verify your identity first. Customers of a merchant should contact that merchant about their orders.
9. Contact
Privacy questions: [email protected].