Privacy Policy for IGO Pay

1. Information We Collect

We collect personal information necessary to deliver secure, reliable, and compliant financial transaction routing and payment aggregation services. This information includes:

• Account & Identification Data: When registering, you provide your name, email address, mobile phone number, business organization name, website URL, and national identification details (where required for KYC / regulatory compliance).
• Authentication Credentials: Passwords, multi-factor authentication preferences, API keys, and security tokens used to protect your merchant dashboard.
• Financial & Settlement Information: Bank account numbers, routing branches, mobile financial services (bKash, Nagad, Rocket, Upay) merchant and wallet numbers needed to disburse settlements and verify payouts.
• Transaction & Telemetry Data: Real-time details regarding transactions routed through IGO Pay, including customer billing identifiers, payment amounts, currencies, transaction IDs, statuses, timestamps, IP addresses, browser user-agents, and webhook delivery logs.
• Device & Automated Log Data: Diagnostic telemetry, system logs, session cookies, device identifiers, operating system data, and network data captured to prevent automated fraud, rate-limit abuses, and malicious network traffic.

2. Google OAuth API & User Data Policy Compliance

IGO Pay provides users with the option to authenticate, register, or sign in using their Google accounts via Google OAuth 2.0. Our handling of Google user data adheres strictly to the Google API Services User Data Policy, including the Limited Use requirements:

• Data Requested: We only request permission to access basic profile data, specifically your verified primary email address (email) and your display name (profile).
• Purpose of Access: Google user data is requested exclusively for user authentication, account creation, and delivering identity verification. We never request access to Google Drive files, Gmail messages, Contacts, Calendars, or any other sensitive or restricted scopes.
• No Sale or Commercial Transfer: We do NOT sell Google user data to third parties, data brokers, or advertising networks. We do not use Google user data for advertising, retargeting, or credit-scoring algorithms.
• No Use for AI/ML Training: Data obtained through Google OAuth is never used to train generalized artificial intelligence (AI) or machine learning (ML) models.
• Human Access Restrictions: No human personnel are permitted to read or view Google user profile data, except when explicitly required to resolve a technical support issue requested by the user, for security audits, or to satisfy applicable law.

3. How We Use Collected Information

We process and utilize your personal and transactional information for the following legitimate purposes:

• Creating, authenticating, maintaining, and administering merchant user accounts.
• Processing online payment requests and facilitating transaction settlements via automated MFS APIs and banking channels.
• Delivering transaction status notifications, automated webhooks, receipts, and system alerts.
• Detecting, investigating, and preventing money laundering, financial fraud, illegal transactions, and unauthorized access.
• Complying with Bangladesh Bank regulations, national taxation obligations, and relevant legal reporting requirements.
• Providing customer support, resolving technical incidents, and responding to inquiries.

4. Data Sharing and Third-Party Disclosures

IGO Pay does not sell, rent, lease, or trade personal data. We disclose your data only to trusted service partners strictly under confidentiality agreements:

• Payment Processors & MFS Providers: Relevant transaction identifiers and amounts are securely routed to licensed telecom/financial operators (such as bKash, Nagad, Rocket) to execute payment authorizations.
• Cloud Infrastructure & Security Providers: We employ trusted global cloud hosting (e.g., Supabase, Vercel, Cloudflare, Resend) to securely host databases, send transactional verification emails, and block cyber attacks.
• Regulatory & Legal Authorities: If required by court order, law enforcement inquiry, or Bangladesh statutory bodies, we may disclose account details to assist lawful investigations.

5. Data Retention, Security, and Storage

We implement industry-standard encryption protocols (TLS 1.3 in transit, AES-256 at rest) to safeguard credentials, tokens, and financial records:

• Retention Period: We retain merchant account information as long as your account remains active. Transactional logs and payment records are maintained for a minimum statutory period (typically 5 to 7 years) to satisfy financial audit and AML regulatory mandates.
• Access Controls: Database access is restricted to verified systems through principle-of-least-privilege network policies, automated bot-detection walls, and rotating cryptographic credentials.

6. User Rights & Data Deletion Requests

You possess full rights regarding the personal data we maintain about you:

• You may inspect, update, or correct your personal profile information at any time within your merchant dashboard.
• Data Deletion: You may submit an official request to delete your account and personal identifiers by contacting us at support@pay.imperialtopup.com. Upon receipt, we will terminate your account and erase personal identifiers, preserving only those financial audit records required by law.
• Revoking Google Access: If you authenticated using Google, you may revoke IGO Pay's permissions at any time via your Google Account Security Settings.

7. Cookies and Tracking Technologies

We use strictly necessary functional session cookies and security tokens (such as Cloudflare Turnstile bot detection cookies) to keep you signed in securely and protect our authentication endpoints from automated credential-stuffing attacks. We do not use third-party advertising tracking cookies.

8. Contact Information & Regulatory Inquiries

If you have questions, feedback, or concerns regarding our privacy practices or wish to exercise your privacy rights, please contact our compliance officers: