Privacy policy

01. Who we are

LeganPay is a payment-link service operated by Greatminds Fintech Private Limited (CIN U62099MH2024PTC430717), a company registered in India. This policy explains what personal data we collect when you use LeganPay, why we collect it, and the choices you have.

It applies to merchants who hold a LeganPay account, customers who pay through a LeganPay link, and anyone who visits our website or contacts us. We process personal data in line with the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and the rules made under them.

02. Information we collect

We only collect what we need to run the service:

• Merchant account details: your name, email address, mobile number, business details and the bank account you settle to.
• Payment link details: the amount, the reason for payment, and the customer mobile number and email address you enter when creating a link.
• Payment details: transaction reference, payment mode, status and timestamps returned by our payment gateway. We never see or store your full card number, CVV, UPI PIN or net-banking password.
• Messages you send us: your name, email, phone number and message when you use the contact form or email support.
• Technical data: IP address, browser type and device information, collected automatically for security and fraud prevention.

03. How we use your information

• To create and deliver payment links by SMS, email or WhatsApp, and to show payment status to the merchant.
• To process payments through our gateway partner and settle funds to the merchant's registered bank account.
• To send service notifications, such as payment confirmations and account alerts.
• To answer support requests and messages sent through our contact form.
• To detect and prevent fraud, abuse and unauthorised access.
• To meet our legal, regulatory, tax and audit obligations.

We do not sell your personal data, and we do not use it for third-party advertising.

04. Payments and card data

Payments on LeganPay are processed by Easebuzz, an RBI-authorised payment aggregator with a PCI-DSS compliant platform. Card, UPI and net-banking credentials are entered on, and handled by, the gateway and your bank.

LeganPay receives only the information needed to confirm the payment, such as the transaction ID, amount, payment mode and status. How the gateway handles your data is also governed by its own privacy policy.

05. When we share information

We share personal data only when it is needed to provide the service or required by law:

• Payment gateway, banks and card networks, to process and settle payments.
• SMS, email and messaging providers, to deliver payment links and notifications.
• Hosting and infrastructure providers that store data on our behalf under confidentiality obligations.
• Legan group platforms, when you choose to sign in to LeganPay through your Legan account.
• Government, regulatory or law-enforcement authorities, when required by law or a valid legal request.

06. Cookies

LeganPay uses only essential cookies: a session cookie that keeps you signed in and a security cookie that protects forms against cross-site request forgery. The site does not work correctly without them.

We do not use advertising or third-party tracking cookies. You can clear or block cookies in your browser settings, but you may then be unable to sign in.

07. How long we keep data

We keep account data for as long as your account is active. Transaction records are kept for the period required by applicable law, including RBI, anti-money-laundering and tax record-keeping requirements, even after an account is closed.

Contact-form messages are kept for as long as needed to resolve your request. When data is no longer needed, we delete or anonymise it.

08. How we protect your data

• All traffic to LeganPay is encrypted with TLS (HTTPS).
• Passwords are stored as one-way hashes and are never visible to our staff.
• Access to personal data is limited to staff who need it for their role.
• Payment callbacks from the gateway are verified with a cryptographic signature before they are accepted.

No system is completely secure. If a breach affects your personal data, we will notify you and the relevant authorities as required by law.

09. Your rights

Under the Digital Personal Data Protection Act, 2023 you can:

• Ask for a summary of the personal data we hold about you and how it is used.
• Ask us to correct, complete or update inaccurate data.
• Ask us to delete your data, subject to our legal record-keeping obligations.
• Withdraw consent you have given, for the future.
• Nominate another person to exercise these rights if you are unable to.
• Raise a grievance with us, and escalate it to the Data Protection Board of India if it is not resolved.

To use any of these rights, email support@leganpay.com. We may ask you to verify your identity first.

10. Children

LeganPay accounts are for businesses and adults aged 18 or over. We do not knowingly collect personal data from children. If you believe a child has given us their data, please contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. The date at the top of this page shows when it last changed. If we make significant changes, we will let merchants know by email or through the dashboard.