Privacy policy

What Payme collects, itemised

• Account details — your name, email address and, if you sign in with Google, the basic profile Google returns.
• Device details — device model, OS and app version, and a device identifier used to authorise uploads from your phone.
• Financial SMS content — the text of bank and UPI transaction messages only. Messages that are not financial (including OTPs, personal messages and promotional texts) are filtered on your device and are never uploaded.
• Declared identifiers — the UPI IDs, bank account and card last-4s and wallets you add so transactions are attributed correctly.
• Subscription data — plan status. Payments are processed by Google Play; Payme never sees your card details.

Why we process it

Solely to provide the service you asked for: extracting transactions from your financial messages, attributing them to your accounts, detecting transfers between your own accounts, and showing you the resulting dashboard. We do not use your data for advertising, and we do not sell it.

AI processing and transfers outside India

Most messages are parsed by deterministic rules on our servers without any AI model. Messages that cannot be resolved that way are sent to a third-party AI provider (OpenCode Go) hosted outside India for extraction. Only the transaction-relevant text and your declared identifiers are sent; the provider operates under zero-retention, no-training terms, and account numbers are masked before sending. Our subprocessor list is available on request.

Retention

• Raw message text is encrypted at rest and deleted after 90 days. A redacted preview remains so your transaction history stays intelligible.
• Extracted transactions stay until you delete them or your account.
• Security and access logs are kept for one year, as required by law.

Your rights

You can access, correct, export or erase your data, withdraw consent at any time, and nominate someone to exercise your rights. In-app: Settings → Privacy centre. By email: support@payme.ind.in. We respond within 90 days, and usually much sooner. If you are not satisfied, you may complain to the Data Protection Board of India.

Security

Transport encryption everywhere; field-level AES-256-GCM encryption for message bodies and identifiers; least-privilege access with audit logging for every operator action. If a breach affecting you occurs, we notify you without delay and the Board within 72 hours.

Contact

Grievance officer: support@payme.ind.in. Postal address available on request.