Introduction
UtillPay Technologies Private Limited ("UtillPay", "we", "our", "us") operates the utillpay.com website, the UtillPay mobile application and all related services (collectively, the "Platform"). We provide mobile & DTH recharges, BBPS bill payments, credit card bill settlement, travel bookings, and an affiliate earnings program.
This Privacy Policy explains what personal information we collect from you when you use the Platform, how we use it, whom we share it with, and the rights you have over your data. By using the Platform you agree to the practices described here.
Information we collect
Information you provide
- Identity data: Full name, date of birth, gender, PAN, Aadhaar reference number and photograph (for KYC where required).
- Contact data: Mobile number, email address, postal address.
- Financial data: Bank account number, IFSC, UPI VPA, card details (tokenised — we never store your full card number or CVV).
- Transaction data: Recharges, bill payments, credit card payments, travel bookings, affiliate commissions.
- Affiliate data: Your referral link, network structure, downline transactions, payout history.
Information we collect automatically
- Device data: Device model, operating system, unique device identifiers, mobile network information, IP address.
- Usage data: Pages visited, features used, timestamps, referring URLs, crash logs.
- Location data: Approximate location (derived from IP) and, with your consent, precise GPS location for fraud prevention and personalisation.
Information from third parties
- KYC verification agencies (Aadhaar, PAN, bank account validation).
- Payment gateways, banks and NPCI for transaction settlement.
- Credit bureaus (only when you opt in to credit-related services).
- Fraud & risk-scoring partners.
How we use your information
- To create and manage your account and complete KYC obligations.
- To process recharges, bill payments, credit card bill settlements and travel bookings.
- To calculate, track and pay out your affiliate/ambassador commissions.
- To send transaction receipts, OTPs, reminders and service updates.
- To detect, prevent and investigate fraud, abuse and security incidents.
- To provide customer support and respond to your queries.
- To personalise offers, cashback and marketing communications (which you can opt out of).
- To comply with legal, regulatory and audit requirements including RBI, NPCI, BBPS and taxation authorities.
Data retention
We retain your data for as long as your account is active, plus a period afterwards to satisfy legal, regulatory and dispute-resolution obligations — typically eight (8) years for KYC and transaction records under the Prevention of Money-Laundering Act, 2002 and RBI directions. Marketing preferences, device analytics and non-financial logs are retained for shorter, defined periods and then anonymised or deleted.
Security measures
We take security seriously. Our practices include:
- 256-bit TLS encryption for all data in transit.
- AES-256 encryption for sensitive data at rest.
- PCI-DSS compliant infrastructure for card handling and tokenisation.
- ISO 27001 certified information-security management system.
- Multi-factor authentication, biometric login and device binding.
- Real-time fraud monitoring and anomaly detection.
- Regular VAPT (vulnerability assessments & penetration testing) by CERT-In empanelled auditors.
No system is 100% secure. If you believe your account has been compromised, contact us immediately at security@utillpay.com.
Your rights
Under the Digital Personal Data Protection Act, 2023, and applicable RBI guidelines, you have the right to:
- Access the personal data we hold about you.
- Correct inaccurate or incomplete data.
- Erase your data, subject to legal retention requirements.
- Withdraw consent for processing where consent is the basis.
- Opt out of marketing communications at any time.
- Nominate a person to exercise your rights in case of death or incapacity.
- File a grievance with our Grievance Officer (see section 11).
You can exercise these rights from the app (Settings → Privacy) or by emailing privacy@utillpay.com. We respond within 30 days.
Children's privacy
The Platform is not directed at children below 18 years of age. We do not knowingly collect data from minors. If you believe a minor has provided us with personal information, please contact us and we will delete it.
Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be notified to you via email or in-app notice at least 30 days before they take effect. The "Last updated" date at the top of this page will always reflect the current version. Continued use of the Platform after changes constitutes acceptance.
Grievance & contact
If you have questions, requests or concerns about this Privacy Policy or how we handle your data, please reach out to our Grievance Officer:
Email: grievance@utillpay.com
Phone: +91 90000 00000 (Mon–Sat, 10:00 – 19:00 IST)
Response SLA: acknowledgement within 24 hours, resolution within 15 days
For general privacy queries: privacy@utillpay.com. For security incidents: security@utillpay.com.