What we collect
We collect personal data in the categories below. The exact data points depend on your role (visitor, merchant, partner or end-customer of a merchant) and the services you use.
Contact data. Name, email address, phone number, company name and designation.
KYC and KYB data. Identity documents (PAN, Aadhaar reference, passport, driving licence), business registration documents (certificate of incorporation, GST registration, beneficial ownership declarations), bank account details.
Transaction data. Payout requests, beneficiary details, wallet balances, ledger entries, reconciliation records.
Technical data. IP address, device identifiers, browser type, operating system, log timestamps.
Usage data. Pages visited, features used, API call volumes, sandbox usage patterns.
Communications data. Content of messages you send us, support tickets, call records where permitted.
We collect data directly from you during onboarding and use, from your use of the Platform (automatically, via logs and cookies), and in some cases from third parties such as KYC bureaus and sanctions databases.
Why we collect it
We process personal data because we need it to run the Platform and because the law requires it. We do not collect data speculatively or for purposes unrelated to the Services.
To onboard you, verify your identity and create your account.
To process payouts and reconcile transactions.
To comply with PMLA 2002, RBI guidelines, sanctions screening obligations and tax reporting requirements.
To detect and prevent fraud, money laundering and other prohibited activity.
To operate, secure and improve the Platform through monitoring, audit logging and aggregated analytics.
To send you service notifications, security alerts, and contract or policy updates.
To send you marketing communications where you have given us consent to do so.
Legal basis
Depending on the data and purpose, we rely on one or more of the following grounds under the Digital Personal Data Protection Act 2023 ("DPDP Act") and applicable Indian law.
Performance of a contract. Processing necessary to enter into or perform an agreement with you.
Legal obligation. Processing required to comply with PMLA 2002, RBI directions, tax law and other applicable statutes.
Consent. Processing where you have provided clear, informed and revocable consent, in particular for marketing communications and certain cookies.
Legitimate use. Processing for purposes that are permitted under the DPDP Act where they are reasonable, proportionate and not overridden by your privacy interests.
How we use data
We use personal data only for the purposes described at the time of collection. We do not use your data to build profiles for advertising to third parties and we do not sell personal data under any circumstances.
Where we use data for product analytics and improvement, we use aggregated or anonymised data wherever possible. Where individual-level data is used, it is subject to access controls and logged access.
Data sharing and processors
We share personal data only as described in this Policy. We do not sell personal data.
Banking partners and regulated entities. To the extent necessary to provide the Services and comply with applicable law.
Service providers. Including hosting, KYC verification, sanctions screening, customer support and analytics providers. All are bound by written confidentiality and data protection obligations.
Regulatory and law-enforcement authorities. Where required under applicable law, including reporting obligations under PMLA 2002.
Professional advisers. Auditors, legal and accounting advisers operating under confidentiality obligations.
Corporate transactions. In connection with a merger, acquisition or financing, under appropriate confidentiality protections and subject to the acquirer honouring this Policy.
Where we transfer personal data outside India, we do so in accordance with the DPDP Act and applicable transfer rules, and we put contractual safeguards in place at the destination.
Data retention
We keep personal data only as long as necessary for the purpose it was collected, or as required by applicable law, whichever is longer.
KYC and transaction records. Retained for the minimum period required under PMLA 2002, currently five years after the end of the business relationship or the date of the transaction, whichever is later.
Marketing data. Retained until you withdraw consent or for the period necessary to fulfil the marketing purpose.
Support and operational logs. Retained for the period necessary for security, audit and dispute resolution.
On expiry of the applicable retention period, data is deleted or irreversibly anonymised.
Security
We use administrative, technical and physical safeguards to protect personal data. These include encryption in transit and at rest, role-based access control, IP whitelisting, two-factor authentication on admin systems, and detailed audit logging. We review our security posture regularly and against recognised standards.
No system is completely secure. If you believe your account has been compromised, notify us immediately at
compliance@milanj.money.
Your rights
Subject to applicable law, you have the following rights regarding your personal data.
Access. The right to know what personal data we hold about you.
Correction. The right to have inaccurate or incomplete personal data corrected.
Erasure. The right to request deletion of personal data where retention is no longer required by applicable law or by the purposes described in this Policy.
Withdrawal of consent. The right to withdraw consent at any time for processing where consent was the legal ground. Withdrawal does not affect the lawfulness of prior processing.
Nomination. Under the DPDP Act, the right to nominate another individual to exercise these rights in the event of your death or incapacity.
Complaint. The right to make a complaint to the Data Protection Board of India or other competent authority.
To exercise any of these rights, email compliance@milanj.money. We will respond within the timelines required under the DPDP Act.
Cookies
Our website uses cookies and similar technologies for essential operation, analytics and, with your consent, marketing. Essential cookies cannot be switched off as the site will not function without them. Analytics and marketing cookies are set only where you have consented.
You can manage cookies at any time through your browser settings. Disabling non-essential cookies does not affect your ability to use the Platform, though some features of the marketing website may work less well.
Changes to this policy
We may update this Policy from time to time to reflect changes in our practices, technology or applicable law. Material changes will be notified at least thirty (30) days in advance through email and a notice on the Platform. The "Effective date" at the top of this page reflects the date of the most recent revision.
We encourage you to review this Policy periodically. Continued use of the Platform after the effective date of any revised Policy constitutes acceptance of the changes.
Questions about this Policy?
Email compliance@milanj.money. For grievances, see the Grievance Redressal page.