Privacy Policy

PayTone — UPI Payment Voice Announcements Android packages: com.paytone.app (PayTone, on Google Play) and com.paytone.app.direct (PayTone Direct, downloaded from our website)

Last updated: 29 October 2026 Effective from: 29 October 2026 Version: 1.2

1. Introduction

This Privacy Policy explains how Lightday Technologies LLP ("we", "us", "our") collects, uses, shares, stores and protects personal data when you use the PayTone mobile application and its backend services (the "Service").

We are the Data Fiduciary for this data under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), and the "body corporate" under the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules").

Please read this together with our Terms of Use.

In one line: we collect the minimum needed to detect a payment on your phone and speak it aloud on your devices — your mobile number, your shop details, your device details, and the payment fields (amount, payer name/masked identifier, reference number, time) taken from payment notifications and bank SMS. We never see your bank login, card number, UPI PIN, CVV, password or OTP, and we never move your money.

2. Summary of what we collect

What we do NOT collect

We do not collect, and the application does not ask for:

• your bank account login, internet-banking credentials, UPI PIN, MPIN, card number, CVV, expiry date, or any password;
• your contacts, call log, photo library, files, microphone audio, or browsing history;
• your personal (non-payment) notifications or personal SMS — see clause 4;
• precise, continuous or background location tracking;
• biometric data, health data, or data about children;
• data used for advertising, ad profiling, or sale to data brokers.

We do not sell your personal data. We do not share it with data brokers. We do not use it for advertising.

3. How we collect data

• You give it to us — when you register, verify your number by OTP, enter shop details, scan your UPI QR, name a device, approve a pairing request, or contact support.
• Your device produces it — device model, OS version, app version, language, and the device identifier we generate on first run.
• From notifications and SMS on your device, only after you grant the relevant access, and only from payment and banking sources — see clause 4.
• Automatically from your use of the Service — API request logs, IP address, timestamps, error and security events.

We do not buy personal data from third parties, and we do not receive your data from your bank or from any UPI application.

4. Notification access and SMS access — read this carefully

These are the two most sensitive permissions the Service uses. Both are optional, both are requested only after an on-screen explanation of what they do, and both can be withdrawn at any time in Android Settings.

4.1 Notification access (NotificationListenerService)

• What it does: when you enable it in Settings → Apps → Special access → Notification access, Android delivers to the Service a copy of notifications posted on the device.
• What we actually look at: only notifications from the specific payment and banking applications enumerated in the app (for example PhonePe, Google Pay, Paytm, BHIM and the banking apps listed in the app's package list). In addition, if you have pinned a "trusted provider" by scanning your own UPI QR, we further restrict processing to that provider's packages.
• What happens to everything else: notifications from any other application are ignored and discarded on the device. They are never read into our records and never leave your phone.
• What is extracted: the notification title and text of a matching notification are parsed on your device against payment patterns to pull out the amount, payer name or masked identifier, and reference number.
• What is sent to our servers: the extracted payment fields, the source package name, and a copy of the original matched message text, which is encrypted (AES-GCM) before storage and retained for audit and dispute replay only.
• What it is never used for: advertising, profiling, analytics on your personal messages, or any purpose other than detecting and announcing a payment and letting you review your own history.

4.2 SMS access (RECEIVE_SMS, READ_SMS) — direct-download version only

The version of PayTone distributed on Google Play (com.paytone.app) does not request or use SMS permissions. This clause applies only to PayTone Direct (com.paytone.app.direct), the version downloaded directly from our website, which you install yourself.

• Why it exists: notification access alone is not dependable on Indian retail hardware — manufacturer battery managers unbind the listener, users mute a bank app's notification channel, and a reboot can leave the binding dead. The bank's transaction SMS still arrives. SMS is therefore an independent second source so a payment is not missed.
• What we actually read: messages are filtered by bank/financial sender ID and by transaction-message patterns. Only messages matching a bank credit pattern are processed. READ_SMS is used only to backfill the small number of messages that arrived while the permission was off or the device was rebooting.
• What we do not do: we do not read your personal SMS conversations, do not upload your SMS inbox, do not transmit non-matching messages anywhere, and do not use SMS content for any purpose other than payment detection.
• If you refuse or revoke it: SMS ingestion disables itself and notification-based detection continues on its own. Nothing else in the Service depends on it.

4.3 Compliance statement

Our use of notification access and SMS access complies with the Google Play Permissions policy and the Play User Data policy. Access is limited to what is necessary for the core, user-facing payment-announcement feature that is prominently described in the listing; the data is not sold, not shared for advertising, and not transferred to third parties other than the service providers listed in clause 7.

5. Other permissions and why we need them

Withdrawing any optional permission reduces functionality but does not disable your account, and does not affect the lawfulness of processing carried out before withdrawal.

6. How we use your data

We use personal data only for these purposes:

1. To create and secure your account — verify your mobile number by OTP, issue and refresh session tokens, and authenticate your requests.
2. To deliver the core service — detect a credit, generate the announcement text in the language each device is set to, synthesise speech, and deliver the announcement to your linked devices in real time.
3. To let you review payments — payment history, search by reference, daily/periodic reports, and export.
4. To manage your devices — pairing, approval, naming, blocking and removal, and to show you where and when a device was registered.
5. To keep the Service safe — deduplicate events, detect spoofed or forged notifications, rate-limit, detect abuse, and investigate incidents.
6. To support you — respond to your queries and troubleshoot faults, including inspecting parse failures.
7. To improve the Service — fix parsing errors and improve reliability, using aggregated or de-identified data wherever possible.
8. To comply with law — meet retention, tax, audit, and lawful-request obligations, and to establish, exercise or defend legal claims.

We do not use your data for advertising, ad targeting, credit scoring, or sale to any third party, and we do not carry out automated decision-making that produces legal effects on you.

7. Who we share data with

We do not sell or rent personal data. We share it only as follows.

7.1 Service providers (processors) acting on our instructions

Google processes Google Play purchases under its own terms and privacy policy, and we receive only the purchase status, never your payment details. Razorpay processes card, UPI and bank details you enter at checkout under its own privacy policy; we never receive your full card number, CVV or UPI PIN.

Each provider is bound by contract to process data only on our instructions, to keep it confidential, and to apply appropriate security.

7.2 Within your own shop

Payment announcements and history are visible to every device you have approved and linked to your shop. You control which devices those are, and you can remove them at any time. See clause 4 of the Terms.

7.3 Legal and protective disclosures

We may disclose data where we are required or permitted to, in good faith:

• to comply with applicable law, a court order, or a lawful request from a government, regulatory or law-enforcement authority;
• to enforce our Terms, or to investigate suspected fraud, security incidents or abuse;
• to protect the rights, property or safety of us, our users or the public.

7.4 Business transfers

If we are involved in a merger, acquisition, reorganisation or sale of assets, data may be transferred to the successor entity, subject to this Policy. We will notify you in the application before your data becomes subject to a different policy.

8. Where your data is stored and transferred

8.1 Our servers, database and object storage are hosted by Amazon Web Services in its Mumbai region (ap-south-1), and payment-transaction records are stored in India. Announcement audio is generated by Google Cloud Text-to-Speech in its Mumbai region (asia-south1).

8.2 A few providers listed in clause 7.1 may process a limited part of the data outside India: the Android geocoder (device coordinates at registration), Google Play services (Play Integrity verdicts and ML Kit model downloads), Google Play billing (subscriptions bought in the Google Play version), Wikimedia (your IP address when a logo is fetched) and, for their own processing, Razorpay and the SMS gateway. Where a transfer outside India occurs, it is made subject to contractual safeguards and only to countries not restricted under section 16 of the DPDP Act.

9. How long we keep data

When a retention period ends, data is deleted or irreversibly anonymised.

Why these periods, and not longer. We are not a bank, a payment aggregator or a prepaid-instrument issuer, and the ten-year retention that applies to those regulated entities does not apply to us — see clause 3 of the Terms of Use. PayTone reads payment notifications your bank has already sent you and reads them aloud; it does not hold, move or settle money. The periods above are therefore set by our own needs — answering a disputed payment, and keeping tax records — and not by a regulator's instruction. Section 8(7) of the DPDP Act requires us to erase personal data once the purpose it was collected for is served, which is why the raw bank message is erased at ninety days rather than kept for the life of the transaction record.

10. Your rights

Under the DPDP Act and the SPDI Rules you have the right to:

• Access — obtain a summary of the personal data we process about you, and the identities of those with whom we have shared it.
• Correction and completion — have inaccurate or incomplete data corrected, completed or updated. Most fields are editable in the app.
• Erasure — have your personal data deleted, subject to the retention obligations in clause 9.
• Withdraw consent — at any time, as easily as you gave it, by revoking a permission in Android Settings or by deleting your account. Withdrawal does not affect processing already carried out lawfully.
• Nominate — nominate another individual to exercise your rights in the event of your death or incapacity.
• Grievance redressal — complain to us first (clause 13), and, if unsatisfied, to the Data Protection Board of India.

How to exercise them: use the in-app controls, or write to hello@lightday.tech, quoting your registered mobile number. We will respond within thirty (30) days. We may need to verify your identity before acting, and may decline a request where the law permits or requires us to.

11. Deleting your account and data

You can delete your account and associated data at any time:

• In the app: Settings → Account → Delete account
• On the web: https://paytone.lightday.tech/delete-account
• By email: hello@lightday.tech from your registered number

What is deleted: your account, shop profile, owner name and address, mobile number, UPI account entries, device and pairing records, voice settings, and session data — within 30 days of your request.

What is retained, and why: payment-transaction records are retained for the period in clause 9 to meet financial record-keeping obligations and to resolve disputes. These are retained in a restricted form and are not used for any other purpose. Aggregated or de-identified data that cannot be linked back to you may be retained indefinitely.

12. Security

We apply reasonable security practices and procedures consistent with the SPDI Rules and the DPDP Act, including:

• TLS/HTTPS for all traffic between the application and our servers;
• AES-GCM encryption at rest for stored raw notification and SMS payloads. Credit-like alerts our parser could not read are stored as plain text for up to 90 days so we can fix the parser, then erased;
• Session tokens encrypted with the device's OS keystore (Android Keystore). A copy is also kept in app-private storage so the background payment listener can reach it; app backup is disabled, so it is not copied off the device;
• On-device filtering, so non-payment notification and SMS content never leaves your phone;
• OTP-based authentication with short-lived challenges and rate limiting;
• Role-based access control and an audit log of administrative access;
• Restricted access to production data on a need-to-know basis.

No system is completely secure. We cannot guarantee absolute security, and you are responsible for keeping your device and mobile number secure. If a personal-data breach occurs, we will notify the Data Protection Board of India and affected users as required by the DPDP Act and by CERT-In directions.

13. Grievance Officer and Data Protection contact

If you have any question, concern or complaint about this Policy or about how we handle your data, contact:

Grievance Officer / Data Protection Contact Name: Rimju Kunhi Veetil Address: Lightday Technologies LLP, 29/67A, Ground Floor, Kannala Building, Trikkakkara Pipeline Road, University Road, Kalamassery, Ernakulam, Kerala 682022, India Email: hello@lightday.tech (subject line: "Grievance") Working hours: Monday to Saturday, 10:00–18:00 IST, excluding public holidays

We will acknowledge within twenty-four (24) hours and endeavour to resolve within fifteen (15) days.

If you are not satisfied with our response, you may complain to the Data Protection Board of India under the DPDP Act.

14. Children

The Service is intended solely for businesses and for persons aged 18 or above. We do not knowingly collect personal data of children. If we learn we have collected data of a child, we will delete it. If you believe a child has provided us data, contact us at hello@lightday.tech.

15. Third-party trademarks

Names and marks of banks, UPI applications and payment providers referred to in the Service belong to their respective owners. They appear only to identify the source of a notification or to help you configure the Service. We are not affiliated with, endorsed by, or sponsored by any of them, or by NPCI or the Reserve Bank of India.

16. Changes to this Policy

We may update this Policy from time to time. The current version is always available in the application and at https://paytone.lightday.tech/privacy, with the "Last updated" date at the top. For material changes we will give notice in the application, and where the change requires it, seek your fresh consent. Continued use after the effective date means you accept the updated Policy.

17. Contact

Lightday Technologies LLP GSTIN: 32AAHFL3394B1ZM 29/67A, Ground Floor, Kannala Building, Trikkakkara Pipeline Road, University Road, Kalamassery, Ernakulam, Kerala 682022, India Email: hello@lightday.tech Website: https://paytone.lightday.tech