Last updated: 04 Oct 2026
Vision Pay Live Private Limited ("Vision Pay", "we", "us") runs the Vision Pay website and the VisionPay Android app (together, the "Service"). This policy explains what personal data we collect, why, who we share it with, how long we keep it and what your rights are. It is written to meet the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000 and its rules, and the Prevention of Money-Laundering Act, 2002 (PMLA).
1. What we collect
Account details • Email address, and your name and profile photo if you sign in with Google. • Mobile number, confirmed with a one-time code. • Password, stored only in a scrambled (hashed) form that we cannot read.
Identity check (KYC), required by law before you can sell • Full name, date of birth, PAN, residential address. • Photos or PDFs of your PAN card and Aadhaar (front and back), and a selfie.
Payout details • Bank account number, IFSC and account holder name, or UPI ID. We pay only into accounts in your own name.
Transaction details • Orders: amount of USDT, rate, fees, tax deducted, rupees paid, dates and status. • Blockchain details: the wallet addresses you send from, transaction IDs and the network used. Blockchain transactions are public by nature. • Payment references (such as UTR numbers) for the rupees we send you.
Support • Messages and images you send in support chat.
Device and usage • IP address, browser or app version, sign-in times, and a device token if you turn on notifications. • Small files on your device (cookies and local storage) that keep you signed in and remember your settings. We do not use advertising or tracking cookies.
2. Why we use it
• To create and secure your account and stop fraud. • To verify your identity and keep the records the law requires (PMLA, KYC and FIU-IND rules). • To give you quotes, match your crypto payment and send rupees to your own account. • To deduct and report tax (TDS under section 194S of the Income-tax Act) and to issue receipts. • To answer your support requests and send you service notifications. • To meet legal duties, including reporting to authorities when the law requires it.
We do not sell your personal data and we do not use it for advertising.
3. Who we share it with
Only as needed to run the Service, under contracts that keep it confidential: • Supabase: database and secure document storage. • Render: website and app hosting. • Google Firebase: Google sign-in, notifications and live chat updates (no message text is sent to it). • WalletConnect (Reown): to connect your wallet app when you choose "Pay with wallet". • Blockchain data providers: to read public blockchain data for your payment. • Banks and payment partners: to send rupees to your account. • Government and law enforcement: the Financial Intelligence Unit (FIU-IND), the Income Tax Department and others, when the law requires it.
Some of these providers store data outside India (for example Singapore or the USA). They are bound to protect it to the standard of this policy and Indian law.
4. How long we keep it
• KYC and transaction records: at least 5 years after our relationship ends, or longer if the law or an investigation requires (PMLA). • Tax records: as long as the Income-tax Act requires. • Support chats: up to [2] years after the order closes. • Device tokens and sign-in records: until you sign out, turn notifications off or close your account, then for up to [12] months for security. After that we delete or anonymise the data.
5. How we protect it
Encrypted connections (HTTPS) everywhere; PAN, bank account numbers and 2-step codes are encrypted in our database; ID documents are stored privately and opened only through short-lived links; staff access needs two-step verification and every view of a document is logged.
6. Your rights
You can ask us to: • see the personal data we hold about you; • correct or complete it; • delete it, where the law does not require us to keep it; • withdraw consent, which may mean we can no longer provide the Service; • name someone to exercise these rights if you die or become unable to. Write to [support email] from your registered email. We reply within 30 days.
7. Children
The Service is only for people aged 18 or over. We do not knowingly collect data from children.
8. Changes
We may update this policy. We will show the new date at the top and, for important changes, tell you by email or in the app before they take effect.