Privacy Policy

1. Information We Collect

To provide secure peer-to-peer cryptocurrency escrow services, we collect only the necessary data categories:

• Account Data: Name, verified email address, phone number, and encrypted password credentials.
• Identity & KYC Documents: Government photo ID (Passport, National ID, Aadhaar, PAN card), date of birth, proof of address, and encrypted biometric selfie liveness captures.
• Financial & Payment Settlement Details: Bank account numbers, IFSC codes, bank names, branch locations, and UPI IDs registered by you for trade settlements.
• Transaction & Communication Records: Trade history, order timestamps, payment proofs, and encrypted trade dispute chat records.
• Technical & Security Metadata: IP addresses, browser user-agent, device identifiers, and session timestamps used by our automated fraud detection engine.

2. OWASP Data Minimization & Bank Detail Masking

• Public Marketplace Masking: When your sell offer is listed on the public P2P marketplace, your full real name, bank account numbers, IFSC codes, and branch details are stripped or masked (e.g. Ka***l).
• Conditional Counterparty Disclosure: Your bank account or UPI details are revealed ONLY to the specific counterparty who has entered into an active, locked trade order with you. Once a trade order expires or is cancelled, sensitive bank data access is immediately revoked.
• No Unrestricted Bulk Access: Our APIs implement strict rate limiting and automated bot defense mechanisms to prevent scraping and enumeration attacks.

3. How We Use Your Information

We process your personal information strictly for legitimate operational purposes:

• Authenticating trade orders and releasing automated escrow contracts.
• Operating our automated fraud engine to detect triangular arbitrage scams, identity theft, and account takeover attempts.
• Enabling customer service and arbitration desk specialists to resolve payment disputes.
• Complying with anti-money laundering (AML), tax reporting, and judicial law enforcement mandates.

4. Chat File Uploads & Document Security

Files and payment screenshots exchanged in trade chats are safeguarded by advanced security controls:

• All uploaded PDF documents and images are deep-scanned on our server to detect and block malicious active content, scripts, and embedded JavaScript exploits.
• Chat files are served using isolated sandbox security headers (Content-Security-Policy: default-src 'none'; sandbox;) and forced attachment downloads to prevent browser-rendered XSS execution.
• Only participants directly involved in the trade (buyer, seller, and platform admin) are authorized to view or download trade proofs.

5. Data Sharing & Third Parties

We do not sell, rent, or monetize your personal information to third-party advertisers or data brokers.

Information is shared only under strict confidential conditions:

• Counterparty: Necessary banking details shared with your trading partner solely to execute the agreed fiat transfer.
• Infrastructure Service Providers: Encrypted cloud storage (Cloudinary, AWS) and SMS/Email notification relays operating under strict data processing agreements.
• Legal Compliance: When compelled by subpoena, court order, or formal investigation by lawful cybercrime and financial enforcement bodies.

6. Data Security Safeguards

We employ defense-in-depth measures to protect your digital assets and identity:

• All network data in transit is encrypted using TLS 1.3 / HTTPS.
• Database fields containing sensitive financial tokens and KYC assets are encrypted at rest using industry-standard AES-256 encryption.
• Cold storage mother wallets are segregated with multi-signature hardware authorization to isolate customer escrow from online hot wallet exposure.

7. Your Privacy Rights

Subject to applicable data protection regulations (such as GDPR and DPDP), you possess the right to:

• Request a copy of the personal and transaction records we hold about you.
• Request correction or updates to inaccurate identity or banking data.
• Request account deletion, subject to mandatory statutory retention obligations for financial audit and AML laws.

8. Data Retention

We retain account and transaction records for the duration of your active account relationship, plus a statutory retention window required by financial compliance and anti-money laundering legislation (typically 5 to 7 years post-account closure).

9. Contact Data Protection Officer

If you have questions, feedback, or data privacy requests, please contact our Data Protection and Compliance Desk at support@bitpaisaa.com or visit our Contact Center.