Privacy Policy

Naafi Pay (“we”, “us”) is digital payment management software for Bangladeshi businesses. We are not a payment gateway, payment processor, payment facilitator, payment aggregator, merchant of record, bank, mobile financial service, money transmitter or custodian.

Naafi Pay never receives, holds, stores, controls, transfers, routes or settles customer money. A customer pays the business directly through the bank, mobile financial service, card processor or other provider selected by that business. Naafi Pay only helps the business manage the related references, status, invoices, records and reconciliation.

• Account data: name, email, phone number, business name, role.
• Payment metadata: transaction IDs, amounts, currency, gateway, status, customer reference, payer phone number (masked when displayed).
• SMS data: sender, body and timestamp of payment-related SMS forwarded from devices you pair with the platform. We use this only to auto-match incoming payments.
• Device data: pairing token, device label, app version, last seen timestamp.
• Technical data: IP address, user agent, request logs, error traces.

Naafi Pay does not collect customers' card numbers, bank credentials or mobile financial service credentials. Users may submit payment transaction or reference information only to match and manage payment records.

Transaction IDs, reference IDs and other payment metadata are records about a payment. They do not give Naafi Pay possession or control of the payment, the customer's account or the business's funds.

• To operate the dashboard, match payments, send webhooks and provide analytics.
• To secure the platform — fraud detection, rate limiting, audit logs.
• To send transactional emails (receipts, password reset, payment alerts).
• To comply with legal obligations and respond to lawful requests.

We do not sell your data. We do not use customer data to train external AI models.

We share data only with:

• Sub-processors who help run the Service (hosting, database, email delivery, error monitoring) under written data-processing terms.
• Payment providers you connect, strictly for the data needed to initiate, identify or confirm a payment directly between you and your customer.
• Authorities, when required by valid legal process.

• Payment and invoice records: 7 years (tax / audit requirements).
• SMS data: 13 months by default; deletable on request.
• Account data: until account closure plus 90 days.

We apply industry-standard safeguards: TLS in transit, encryption at rest, row-level security on every table, scoped API keys, signed webhooks, device-pairing tokens, 2FA on accounts, and audit logs on sensitive actions. No system is perfectly secure; report issues to security@naafipay.com.

Subject to applicable law, you may:

• Access, correct or export your data from the Account screen.
• Request deletion of your data (some records are retained where law requires).
• Withdraw consent for non-essential email communication.

Contact privacy@naafipay.com to exercise any of these rights.

We use first-party cookies and browser storage only for authentication, preferences, and basic analytics. We do not run third-party advertising trackers.

The Service is intended for businesses. We do not knowingly collect personal data from anyone under 18.

Data may be processed outside Bangladesh by our hosting and infrastructure providers, subject to appropriate safeguards.

We will post any material changes to this policy here and notify you in-app or by email at least 14 days before they take effect.

For any privacy questions, email privacy@naafipay.com.