Privacy Policy

This Privacy Policy explains how Rupto Technologies Pvt Ltd ("Rupto") collects, uses, shares, and protects your personal data when you use the Rupto app and website. Rupto is the data fiduciary responsible for that data.

• Account data — your name, email address, phone number (if provided), a hashed password, and basic profile details from Google if you sign in with Google.
• Identity (KYC) data — government identifier details, date of birth, address, and verification documents or images, where the law requires us to collect them.
• Transaction data — payment amounts, payee UPI IDs, quotes, fees, timestamps, the settlement partner involved, and bank reference numbers (UTRs).
• Wallet and on-chain data — your deposit and withdrawal addresses, and the public blockchain transactions linked to them.
• Technical data — device and browser information, IP address, app version, and basic usage analytics.

• to create and operate your wallet and process your payments;
• to meet our KYC, anti-money-laundering, and other legal obligations;
• to detect, investigate, and prevent fraud, abuse, and security incidents;
• to provide customer support and respond to your requests;
• to send you service, transaction, and security notifications;
• to maintain, improve, and secure the product.

We process personal data to perform our contract with you, to comply with legal obligations (notably the Prevention of Money Laundering Act, 2002), for our legitimate interests in keeping the service secure and free of fraud, and on the basis of your consent where we specifically ask for it.

• Settlement partners — only the limited data needed to complete a specific payment.
• Verification and screening providers — to carry out KYC, AML, and fraud checks.
• Regulators and law enforcement — Indian regulators, courts, and law-enforcement agencies, where the law requires.
• Infrastructure providers — cloud hosting, email delivery, and analytics — bound by contract to protect your data.

We do not sell your personal data.

Transactions on public blockchains such as Tron, Ethereum, BNB Chain, and Solana are visible to anyone and are permanent. We cannot change, hide, or delete on-chain data. Treat your wallet addresses and on-chain activity as public.

We retain identity and transaction records for at least five years after our relationship with you ends, as required by the Prevention of Money Laundering Act, and for longer where another law or a lawful request requires. Other data is kept only for as long as it is needed for the purposes above.

We use encryption in transit, hashed credentials, access controls, and protected systems for custodial keys. No system is ever perfectly secure, so you also play a part — keep your password, OTPs, and devices safe, and stay alert to phishing.

Subject to law, you can ask us to give you access to your personal data, to correct or update it, to withdraw a consent you have given, or to delete data that we are not legally required to keep. To exercise a right, contact us using the details below; we may need to verify your identity first.

Our website uses essential cookies to keep you signed in and to secure your session, along with a small amount of analytics. You can manage cookies through your browser settings; disabling essential cookies may stop parts of the site from working.

Rupto is intended only for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has used Rupto, contact us and we will remove the data.

Your data is primarily processed on servers in India. Where any processing or transfer takes place elsewhere, we apply appropriate safeguards as required by law.

We may update this Privacy Policy. We will post the current version here and flag material changes in the app or by email.

For any privacy question, request, or complaint, contact our Grievance Officer at contact@rupto.in, addressed to Rupto Technologies Pvt Ltd, Mumbai, India. We will acknowledge and resolve grievances within the timelines set by applicable law.