TruePayout Privacy Notice
Last updated: 23 October 2026
This notice explains what personal data TruePayout collects, why, how long we keep it, who we share it with, and the rights you have. It is written for the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Digital Personal Data Protection Rules, 2025 ("DPDP Rules") and the Information Technology Act, 2000 and its rules.
Who is responsible for your data (the "Data Fiduciary"): TruePayout, Bengaluru (Urban), Karnataka, India (postal address for legal notices on request at grievance@truepayout.in) ("TruePayout", "we", "us").
Questions or complaints about your data: Aloka Kiran, Grievance Officer and data protection contact, grievance@truepayout.in, +91 96065 74521. See section 12.
This notice is available in English. Choose your language from the language menu.
1. The short version
- You download your own reports and bank statement and upload them. Your original files never leave your device.
- Your browser keeps only the columns we need (order IDs, SKUs, dates, statuses, amounts, transaction references). It does not read customer names, addresses or phone numbers. From bank statements it keeps only the date, the amount and reference numbers (such as UTRs). It drops names, UPI IDs, phone numbers and IFSC codes; a reference number in your bank narration can include an account number, so please do not upload statements of accounts that are not yours.
- That reduced data is sent to our server in Mumbai, India, encrypted, and checked there. The reduced rows themselves are not stored. We keep the check result (order numbers, amounts, dates, payouts and the differences found) so you can come back to it and track claims, until you delete it.
- We never log in to your marketplace or bank account. We never see your card or UPI details.
- No advertising or tracking cookies. We do not sell your data.
- You can withdraw consent, download, correct or delete your data at any time.
2. What data we collect
2.1 Account data
| Data | When we collect it |
|---|---|
| Email address | Always, to create your account |
| Name | Only if you give it, or if you use Google sign-in (Google shares your name and email) |
| Google account identifier | Only if you choose Google sign-in |
| Language preference | When you choose a language |
| Phone or WhatsApp number | Only if you choose to give it |
| Business name, address, GSTIN | Only if you add them for your invoice |
2.2 Data from your reports (reduced data)
Your browser reads your marketplace reports and bank statement on your device and keeps only these fields:
- Marketplace reports: order and sub-order IDs, SKU, dates, order and return statuses, amounts (sale price, fees, deductions, settlement amounts), and transaction or UTR references.
- Bank statement: only the transaction date, the amount, and reference tokens that contain digits (such as UTR or transaction numbers). Names and descriptions without digits are dropped.
We do not read customer names, addresses or phone numbers in your reports, and we never receive your original files.
Your reports belong to your business, but they can still be personal data, especially if you are a sole proprietor. Bank transaction data is financial information, which we treat as sensitive.
2.3 Results we create and store
- the checks you ran and when;
- differences found and how strong the evidence is;
- payout explanations;
- suggested claim text, the claims you mark as filed, and their status;
- notes you add.
These results can contain order IDs, SKUs, dates, amounts and references taken from the reduced data.
2.4 Payment and invoice data
- Razorpay payment ID, order ID, amount, status, date and payment method type (for example "UPI" or "card").
- Invoice records: your name, email, address and GSTIN (if you give them), what you bought and the amount.
We never see or store your full card number, CVV, UPI PIN or net banking login. Razorpay collects these directly.
2.5 Technical and security data
- IP address, browser and device type, and time of requests, collected by our hosting provider (Cloudflare) and our database provider (Supabase).
- Bot-check signals from Cloudflare Turnstile, used only to stop automated abuse.
- Sign-in and security logs (for example, sign-in times and failed attempts).
2.6 Support and messages
- Emails or messages you send us, and our replies.
- If you click a WhatsApp chat or share link, WhatsApp is opened on your device. We only see the message if you choose to send it to us.
2.7 Data we do not collect
- Marketplace or bank passwords.
- Your original report or bank statement files.
- Customer names, addresses or phone numbers from your reports.
- Advertising identifiers or tracking cookies.
3. Why we use your data, and our legal basis
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and run your account, sign you in | Account data, security data | Your consent at sign-up |
| Check your reports, find differences, explain payouts, prepare claim text | Reduced data from reports | Your consent at first upload (separate pop-up) |
| Save your results and claims so you can return to them | Results, notes | Your consent at first upload |
| Run the check on our server (and not only in your browser) so results cannot be altered, your claims are saved safely, and bigger files can be checked | Reduced data | Your consent at first upload |
| Take payment, send invoices, keep tax records | Payment and invoice data | Your consent when you pay; keeping invoices for the legally required period is required by tax law (DPDP Act section 8(7) allows retention needed to comply with law) |
| Send service emails (sign-in links, receipts, important changes, security alerts) | Needed to provide the service you asked for (consent at sign-up / legitimate use under DPDP Act section 7(a)) | |
| Answer your support requests and grievances | Support messages, account data | Legitimate use: you gave us the data for this purpose (section 7(a)) |
| Keep the Service secure, stop fraud and bots, meet CERT-In and DPDP log duties | Technical and security data | Compliance with law, and your consent at sign-up |
| Send product news and offers by email or WhatsApp | Email, phone/WhatsApp | Only with your separate, optional consent. Untick it or turn it off any time |
| Respond to lawful requests from courts or authorities | Any relevant data | Compliance with law (DPDP Act section 7(d) and (e)) |
We do not use your data for advertising. We do not sell or rent your data. We do not use your data to make decisions about you that have legal effects.
4. How to withdraw consent
You can withdraw any consent at any time. It is as easy as giving it.
- Marketing: Account > Your privacy choices > untick the email or WhatsApp box. Or click "unsubscribe" in any marketing email, or reply STOP on WhatsApp.
- Report processing and saved results: Account > Your privacy choices > untick "Check my files on TruePayout's server". We stop running checks for you and immediately delete your saved checks, findings and claim progress. Download them first if you need them.
- Everything: Account > Delete my account and data.
- By email: write to grievance@truepayout.in from your account email.
Withdrawing consent does not affect processing done before you withdrew. If you withdraw consent for report processing, we cannot run new checks for you. Records we must keep by law (such as invoices) are kept as explained in section 6.
5. Your rights
Under the DPDP Act you have the right to:
- Access: get a summary of your personal data we hold, what we do with it, and who we have shared it with. You can also download your claim list from any unlocked check (Download list).
- Correction and updating: fix wrong or incomplete data. You can edit most account details yourself.
- Erasure: ask us to delete your data. We will delete it unless the law requires us to keep it.
- Grievance redressal: complain to our Grievance Officer and get a response.
- Nominate: name another person who can use your rights for you if you die or become unable to act. Email us to name a nominee.
How to make a request: Use the in-app options, or email grievance@truepayout.in with your account email and what you want. We may ask you to confirm it is you, for example by a sign-in link. We do not charge for requests.
Response time: We will acknowledge your request within 48 hours and respond within 30 days. (The DPDP Rules allow up to 90 days; our published period is 30 days.)
Your duties: The DPDP Act also asks you not to give false information, not to impersonate anyone, and not to file false or frivolous complaints.
Complaint to the Data Protection Board of India: If you are not satisfied with our response, you may complain to the Data Protection Board of India through its online portal at https://www.dpb.gov.in, after first using our grievance process.
6. How long we keep your data
| Data | How long |
|---|---|
| Original files | Never received. They stay on your device. |
| Reduced data (rows sent for checking) | Not stored. Used only in memory while the check runs. |
| Check results (order numbers, amounts, dates, payouts, differences found), claims, notes | While your account is open, until you delete them or withdraw consent. |
| Account data | While your account is open. Deleted within [30] days of account deletion. |
| Inactive accounts | If you do not sign in for [24 months], we will email you and give at least 48 hours' notice, then delete the account and results. |
| Payment and invoice records | [8 years] from the end of the financial year of the payment, as required by tax and company law. Anonymised where possible after account deletion, but kept with your name, address and GSTIN where the law requires. |
| Security and access logs | 1 year, as required by the DPDP Rules, then deleted. |
| Consent records (what you agreed to and when) | While the consent lasts, plus [3 years] to prove consent if challenged. If you delete your account, the record is kept without your account link, under a one-way reference. |
| Support and grievance messages | [3 years] after the matter is closed. |
| Marketing consent and contact | Until you withdraw consent. |
| Backups | Deleted data is removed from backups within [35] days as backups roll over. |
| Data on your device (session, language, last result) | Until you sign out or clear your browser storage. |
7. Who we share data with
We share data only with service providers who help us run TruePayout. They process it on our instructions under contract, and must keep it secure.
| Provider | What it does | Data it handles | Where |
|---|---|---|---|
| Supabase (on Amazon Web Services) | Database, sign-in, server checks | Account data, reduced data, results, logs | Mumbai, India (AWS ap-south-1) |
| Cloudflare | Website hosting, content delivery, security, Turnstile bot check | Technical data, IP address, website traffic | Global network; may be processed outside India |
| Razorpay | Payment processing | Payment data, name, email, phone if given | India |
| Resend | Sending emails (sign-in links, invoices, notices) | Email address, name, email content | May be processed outside India (including USA) |
| Sign-in, only if you choose it | Name, email, Google account ID | May be processed outside India | |
| Odoo | Accounting and invoice records | Invoice records | As per Odoo's hosting for our account |
WhatsApp: Today we only use links that open WhatsApp on your device when you click them. If we start sending WhatsApp Business messages, we will ask for your separate consent first, and add WhatsApp (Meta) to this list.
We may also share data:
- with your consent or at your request;
- with courts, police or regulators when the law requires it; and
- with a buyer of our business, who must keep this notice's protections.
We never share your data with Meesho, Amazon or Flipkart. You decide what you send them.
8. Data outside India
Your reports, results and account are stored in India. Some providers (Cloudflare, Resend, Google) may process limited data, mainly your email address and technical data, outside India. The DPDP Act allows this unless the Government restricts transfers to a specific country. We will follow any such restriction.
9. How we protect your data
- Files are filtered on your device, so less data leaves it.
- Data is encrypted in transit (HTTPS/TLS) and encrypted at rest by our database provider.
- Each account can only read its own data (database access rules).
- Staff access is limited to what is needed, protected by multi-factor authentication, and logged.
- We keep security logs, monitor for misuse and keep backups.
- Our providers are bound by contract to keep data secure.
No system is completely secure, but we work to meet the "reasonable security safeguards" required by the DPDP Act and Rules.
10. If there is a data breach
If a personal data breach affects you, we will tell you without delay, by email or in the app, in plain language. We will say what happened, when, what data was involved, the likely impact, what we are doing about it, what you can do to protect yourself, and who to contact.
We will also report the breach to the Data Protection Board of India (with a detailed report within 72 hours) and, where required, to CERT-In within 6 hours of noticing it.
11. Cookies and storage on your device
We only use storage that the Service needs to work:
- Sign-in session: keeps you signed in.
- Language preference: remembers your language.
- Last result: keeps your latest result on your device so it loads quickly.
- Cloudflare security: Turnstile and Cloudflare may set strictly necessary security cookies to stop bots.
We do not use advertising or tracking cookies. If we add analytics, it will be cookieless and will not track you across websites. We will update this notice first.
12. Children
TruePayout is only for people aged 18 and over. We do not knowingly collect data from children. If you think a child has signed up, email grievance@truepayout.in and we will delete the account.
13. Grievance Officer and contact
Aloka Kiran Grievance Officer and data protection contact, TruePayout Bengaluru (Urban), Karnataka, India (postal address for legal notices on request at grievance@truepayout.in) Email: grievance@truepayout.in Phone: +91 96065 74521 (10 am to 6 pm IST, Monday to Friday, except public holidays, Monday to Friday)
See our Grievance Redressal Policy for timelines and escalation.
14. Changes to this notice
If we change this notice in a way that matters, we will email you or show a notice in the app before the change applies. If a change needs your fresh consent (for example, a new purpose), we will ask for it and not assume it.