This policy explains what information PayNest collects, why we need it, where it is stored and what choices you have. We only collect what we need to run your wallet safely.

1. What we collect

• Account details: your name, mobile number, Gmail address and account type (personal or merchant).
• Verification details: your NID or passport number and photos of the document if you add them; for merchants, the business name, category, address, trade licence and logo.
• Wallet activity: your balance, transfers, cash-outs, recharges, reports, and the receiving numbers or addresses you enter.
• Security details: your PIN, stored only as a secure one-way hash (we cannot read it), the devices you trust, and login attempts.
• Google sign-in: if you use "Continue with Google", we receive your Google email and name. We do not get your Google password.

2. Why we use it

• To create your account and let an admin verify who you are.
• To process and review transfers, cash-outs and recharges, and to handle reports.
• To protect you and other users from fraud, for example with one-time codes on new devices.
• To send you codes and important messages about your account by email or SMS.
• To meet legal duties, such as answering valid requests from the authorities.

We do not sell your information, and we do not use it for advertising.

3. Where it is stored

• Account and wallet data is stored on Firebase, a service run by Google.
• Images you upload (ID documents, trade licence, logo, profile photo) are stored on Cloudflare (R2 storage).
• These providers may store data on servers outside Bangladesh. They protect it with encryption and access controls.

4. Who can see it

• PayNest admins, only to verify accounts, review payments and help with support.
• People you pay or who pay you see your name and wallet number.
• Payment partners (bKash, Nagad, Binance, mobile operators) receive only what is needed to complete a cash-out or recharge.
• Authorities, when the law requires it.

5. How long we keep it

We keep your information while your account is open. After it is closed, we keep transaction records for as long as the law or fraud prevention requires, then delete them. You can ask us to delete images you uploaded if your account was never approved.

6. Your choices

• Ask for a copy of the information we hold about you.
• Ask us to correct details that are wrong.
• Ask us to close your account and delete your information, subject to the records we must keep.

Send these requests to rahul.da.cyber.master@gmail.com from the email on your account.

7. Security

We use secure connections (HTTPS), hashed PINs, one-time codes and admin review to keep your account safe. No system is perfect, so please keep your PIN private and tell us at once if you notice anything unusual.

8. Changes

If we change this policy in an important way, we will tell you in the app or by email before the change applies.

9. Contact

Privacy questions: rahul.da.cyber.master@gmail.com.