Privacy Policy

Last Updated: 2022-03-10

Juspay Technologies Pvt Ltd. ("Juspay"/ "Us"/ "Our"/ "We") is committed to protecting your privacy.Juspay is a global company providing payment facilitator and payment gateway services, enabling e-commerce merchants with payment processing. We understand that you care about how your information is used and shared when you use Juspay's payment services as a merchant or end customer, and this notice describes our privacy policy and practices.

Online payment transactions may involve transfer of data across international borders, as well as backing up of data at our data centers in India. This means that data may be transferred, processed and stored outside the EU, the European Economic Area (EEA), UK and Switzerland. By submitting your data directly or through a third party such as a merchant you are agreeing to such transfer, processing and storage.

Juspay Services

"Services" shall mean the services that Juspay indicates in this Policy as provided by Juspay. Our technology based payment processing services provided by Juspay to entities who directly and indirectly provide us with End Customer Personal Data in connection with those entities (i.e. e-commerce merchants) own business and activities. Our End User Services are those Services which Juspay directs to individuals (rather than entities), one of such Service is online one click checkout services in the name and style of 'Breeze' the terms of which are provided here. "Sites" means Juspay.in and the other websites that Juspay indicates are covered by this Policy. Collectively, we refer to Sites, Business Services and End User Services as "Services" to partner merchants ("Merchants") and/or End User who directly and indirectly provide us with "End Customer" Personal Data in connection with those Merchants' own business and activities.

Juspay acts as a technology provider supplying secure online and mobile digital payment processing services to Merchants so that they can sell their goods and services to the End Customers shoppers both domestically and worldwide.The personal information collected by Juspay depends on how you are using our services. Depending on the context, "You" shall mean the Merchant and/or the End Customer who typically interface with Juspay in one of the following ways:

Merchant: you may be a business customer that has consented to Juspay's terms of service under a service agreement or other formal agreement and uses Juspay's Services to provide secure online payment solutions to the End Customers. To set up a merchant account you will need to provide personal details, business data and identifying documentation to comply with KYC and other requirements relating to the payments industry.

End Customer: You may be a business or consumer using Juspay's Services in the form of secure online payment technologies to complete the purchase of goods and services from a Merchant that has selected Juspay as its payments solution. Your own choice of payment method will usually determine what personal data is passed to Juspay to enable your payment transaction to take place. It could be name, address and credit/debit card details, electronic bank transfer information, or digital wallet credentials or tokenized data of your card details. When you use Juspay Services in the form of one click checkout i.e. Breeze, you do business with, or otherwise transact with, a Merchant (typically a merchant using Breeze Checkout, e.g. when you buy a pair of shoes from a merchant that uses Breeze for payment processing) but are not directly doing business with Juspay, we refer to you as an "End Customer".

While such secure transactions may be completed in just a few seconds they are often complicated by the fact that live anti-fraud checks need to be conducted. Data also has to be passed to the relevant payment processors; banks, payment card and payment account services may need to be notified; legal tax invoices generated, and transaction confirmations delivered; and this is dictated by the End User's choice of payment method and selected Merchant. Often these transactions may be international in nature, involving transfer of data across borders and continents. Some or all of these steps may all involve the transfer and sharing of personal data down a chain of service providers, the storage of transaction records in accordance with regulatory or contractual requirements as well as the use of tracking cookies.

Depending on the activity, Juspay acts as a "data controller" or "data processor".

WHAT CONSTITUTES PERSONAL INFORMATION:

For the purposes of this Privacy Policy, Personal Information means any information relating to an identified or identifiable natural person and shall include:

Contact Information (such as Your Name, phone number, email address; postal address);
Transaction Data (payment method information, last four digits of the debit/credit card number)
Mobile and device unique identifiers
Geo-location data
IP address, browser type, operating system
Other information (such as tracking behavior, cookie preferences, language preferences, age), device details
Financial information such as bank account, credit or debit card number, CVV or other payment instrument details which are encrypted in accordance with PCI DSS standard. Juspay will not collect or retain any of your payment information like your credit or debit card number, CVV, bank account details etc.
Purchase amount, currency, purchased product and size, date and location of purchase.
Transaction and purchase history.
Unique identifiers like transaction id, customer id etc.

HOW DO WE USE YOUR INFORMATION:

The information is collected to perform the following functions:

Process payment transactions (including authorization, processing refunds and dispute resolution processes)For example, when you choose to use a payment method for the transaction (e.g. credit card, debit card, buy now pay later, or UPI), your payment method will receive the transaction data (name, transaction ID, customer ID, payment instrument, unique identifiers, etc.) that includes your Personal Data. Please review your payment method's privacy policy to learn more about how they use and share this information.
For example, if you have a Breeze Account, Juspay will use your Personal Information in connection with your purchase transactions with Merchants associated with Breeze, including to;
1. Process payments for purchases from Merchants.
2. To personalize your shopping experience with Merchants.
Generation of invoices, transaction confirmation notices, access keys, product download files and associated documentation, relating to transactions, refunds and dispute records etc.
Communicate with you, respond to inquiries and send service notices, issue notices about functions and services you are registered to use including significant developments about the Services. (Users cannot normally op-out of this kind of email communication without cancelling the relevant service).
When Juspay acts as payment service provider, we may need to share relevant customer information with the specific Merchant's involved in the transaction in order for them to fulfill the transaction. The Merchant you choose to do business with will also receive transaction data that includes your Personal Data and the Merchant may share that Personal Data with others. Please review your Merchant's privacy policy to learn more.
Check applications for use of Juspay Services, KYC for Merchant Onboarding, protect against and prevent customer and transaction fraud, investigating potentially prohibited or illegal activities, unauthorized transactions, claims, manage risk exposure, conduct periodic risk reviews.
Evaluate business, product development, improve services, run billing, invoicing and account reconciliation functions.
Compliance with legislation, regulations, legal requirements and law enforcement measures, orders from judicial and governmental authorities, enforcement and defense of contractual and legal rights and claims.
Perform data analysis and generation of aggregated data reports based on anonymized information for benefit of Juspay, Merchants, processing partners, regulators and End Customers, auditing practices, conducting business intelligence.
Compliance with internal policies, card industry and payment scheme requirements
Payment Card Industry (PCI) assessment and validation
Consensual storage of End Customer payment information for subsequent or recurring transactions.
Provide information to regulators, Card Networks, investors and professional advisers.

Juspay may also use information in other ways for which we provide specific notice at the time of collection.

LEGAL BASIS FOR PROCESSING YOUR PERSONAL INFORMATION

Juspay processes Your Personal Information for the purposes defined above, basis the following lawful basis under GDPR:

Contractual and Pre-Contractual Business Relationships. We process Personal Data for the purpose of entering into business relationships with prospective Merchants to perform the respective contractual obligations that we have with these Merchants. Activities include:

Processing of payments, including fraud detection and prevention, optimizing valid transactions, communications regarding such payments, and related customer service.

Legal Compliance. We process Personal Data to verify the identity of Merchants in order to comply with fraud monitoring, prevention and detection obligations, laws associated with the identification and reporting of illegal and illicit activity, such as Anti-Money Laundering ("AML") and Know-Your-Customer ("KYC") obligations, and financial reporting obligations. For example, we may be required to record and verify a Merchant's identity for the purpose of compliance with legislation intended to prevent money laundering and financial crimes. These obligations are imposed on us by the operation of law, industry standards, and by our financial partners, and may require us to report our compliance to third parties, and to submit to third party verification audits.
Legitimate Business Interests. Where allowed under applicable law, we rely on our legitimate business interests to process Personal Data about you. The following list sets out the business purposes for which we have a legitimate interest in processing your data:

Detect, monitor and prevent fraud and unauthorized payment transactions;
Respond to enquiries, send Service notices and provide customer support;
Promote, analyze, modify and improve our Services, systems, and tools, and develop new products and services, including reliability of the Services;
Manage, operate and improve the performance of our Services by understanding their effectiveness and optimizing our digital assets;
Analyze and advertise our Services;
Conduct aggregate analysis and develop business intelligence that enable us to operate, protect, make informed decisions, and report on the performance of, our business;
Enable network and information security throughout Juspay and our Services; and

Consent. We may rely on consent to collect and process Personal Data as it relates to how we communicate with you and for the provision of our Services like Link, Atlas and Identity. When we process data based on your consent, you have the right to withdraw your consent at any time without affecting the lawfulness of processing based on such consent before the consent is withdrawn.

DISCLOSURE/SHARING OF PERSONAL INFORMATION TO THIRD PARTIES

Juspay does not sell or otherwise disclose personal information we collect about you except as disclosed in this Privacy Policy or as may be disclosed to you at the time information is collected.

Juspay may share personal information collected with entities that process payment transactions as well as relevant Merchants, fraud prevention services, card and payment services, and payment processors/acquirers.

Juspay may share certain information with service providers who provide or perform services on behalf of Juspay. We authorize such services providers to use or disclose such information only as necessary to perform services on our behalf or to comply with legal requirements. Such entities are required by contract and/or law to safeguard the privacy and security of personal information processed on our behalf. We may also share personal information with other parties with your express consent.

Juspay is also contractually committed with respect to data transfers from the EEA, UK and Switzerland to other countries including India through the use of contractual provisions including the EU's approved 'Standard Contractual Clauses'("SCCs"). Juspay relies on the SCCs with respect to data transfers from the EEA, Switzerland and UK to the US in both the original and more recent modular formats. Juspay is committed to maintaining the principles of transparency, accountability and choice regarding the collection and use of your personal information.In certain situations, Juspay might be deemed to be acting on the instruction of other transaction services or together with such parties, in which case Juspay shall itself be obligated to act in a manner compliant with applicable data law.

Certain Merchants might use checkout and other systems as part of the payment transaction process that might be integrated with Juspay. Accordingly, personal information that you provide to such services either directly or through your selected Merchant might be passed to Juspay. Juspay treats such personal information in accordance with this Privacy Policy, however other entities might have their own policies and these should be thoroughly checked by you.

Juspay may use third-party service providers to provide a variety of critical services, for example hosting (storing and delivering), analytics to assess the speed, accuracy and/or security of our Services, customer service, email and auditing.When you sign up for our services we will share your personal information only as necessary for the third party to provide that service. Personal information collected relating to marketing and Merchant onboarding functions may be stored and processed on secure compliant cloud-based services provided by third parties to Juspay. Such service providers are contractually required by Juspay to act in compliance with relevant data law.

We host and process data, including personal information in India , through a third party, to operate and manage this Service. When you access or use our Website or the Service, or otherwise provide information to us, you are consenting, on behalf of yourself and your authorized representatives or end-users, to the processing and transfer of information in and to India which may have different privacy laws from your country of residence. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Policy.

EU/EEA DATA PRIVACY LAW

With respect to data protection legislation in the European Economic Area, UK and Switzerland including the GDPR, Juspay acts as 'Data Processor' concerning End Customer information of EU/EEA/UK/Swiss-based persons that is transmitted to Juspay either through a Merchant or directly in order to process a purchase transaction.

When preserving transaction records in accordance with regulatory or industry requirements Juspay may act in such circumstances as 'Data Controller'.

When Juspay sets up an account for a Merchant we are required to conduct various payment security, anti-money laundering, credit and KYC checks. When managing such personal data with respect to EEA/UK-based individuals Juspay acts as a Data Controller.

EU/EEA/UK-based users will be asked to expressly consent to provision of personal information or initial setting of cookies when visiting Juspay web properties so that there is a clear legal basis for processing such data. In other cases personal information will be processed legally by virtue of the performance of the contractual obligations relating to a Merchant and/or End Customer, Juspay's legitimate interest, legal obligation or the defense or preservation of Juspay's legal rights.

Juspay complies with legal requirements to provide adequate safeguards for the transfers of personal data outside the EU/EEA/UK and Switzerland.

Individual users from the EU/EEA or other regions with laws governing data collection and use, should note that you are agreeing to the transfer of your personal information to India, from where Juspay operates. By providing your personal information with respect to a transaction or express consent mechanism, you consent to any transfer and processing in accordance with this Policy.

Individuals based in the EU/EEA and UK have additional statutory data subject rights as shown below under the heading: EU/EEA and UK Data Subject Rights.

Your right to access your personal data may be restricted in exceptional circumstances, including, but not limited to, when the burden or expense of providing this access would be disproportionate to the risks to your privacy in the case in question, or when the rights of persons other than you would be violated by the provision of such access. If we determine that your access should be restricted in a particular instance, we will provide you with an explanation of our determination and respond to any inquiries you may have.

LEGAL DISCLOSURE

We reserve the right to disclose your Personal Information as required by applicable law and when we believe that disclosure is necessary to protect our rights and/or to comply with a judicial proceeding, court order, or other legal process served on us.

Your Personal Information will also be shared between Juspay subsidiaries/affiliates for the activities permitted under this Policy.

In the event Juspay goes through a business transition, such as a merger or acquisition by another company, or sale of all or a portion of its assets, including an acquisition which occurs as a result of our bankruptcy, the Merchant user account and data will likely be among the assets transferred. You will be notified via a prominent notice on our Website of any such change in ownership or control.

MARKETING COMMUNICATION

Juspay may, from time to time, send you an email regarding the Juspay service or any other services, which we believe could be of interest to you. If you receive an unwanted email from us, you can write to us at privacy@juspay.in or use the unsubscribe link found at the bottom of the email to opt out of receiving future emails, and we will process your request within a reasonable time after receipt.

YOUR CONTROLS AND CHOICES

As a Processor, we shall address Your Rights under GDPR, only on the instructions of Our Merchants/Partners and shall directly address Your rights under GDPR where we directly collect your Personal Information on this Website. We are committed to our obligation of assisting our Merchants/Partners in addressing your Rights, in a timely manner. Where Juspay processes Personal Information as a Processor, You should submit your request to the Merchant directly.

Under GDPR, the following rights shall be available to You where Juspay processes Personal Information as a Controller:

Accessing and rectifying your Personal Information

When You use Our Services, We make reasonable efforts to provide You with Your right to access Your Personal Information and further upholding the accuracy of the Personal Information.;

Data Portability

You may request copies, in a structured, commonly used, and machine-readable format, of the Personal Information that You provided to Us, wherever feasible. Alternatively, You may request for Your Personal Information to be transmitted to another service provider (where technically feasible) directly by Us.

Data Retention and Erasure

We retain Your Personal Information for legitimate business interests and until We require such Personal Information to fulfill the purposes of collection mentioned above under clause "PURPOSES OF COLLECTING PERSONAL INFORMATION". We may also need to retain Your Personal Information to comply with legal obligations. If You no longer want Us to use Your Personal Information, then You can request to erase Your Personal Information. Do note that if You request for the erasure of Your Personal Information, We may retain some of the Personal Information as may be required for the following purposes:

Retention and use of Your Personal Information as necessary for Our legitimate business interests, such as fraud detection and prevention and enhancing safety;
Retention and use of Your Personal Information to the extent necessary to comply with Our legal obligations. For example, We may keep some of Your Personal Information for tax, legal reporting and auditing obligations;
Personal Information You share with Us (e.g. comments, complaints, feedback etc.) maybe retained for legitimate purposes, even after Your Account or subscription is cancelled, suspended, terminated or withdrawn; and
Because of the way We maintain certain services, after You delete Your Personal Information, residual copies of such Personal Information, it may take some time before these are deleted from Our active servers and may remain in Our backup systems.

You should be aware that it may not be possible to completely remove or delete all Your Personal Information from Our databases to effect any opt-out preferences You have made due to technical concerns with data backup and contingency support.

Your request for deletion, or modification of Your Personal Information shall be subject to the following:

where You have shared Your Personal Information, that You wish to request for deletion or modification, directly with Our Merchants/Partners, You shall request such parties for deletion or modification of Your Personal Information. Juspay as a data processor, shall not be responsible for the deletion or modification of such Personal Information held by data controller; and
in case the Personal Information that You request for deletion or modification has been collected and used only by Juspay, Juspay shall be responsible for the deletion or modification of the Personal Information requested, only when directed by Our Merchants/Partners acting as data controllers, and subject to the data retention conditions stipulated in this Privacy Policy.

Objection and Restriction of Processing

Where there is a lawful basis for processing Your Personal Information and such processing falls within Our legitimate interest like, without limitation, Device ID, IP Address, Customer ID, or where You have reasons to believe that the Personal Information being processed by Us is inaccurate, unlawful or is no longer required to be processed by Us under any lawful basis, You may, at any time, ask to restrict or object the processing of Your Personal Information.

PROTECTION OF YOUR PERSONAL INFORMATION

We are aware of the importance of the data we collect from the Website and therefore we use advanced technology to protect such information. We take reasonable precautions to protect such information from loss, misuse and unauthorised access, disclosure, alteration and destruction.

We will strive to do our best to protect your data. Your privacy is of utmost importance to us. If you have questions about our security you can contact us at privacy@juspay.in.

UPDATES/AMENDMENTS TO THE POLICY

Juspay reserves the right to change, modify, add, or remove portions of this privacy policy at any time for any reason. Such changes shall be effective immediately upon posting. We suggest that you review this policy periodically for changes. The current version of this Policy can be accessed from the link on our homepage, or at the bottom of our other Website pages. You acknowledge that, by accessing our Website after we have posted changes to this Policy, you are agreeing to the terms of the privacy policy as modified.

CHILDREN'S PRIVACY & PARENTAL CONSENT

This website is not intended for children and we do not knowingly solicit or collect Personal Information from children. Please be aware that we have not designed this Website for, and do not intend it to be used by anyone under the age of 16. We specifically request that persons under the age of 16 do not use this Website or submit or post information to the Website. Should we inadvertently acquire personal information or other data from users under the age of 16, we will not knowingly provide this data to any third party for any purpose whatsoever, and any subsequent disclosure would be due to the fact the user under age 16 used our website and submitted personal information without solicitation by or permission from us.

OTHER SITES

Juspay is only responsible for the privacy statement and content of this Website. We are not responsible for the privacy practices or the use of cookies on Websites that you may have accessed from this Website, or the privacy policies adopted by our Partners/Merchants.

CONTACT

If you have any questions about this privacy policy or want to get your grievances addressed, you can contact our Data Protection Officer - Parthiban Duraisamyat privacy@juspay.in.

For your dealings with the Juspay website, and any other technical support, you can contact us at hello@juspay.in

Registered Address: 444, Stallion Business Center, 18th Main Road, 6th Block, Koramangala, Bengaluru, Karnataka 560095

Breeze Automatic - Privacy Policy

Juspay Technologies Private Limited ("Company", "We", "Us", or "Our") has prepared this Privacy Policy to explain how we collect, use, store, share, and protect personal information in connection with its product, Breeze Automatic ("Breeze Automatic" or "Product").

Breeze Automatic is an AI-powered conversational assistant built to help D2C merchants make sense of their business data, gain insights, and automate tasks. The Product operates independently as an analytics tool and is distinct from other services we may provide.

By choosing to use Breeze Automatic, you expressly acknowledge and consent to the collection, use, storage, processing, and transfer of your personal data in accordance with this Notice, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), and the Digital Personal Data Protection Act, 2023 ("DPDP Act").

The scope of this Privacy Policy is limited exclusively to Breeze Automatic. It does not apply to any other products or services operated by us, which may be subject to separate privacy policies or notices.

1. Definitions

"Merchant" means the business customer that subscribes to/uses the Product.

"End-Customer" means an identifiable individual whose personal data is contained in the Merchant's datasets (e.g., CRM contacts, website visitors, ad audiences, purchasers, leads).

"Account Data" means data we collect from Merchant's personnel to create and administer the Merchant's account (e.g., work email, name, role, usage logs).

"Customer Data" means data that the Merchant uploads or connects to the Product (e.g., CRM records and Google/Meta advertising data), which may include personal data and sensitive personal data of End-Customers.

"Personal Data" means any data about an individual who is identifiable.

"Sensitive Personal Data" includes categories that, due to their nature, warrant heightened safeguards (e.g., financial data, precise location, biometric identifiers), and any other categories designated or treated as sensitive under law or contract.

2. Information we collect

We may collect, store, use, disclose, transfer, and process including but not limited to:

Account Data. Name, business email, phone (if provided), role, organization, authentication and usage logs, device and technical telemetry (e.g., IP address, browser/OS, app version), and support communications.
Customer Data (Merchant datasets). Data contained in or derived from CRM systems and Google/Meta Ads integrations that the Merchant connects, which may include End-Customer identifiers (e.g., name, email, phone), engagement and transaction records, campaign/ad metrics and audience segments, device/traffic attributes, payment mode metadata, and other business fields selected or synced by the Merchant. We process these strictly to provide analytics, diagnostics, and reports to the Merchant.
Phone/Device Data: With express consent, we may access camera, microphone, location, and SMS data (limited to transaction or business alerts) for verification, onboarding, or fraud-prevention purposes.
Cookies and Analytics Tools: We use cookies and similar technologies to ensure functionality, security, and user experience improvements. These include session cookies (to maintain login), technical cookies (to store preferences), and analytics cookies (to measure and improve performance). Advertising or tracking cookies will only be used if you explicitly opt in.
Voluntary Information: Any other information you choose to share while using the Product, including uploaded business records, customer/vendor details, or supporting documentation.

3. Purpose and Lawful Basis

3.1. We process Personal Information and Sensitive Personal Information to: (a) create and manage accounts; (b) connect integrations and retrieve business data as instructed; (c) generate insights, summaries, analytics and non-binding recommendations; (d) execute your approved commands via integrations(e) maintain security, reliability, and performance; and (f) comply with legal obligations.

3.2. We rely on consent and other lawful basis permitted under the DPDP Act. You may withdraw consent at any time; withdrawal does not affect processing already carried out with consent.

3.3. For merchant-provided datasets (including CRM systems, Meta Ads, Google Ads, and other advertising or business platforms), the merchant is the primary Data Fiduciary, and the Company acts solely as a Data Processor, processing such data strictly on the merchant's instructions to provide the Product functionalities as per the DPDP Act. Such data will not be used for the Company's independent purposes, including profiling or marketing, unless the merchant has explicitly opted in.

3.4. Merchant Responsibilities: The merchant represents and warrants that it (i) has a lawful basis to collect and share the data with the Company; (ii) has provided all required notices and obtained any necessary consents/opt-ins from Data Principals (as defined under the DPDP Act); (iii) will configure data minimisation (e.g., restricting synced fields) and honour unsubscribe/opt-out flags; and (iv) will not upload prohibited or specially regulated categories of data unless permitted by law and configured in the Product.

4. Data Retention & End-Customer Rights

4.1. Data Retention

We retain the personal information collected through Breeze Automatic only for as long as it is necessary to fulfil the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.
We confirm that no personal data will be retained beyond the period necessary for the purposes identified at the time of collection, and such data shall be deleted or anonymised once the purpose is fulfilled, unless retention is mandated by applicable law.
The retention of your data is guided by the following principles:
1. Service Continuity: Data will be retained for the duration of your use of Breeze Automatic to ensure seamless service and accurate analytics.
2. Improvement and Benchmarking: Aggregated or anonymised data may be retained indefinitely to support statistical research, benchmarking, and service improvement.
3. Legal and Regulatory Requirements: Certain records may be stored beyond your active use period to comply with applicable laws, respond to legal claims, or enforce our rights.
4. Periodic Review: We will periodically review the data retained to ensure it remains necessary and proportionate for the purposes described.

4.2. End-Customer Rights

Where applicable, individuals whose data is processed may have rights under law, including the right to access, correct, delete, or restrict processing of their data. Merchants are primarily responsible for addressing such rights, and the Company will reasonably assist in fulfilling these requests:

Right of Access: The End-Customer may request a copy of the personal data we hold about you, along with details of how it is used.
Right to Rectification: The End-Customer may ask us to correct any inaccurate or incomplete personal data.
Right to Erasure: The End-Customer may request the deletion of its personal data when it is no longer necessary for the purposes collected, subject to any legal or contractual obligations.
Right to Restrict Processing: The End-Customer may request restrictions on how we use the data in certain circumstances.
Right to Data Portability: The End-Customer may request a copy of their personal data in a structured, commonly used, and machine-readable format, and transmit it to another service provider where technically feasible.
Right to Withdraw Consent: The End-Customer may withdraw your consent at any time for data processing based on consent. Such withdrawal will not affect the lawfulness of processing based on consent before its withdrawal.
Right to Object: The End-Customer may object to our processing of your personal data in certain situations, such as processing for direct marketing.

5. Data Sharing & Disclosure

To provide you with a seamless and reliable experience on Breeze Automatic, we may share the Customer Data under the following circumstances:

Service Providers and Partners: We may engage trusted third-party service providers to assist us in delivering Breeze Automatic, such as hosting providers, artificial intelligence, or IT security firms.
Group Companies: We may share data with our affiliates or group companies where necessary to improve product functionality, develop new features, or for internal compliance, provided such sharing remains consistent with this Privacy Policy.
Legal and Regulatory Disclosures: We may disclose your data if required by applicable law, regulation, legal process, or governmental request. We will ensure that such disclosure is limited to what is legally necessary.
Business Transfers: In the event of a merger, acquisition, restructuring, or sale of assets, your data may be transferred as part of the business transaction. In such cases, we will ensure that the successor entity is bound by privacy commitments at least as protective as this Privacy Policy.
Aggregated and Anonymised Data: We may use and share anonymised and aggregated information (that cannot reasonably identify you) for research, analytics, product development, or to publish insights about market trends. Such data will not be linked back to you individually.

We do not use Customer Data for our own marketing, profiling of individuals, or unrelated product development. Such data is processed solely to generate insights, analytics, and dashboards for the merchant and is disclosed only to authorised sub-processors engaged to provide the Product, under written agreements and appropriate safeguards.

6. No model training by default

By default, we do not use Customer Data or outputs to train foundation models used for other customers.

7. International Transfers

Customer Data may be processed in India or other jurisdictions where our service providers are located. Any cross-border transfers will comply with the DPDP Act and applicable Government notifications. Where required, we will implement contractual safeguards (such as data transfer agreements) or other legally recognised mechanisms. We will transfer only to jurisdictions not restricted under the DPDP Act.

8. Data Security

8.1. We implement appropriate technical and organisational measures to safeguard your personal information against unauthorised access, loss, misuse, or disclosure. While we take reasonable steps to protect your data, no security system is entirely foolproof, and we cannot guarantee absolute security.

8.2. The Company complies with Rule 8 of the SPDI Rules and follows reasonable security practices and procedures, including ISO 27001 or equivalent industry-recognised standards.

9. Automated Decision Making

9.1. Breeze Automatic may use automated tools, including algorithms and statistical models, to analyse Customer Data and derive insights, trends, and predictions. These tools assist in improving operational efficiency, identifying patterns, and delivering analytics dashboards that help Customers make data-driven decisions.

9.2. We clarify that:

No Solely Automated Decisions with Legal or Significant Effects - Breeze Automatic does not take decisions that have a direct legal effect or similarly significant impact on individuals solely based on automated processing of their personal data. Any insights generated are intended to support business understanding and decision-making by the Customer.
Purpose of Profiling - Where profiling of datasets is undertaken, it is done exclusively for generating aggregate insights, performance indicators, or market intelligence. Such profiling is not aimed at evaluating personal aspects of any specific individual.
Safeguards - In all cases, reasonable technical and organisational measures are implemented to ensure that automated data processing remains accurate, fair, and proportionate to the legitimate business purposes for which it is deployed.
Customers retain full discretion and responsibility for how they interpret and act upon the insights generated through the platform.

10. Policy Updates and Changes

10.1. Breeze Automatic may amend, update, or revise this Privacy Policy from time to time to reflect changes in legal requirements, regulatory guidance, or business practices. Whenever material changes are made, the updated Privacy Policy will be published on our website and, where required by law, Customers will be notified through appropriate means (such as email communication or in-platform notifications).

10.2. The revised Privacy Policy will take effect from the date of publication, unless a different effective date is specifically indicated. Continued access to or use of the Breeze Automatic after the updated Privacy Policy has been published shall be deemed acceptance of the changes.

10.3. Customers are encouraged to review this Privacy Policy periodically to remain informed of how their data is being collected, used, and protected.

11. Grievance Redressal

If you have any concerns or complaints related to data privacy, you may contact our designated Grievance Redressal Officer using the details below:

Grievance Redressal Officer
Mr. Parthiban Duraisamy
Email: privacy@juspay.in

If you have any grievance, then you may intimate the same to above e-mail address in the manner explained below:

Sending a request in writing or through email signed with electronic signature identifying the grievance;
Your contact information like address, telephone number, email address, etc. where you can be contacted.

Social Media Sync by Breeze - Privacy Policy

This section explains how Juspay Technologies Private Limited ("Company", "We", "Us", or "Our") handles information from Instagram in connection with Social Media Sync by Breeze, a Shopify app that lets a merchant show posts from their own Instagram professional account on their own Shopify storefront. Its scope is limited to Social Media Sync by Breeze.

1. What we access

When a merchant connects their Instagram professional account through Instagram Login, Instagram shares that account's username and Instagram user ID, and its published posts: photos, videos and Reels, with their captions, the links to the posts on Instagram, the post type and the time of posting. We request only the instagram_business_basic permission, which is read-only. We do not access direct messages, comments, followers, insights, or any other person's account.

2. How we use it

Only to display the merchant's own posts on the merchant's own storefront, in the layout the merchant chooses. While the account stays connected, we refresh the posts about once an hour. We do not use this information for advertising or profiling, and we do not sell it or share it with anyone else.

3. How we store it

The Instagram access token is encrypted at rest. Copies of the posts' images and videos are kept in our storage and served from our content delivery network, so the storefront loads quickly and does not call Instagram on every page view. Storefront visitors are not identified: the feed does not collect or store anything about the people viewing the store.

4. How long we keep it, and how to delete it

When the merchant disconnects the account in the app, uninstalls the app from Shopify, or Shopify sends us a shop data deletion request, we delete the access token and the connection details and remove the cached copies of the posts.
If a connection stops working without being disconnected (for example, access is revoked from Instagram), we delete the cached posts within 30 days.
A merchant can also revoke access at any time in Instagram (Settings, then Apps and websites), or follow our data deletion instructions.

5. Contact

Questions or deletion requests: privacy@juspay.in, or our Data Protection Officer, Parthiban Duraisamy, at the same address.

Popups by Breeze - Privacy Policy

This section explains how Juspay Technologies Private Limited ("Company", "We", "Us", or "Our") handles information collected through Popups by Breeze, a Shopify app that lets a merchant show on-site popups, bars and spin-to-win offers on their own Shopify storefront and capture a shopper's contact details in exchange for a reward. Its scope is limited to Popups by Breeze.

1. What we access

When a shopper submits one of a merchant's popup forms, we receive whatever the merchant's own form asked for and the shopper typed: an email address, a phone number, a name, or another field the merchant added, together with whether the shopper agreed to the consent statement shown on that form, which campaign and variant showed it, the page it appeared on, a coarse device type (desktop, mobile or tablet), and the reward code issued in exchange, when the campaign issues one. We do not set a cookie and do not assign a shopper any identifier: which offer a shopper has already seen, and how many times, is remembered only in that shopper's own browser, not by us.

2. How we use it

To deliver the reward the popup promised, to show the merchant their own leads and campaign performance, and - only when the merchant has turned it on and the shopper consented - to send one follow-up email from the merchant and, separately, to forward the same details to a marketing tool the merchant has connected. Neither the follow-up email nor the forwarding ever happens for a shopper who did not consent. We do not use this information for our own advertising or profiling, and we do not sell it.

3. How we store it

Contact details are stored against a one-way, unreadable digital fingerprint of the shopper's email address, which lets us find and act on one shopper's data without keeping a second, plainly readable copy of it. Storefront traffic counts (impressions, clicks and conversions) are kept only as totals per campaign and carry nothing that identifies who generated them. If a merchant connects a third-party marketing tool, the credential for that tool is stored separately and is never included in what shoppers or storefronts can see.

4. How long we keep it, and how to delete it

A submitted contact detail is kept for up to 183 days from capture, and a storefront traffic total for up to 90 days, after which it is deleted automatically. The exact deletion date for a given capture is fixed at the moment it is captured and is shown to the merchant.
When a merchant uninstalls the app, or Shopify sends us a shop data deletion request, we erase every contact detail, every traffic total and every stored setting for that store.
A shopper can ask a merchant to delete their own details at any time; the merchant's request reaches us as a Shopify customer-data-erasure request naming that shopper's email address, and we erase every matching record and report back how many were removed.

5. Contact

Questions or deletion requests: privacy@juspay.in, or our Data Protection Officer, Parthiban Duraisamy, at the same address.

Cookie Consent by Breeze - Privacy Policy

This section explains how Juspay Technologies Private Limited ("Company", "We", "Us", or "Our") handles information collected through Cookie Consent by Breeze, a Shopify app that records which choices shoppers make in a store's own Shopify cookie banner and shows the merchant that history. The app does not show a banner of its own. Its scope is limited to Cookie Consent by Breeze.

1. What we access

When a shopper opens a store that has switched the app on, a small script supplied with the app reads the state of Shopify's cookie banner in the shopper's browser and sends us a record of it. A record holds whether the shopper has granted or denied each of four purposes (analytics, marketing, preferences and sale of data); which of them are in effect as a result; whether the browser sent the Global Privacy Control signal; the language of the page; whether the choice was already set when the shopper was first seen or was changed by the shopper; the time, as reported by the shopper's browser and as received by us; and a random receipt number. A record does not contain the shopper's name, email address, phone number, address, IP address, browser details or customer account, and we give the shopper no identifier that could be used to recognise them across visits or across stores. The app sets no cookie and keeps nothing else in the shopper's browser, and it does not record the wording of the banner. From the merchant, we receive the store's web address and the tracking settings the store has configured with Breeze, which the app uses to show which trackers a shopper's choice applies to.

2. How we use it

Only to show the merchant, inside the app, the history of what shoppers chose in their store's cookie banner and what that means for the trackers the store runs, so the merchant can see and demonstrate how the banner has been used. We do not use this information for advertising or profiling, and we do not sell it or share it with anyone else.

3. How we store it

Records are kept in our managed data store, separated by store, and are shown only to the merchant of the store they came from. The date on which a record is deleted is fixed when the record is received.

4. How long we keep it, and how to delete it

A record is kept for six months from the day we receive it. After that it stops appearing in the app and is deleted automatically, within two days.
When Shopify sends us a shop data deletion request, which it does 48 hours after a merchant uninstalls the app, we delete every record for that store.
A record contains nothing that identifies an individual shopper, so there is nothing of that shopper in the app's records to return or remove in response to a Shopify customer data or customer erasure request. A shopper with a question about their cookie choices can write to us at the address below.

5. Contact

Questions or deletion requests: privacy@juspay.in, or our Data Protection Officer, Parthiban Duraisamy, at the same address.

PRIVACY POLICY

Breeze Automatic - Privacy Policy

Social Media Sync by Breeze - Privacy Policy

Popups by Breeze - Privacy Policy

Cookie Consent by Breeze - Privacy Policy