Privacy Policy

OneTap Checkout ("Company", "We", "Us", or "Our") is committed to protecting your privacy. OneTap Checkout is a digital 1-click checkout service provider enabling e-commerce merchants with payment processing acceleration and checkout optimization.

By choosing to use OneTap Checkout directly as an End-Customer or as a Merchant, you acknowledge and consent to the collection, use, storage, processing, and transfer of your personal data in accordance with this Privacy Policy, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), and the Digital Personal Data Protection Act, 2023 ("DPDP Act").

1. Definitions

• "Merchant" means the business customer that has integrated OneTap Checkout with their Shopify store and uses our Services to provide secure, accelerated online payment and checkout solutions.
• "End-Customer" means an individual who uses OneTap Checkout's secure online checkout technologies to purchase goods or services from a Merchant (e.g., when you purchase items from a store using OneTap Checkout).
• "Services" means the one-click checkout services, platform APIs, admin portal, analytics dashboards, and sites operated by us.
• "Sites" means onetapcheckout.in and other web properties covered by this Policy.
• "Personal Data" means any data or information relating to a natural person who is directly or indirectly identifiable.

2. Information We Collect

Depending on how you interface with our Services, we collect and process the following information:

A. Merchant Account Data

To set up and manage a Merchant account, we collect:

• Name, business email, physical address, phone number, and organizational role.
• Authentication credentials, API keys, platform configuration settings, and store connection details (such as Shopify domain and OAuth tokens, stored encrypted).
• Payment gateway configuration (such as Razorpay Key ID — secrets are stored encrypted and are never displayed in plaintext).

B. End-Customer Data

When a Shopper checks out on a store powered by OneTap Checkout, we process:

• Contact Information: Name, mobile phone number, shipping address, and email address.
• Transaction Data: Selected payment method, purchase amount, currency, purchased product variants and sizes, and date of the purchase. We do not store any card numbers, CVV codes, or banking credentials — all payment data is handled exclusively by the payment gateway (e.g., Razorpay).
• Device & Telemetry Data: IP address, browser type, operating system, and session identifiers.
• Unique Identifiers: Internally generated transaction IDs, session IDs (secured via cryptographic nonces), and customer IDs.

3. Purpose and Lawful Basis

We process Personal Data and Sensitive Personal Data under the following lawful bases permitted under the DPDP Act and GDPR:

• Contractual Business Relationships: To perform our contractual obligations with Merchants and End-Customers, including processing orders, delivering transaction confirmation notifications, and pre-filling shipping profiles for 1-click checkouts.
• Legal Compliance: To comply with applicable law.
• Legitimate Business Interests: To protect against transaction fraud, secure our network from CSRF and injection attacks, improve app performance, and run aggregate business intelligence reports.
• Consent: Where you consent to store your phone number and delivery addresses for automatic pre-filling across our checkout network. You have the right to withdraw this consent at any time.

4. End-Customer Rights

Under the DPDP Act and GDPR, End-Customers have statutory rights regarding their data. Merchants are primarily responsible (as the Data Fiduciary) for addressing these rights, and we will assist them in fulfilling the following:

• Right of Access & Rectification: The right to inspect and update the Personal Data we maintain.
• Right to Erasure (Deletion): The right to request deletion of your information, subject to mandatory regulatory retention requirements (such as tax records or active fraud investigation).
• Right to Restrict or Object: The right to object to processing if you believe the data is processed unlawfully or inaccurately. Please contact us at support@onetapcheckout.in to exercise any of these rights.

5. Data Sharing and Disclosure

We do not sell your personal data. We disclose information strictly under the following terms:

• Acquirers and Payment Processors: Transaction details are shared with banks, card networks, and payment gateway providers (e.g., Razorpay) to complete the sale.
• Merchants: Relevant checkout details are synced back to the specific Merchant store from which the Shopper is buying, enabling order fulfillment.
• Service Providers: Trusted third-party vendors who assist in hosting (database servers, Redis cache), sending verification SMS OTPs (e.g., MSG91), and analytics.
• Business Transitions: In the event of a merger, acquisition, or sale of assets, customer accounts and transaction databases will be part of the transferred assets.

6. International Data Transfers

Our primary data centers are located in India, where we operate. By submitting your data (either directly or through a Merchant), you consent to the processing and storage of your information in India.

Any cross-border transfers of data outside the European Economic Area (EEA), UK, or other regions will comply with the DPDP Act and GDPR through legally recognized transfer mechanisms, including Standard Contractual Clauses (SCCs). We transfer data only to jurisdictions not restricted under the DPDP Act.

7. Data Security and Cryptographic Controls

We implement recognized security best practices to protect your data. Access tokens and Shopify OAuth tokens are encrypted using AES-256-GCM. All secrets and passwords are redacted from application logs using scrubbing filters before they are stored or printed.

8. Automated Decision Making

OneTap Checkout uses algorithms to evaluate transaction risk and identify patterns. We do not make solely automated decisions that have direct legal effects or similarly significant impacts on individuals. All automated checks are designed to support merchant fraud mitigation and optimize funnel performance.

9. Data Retention Policy

We retain Personal Data and merchant configurations only as long as necessary to fulfill the purposes outlined in this Privacy Policy:

• Merchant Data: In the event of account uninstallation or deletion, merchant configuration, branding settings, and order databases are retained in a secure backup for a grace period of up to 90 days before being permanently and irreversibly purged from our systems. Unique parameters (such as email and shop domain) are released immediately upon account deletion to facilitate new registrations.
• End-Customer Data: We store purchase histories, shipping details, and verified shopper profiles as long as necessary to provide continuous 1-click checkout acceleration services, or as required to meet financial auditing, taxation, and legal dispute resolutions.

10. Contact Us

If you have any questions, comments, or concerns about this Privacy Policy or our privacy practices, please contact us at:
📧 support@onetapcheckout.in