Data Privacy Notice
This notice explains what personal data Mount Pay collects, why we collect it, how long we keep it, and what rights you have over it. It applies to visitors to mountpay.co, merchants who sign up for our services, and end customers who transact through a merchant using Mount Pay.
Short version. We collect data we need to process payments and to run our business. We don't sell it. We store it in India where possible, apply Indian and country-specific data protection standards, and give you the ability to ask what we hold and get it deleted where the law allows.
Contents
1. Who we are
Mount Pay is a payment infrastructure service operating at mountpay.co. The data controller for the purpose of this notice is Mount Pay Technologies, together with the licensed acquiring partners we operate through in each of the countries we serve. Your account manager can confirm the specific legal entity that holds your data on request.
2. What data we collect
From visitors to mountpay.co
- IP address, user agent, referrer URL, and pages viewed
- Any information you submit through contact forms (name, email, company, message)
- Cookie identifiers set by us or by third-party analytics tools we use (see cookies section)
From merchants signing up for our services
- Company registration details, tax IDs, bank account information
- Identity documents for beneficial owners and directors (KYB)
- Contact details for the people who administer your account
- Technical data related to your integration (API request logs, webhook delivery logs)
From end customers transacting through a merchant using Mount Pay
- Payment method identifiers (masked card number, VPA, wallet handle, bank account number)
- Transaction amounts, timestamps, merchant reference IDs
- Where required by the payment method or by regulation, identity data supplied during a KYC step
- Technical data related to the payment session (device fingerprint, IP, session identifiers)
3. Why we collect it
We collect and process the data listed above for the following purposes:
- Processing payments. To route your transactions to the correct rail, confirm settlement, and reconcile.
- Fraud prevention. To score transactions in real time and detect abusive patterns before they affect merchants or their customers.
- Meeting regulatory obligations. KYC, KYB, AML monitoring, and reporting required by the payment institutions and central banks we operate under in each country.
- Providing support. To answer merchant questions, reproduce issues, and improve our service.
- Improving our product. To understand which features are used and to prioritise our roadmap. This uses aggregated data wherever possible.
4. Where it is stored and for how long
Data is stored on infrastructure hosted in AWS ap-south-1 (Mumbai). We do not replicate live payment data to regions outside South Asia. Cold backups are encrypted and retained under our compliance obligations.
Retention periods vary by data type:
- Transaction records: 10 years, in line with financial services record-keeping obligations in India, Bangladesh and Pakistan.
- KYC and KYB documents: for the life of the relationship plus 8 years, or as required by the local regulator.
- Support conversations: 3 years from the date of last activity.
- Website analytics: 14 months.
- Marketing consent records: for the life of the consent plus 2 years for evidence.
5. Who we share it with
We share personal data only with:
- Licensed acquiring partners in each country, as needed to process and settle transactions.
- Banks and payment networks that clear the underlying transaction.
- Regulators, tax authorities and law enforcement when required by law or a valid legal order.
- Sub-processors we use to run our service (hosting, monitoring, analytics), each of whom is under a written contract that requires them to protect the data.
We do not sell your data. We do not share it with third-party advertisers. We do not use payment data to train general-purpose machine learning models available to third parties.
6. Your rights
You have the following rights over the personal data we hold about you. Some rights are subject to legal exceptions (for example, we cannot delete transaction records we are required by law to retain).
- Access. Ask us what data we hold about you and get a copy in a portable format.
- Correction. Ask us to correct inaccurate data.
- Deletion. Ask us to delete data where the law allows.
- Restriction. Ask us to stop processing your data for specific purposes while a question about it is being resolved.
- Objection. Object to processing based on our legitimate interests.
- Withdraw consent. Withdraw any consent you have given, without affecting the lawfulness of processing before the withdrawal.
To exercise any of these rights, contact us at privacy@mountpay.co. We will reply within 30 days.
7. Cookies and tracking
The mountpay.co website uses cookies for the following purposes:
- Essential cookies. Session tokens for logged-in merchants, CSRF protection, load-balancing hints.
- Analytics cookies. To understand how visitors use the site so we can improve it. These are set only after you accept the cookie banner.
- Preference cookies. To remember your language, theme, and cookie choices themselves.
We do not use third-party advertising cookies. We do not sell cookie data to marketing platforms.
8. Security
We hold ISO/IEC 27001:2022, ISO/IEC 27017:2015 and SOC 2 Type II attestations. Data is encrypted at rest with AES-256 and in transit with TLS 1.3. Access to production systems requires just-in-time credentials, multi-factor authentication and per-action approval; all access is logged and reviewed quarterly.
If we discover a breach that affects your data, we will notify you within 72 hours of confirming the incident, in line with the breach notification requirements in the applicable jurisdiction.
9. Changes to this notice
We may update this notice from time to time. If we make a material change, we will notify active merchants by email and post the updated version here with a revised effective date. Older versions are archived on request.
10. Contact us
For any question about this notice, or to exercise any right, contact us at:
- Email: privacy@mountpay.co (privacy-specific), hello@mountpay.co (general)
- Postal: Registered address available on request through your account manager.
Not a legal opinion. This notice is a plain-English summary of our data-handling practices. Where local law imposes stricter obligations (India DPDP Act, Bangladesh's Personal Data Protection Bill, Pakistan's PECA and related instruments), those obligations apply and take precedence. For the exact legal framework applicable to your specific case, ask your account manager for the country-specific data processing agreement.