Privacy Policy

1. Introduction

This Privacy Policy explains how FamGateway collects, uses, encrypts, and protects your information when you access our payment gateway, API dashboards, or website at https://famgateway.in.

2. Information We Collect

To provide automated payment processing services, we collect only necessary developer and account data:

• Account Details: Name, email address, password hash (salted and hashed via bcrypt), and unique Merchant ID.
• Payment Configuration: Your public FamPay UPI ID (e.g. username@fam) to generate QR codes.
• Email Verification Credentials: Dedicated single-purpose Google App Passwords provided by you for automated transaction receipt matching.
• Transaction Metadata: Order amounts, timestamps, transaction statuses (Paid/Pending/Expired), and customer IP logs for anti-fraud detection.

3. Cryptographic Architecture & Credential Protection (AES-256)

FamGateway adheres to a rigorous defense-in-depth cryptographic model designed to protect merchant credentials against database breaches, unauthorized access, and pattern analysis:

1. 256-Bit Symmetric Encryption with Dynamic IVs: All sensitive credentials (including 16-character Google App Passwords) are encrypted using 256-bit Advanced Encryption Standard (AES-256) prior to storage in our database. Every encryption call dynamically generates a cryptographically secure 16-byte pseudorandom Initialization Vector (IV) via openssl_random_pseudo_bytes(16). Because no two database records ever share the same IV, ciphertext pattern analysis and rainbow-table attacks are mathematically impossible.
2. Server-Level Key Separation (Database Isolation): The master 256-bit encryption key is stored strictly within server-level environment configuration files (env.php) protected by restricted Linux filesystem permissions. The encryption key is never stored in the MySQL database. In the event of a raw database dump or SQL compromise, an adversary obtains only scrambled ciphertexts that cannot be decrypted without the isolated server environment key.
3. Stateless In-Memory Volatile Processing: Incoming FamPay transaction emails are inspected strictly in transient, volatile server memory (RAM) during active polling. The execution lifecycle lasts under 5 milliseconds: as soon as the Bank UTR and payment amount are matched against an active order, the memory buffer is immediately flushed. Email contents, sender personal messages, and inbox archives are never written to disk, database, or persistent logs.
4. Zero Primary Password Access: FamGateway strictly prohibits and never requests your primary Google account password. Only isolated, single-purpose 16-character Google App Passwords generated specifically for mail access are utilized.
5. Unilateral Merchant Revocation Rights: Because merchants utilize Google App Passwords rather than account credentials, you retain absolute, real-time control. You can revoke access in one click directly inside your Google Account Security Settings at any second. Revoking the password at Google instantly renders the encrypted database entry completely inert, even before updating your FamGateway dashboard.
6. Defense-in-Depth Infrastructure: All data in transit is protected using TLS 1.3 encryption with strict HSTS headers. Database access is restricted to localhost socket connections, and backend application execution is monitored in real time via Sentry for unauthorized anomaly detection.

4. Non-Custodial Architecture: No Financial Data Storage

FamGateway is an automated software bridge. We do not store credit card numbers, debit card PINs, CVVs, or bank net-banking credentials. 100% of the financial transaction occurs over the secure, encrypted NPCI UPI network directly into your personal account.

5. How We Use Collected Information

We use your information exclusively for the following purposes:

• To generate dynamic UPI QR codes and branded payment links for your customers.
• To verify transaction receipts and dispatch automated JSON webhooks to your designated server endpoint.
• To generate real-time revenue analytics and transaction history in your merchant dashboard.
• To monitor and prevent malicious activity, DDoS attacks, and unauthorized misuse.

6. Information Sharing & Third-Party Disclosure

We do not sell, rent, trade, or share your personal data with third-party advertisers.

Information is only shared under the following limited circumstances:

• Essential Infrastructure: Secure cloud server hosting providers operating under strict confidentiality and encryption agreements.
• Legal & Compliance: If required by applicable Indian Law, court order, or authorized government agencies pursuant to valid legal process.

7. User Control & Data Rights

You maintain complete control over your data on FamGateway:

• Revoke App Passwords: You can disconnect your Gmail or delete your App Password at any time from the Settings dashboard or directly inside your Google Account security center.
• Regenerate API Keys: You can cycle or delete your API credentials with one click if you suspect unauthorized access.
• Account Deletion: You may request complete account deletion and data scrubbing by contacting our support team.

8. Cookies & Session Security

FamGateway uses strict, secure session cookies (configured with HttpOnly, SameSite=Strict, and Secure flags) exclusively to keep you safely logged in. We do not use third-party cross-site advertising cookies.

9. Contact the Privacy Officer

For any privacy inquiries, data deletion requests, or security reports, please reach out to our team:

• Operating Entity: Aryanispe (Founder: Aryan Gupta)
• MSME Registration: UDYAM-BR-28-0050000
• Official Website: https://famgateway.in
• Official WhatsApp Support: Chat on WhatsApp (+91 9771348544)

Back to Homepage →