1. Two kinds of people

Merchants hold an account with us, so we hold identity and bank details for them. Customers are people paying a merchant; we see only what is needed to move one payment, and we hold no account for them. The sections below say which is which.

2. What we collect from a merchant

Account

Email address, business name, password (stored only as a hash).

Verification

CNIC number and photographs of the card, business details, and the bank account title and IBAN you want to be paid into.

Activity

Every payment you take, the fee on it, the statements it appears in, webhook deliveries we attempted, and the IP address a sign-in or an administrative change came from. We do not record your browser's user agent.

3. How the sensitive parts are stored

Your CNIC number and your IBAN are encrypted with AES-256-GCM before they reach the database, using a key held outside it. Neither is readable by someone holding a copy of the database alone. To notice the same CNIC or account being submitted twice we store a keyed one-way index alongside the ciphertext rather than the number itself.

Photographs of your CNIC are held in private storage that is not reachable from the web, and are opened only through a short-lived link generated for a specific person at the moment they look. Every such access is recorded.

Your API secret is encrypted at rest and shown to you once, at the moment it is created. We cannot show it to you again, which is deliberate: it means nobody at our end can be talked into reading it out.

4. What we collect from a customer

The mobile number they pay with, the amount, and the outcome. The full number is encrypted at rest; the merchant sees it masked (0300****567) in the dashboard and in exports, because a merchant needs to recognise a payment, not to hold a database of phone numbers. We never see or store a wallet PIN, an OTP or a card number — those are entered with the wallet provider, not with us.

5. What we do with it

Take payments, apply the fee, settle the balance, verify who a merchant is, answer support questions, keep records we are required to keep, and detect fraud and abuse. Nothing else. We do not sell personal information, we do not share it for anyone's advertising, and there is no analytics script, ad pixel or third-party font on any page of this site — the pages load nothing from anywhere but our own server.

6. Who else sees it

Licensed payment processing partners

The regulated institutions that actually move the money receive what they need to move it — the amount, the wallet, the customer's mobile number, a reference. They do not receive your verification documents.

The wallet the customer chooses

JazzCash or EasyPaisa authenticate their own customer and handle their own PINs and one-time codes under their own privacy terms.

Regulators, banks and law enforcement

On a lawful request, and no further than the request reaches.

Suppliers we run on

Hosting and email. They process data on our instructions and for no purpose of their own. The specific suppliers, and whether any of them stores data outside Pakistan, to be listed here.

7. Cookies

One, called pgw_session. It holds a session identifier and nothing else, is not readable by JavaScript, is sent only over HTTPS in production, and is discarded when you close your browser. There are no advertising or analytics cookies, so there is no consent banner to click past.

The same cookie is set on the checkout page, where it carries a customer through a single payment — the error message if a number was mistyped, and the QR code while it is on screen. It is not linked to any account, it is not shared with the merchant, and it holds nothing about the customer once the payment is over.

8. How long we keep it

Payment and settlement records are kept for as long as financial and anti-money-laundering rules require, which is longer than an account lasts — closing an account does not delete the history of money that moved through it. Verification documents are kept for as long as the account is open and for the retention period after that. Exact retention periods, per category, to be confirmed against SBP and FBR requirements.

9. What you can ask for

A copy of what we hold about you, a correction of anything wrong, and deletion of anything we are not required to keep. Most of it you can already see and change in the dashboard. For the rest, write to support@payflow.com. Response time commitment, and how we verify that a request came from the account holder, to be settled.

If you are a customer rather than a merchant and want to know what was held about a payment you made, ask the merchant you paid first — the record is theirs. Write to us if that gets you nowhere.

10. If something goes wrong

If personal information is exposed and it puts anyone at risk, we will tell the affected merchants and the relevant authority. Notification deadline to be confirmed against the applicable Pakistani data protection rules.

11. Changes, and reaching us

Changes to this page are announced to the email address on your account. This policy forms part of the terms of service. Anything at all: support@payflow.com.