Security and privacy

UPINOW is a payment confirmation tool: money never passes through it. This page explains what that means for your money, your mailbox and your account data.

Your money never touches UPINOW

Every payment goes directly from your customer's UPI app to your own bank account. UPINOW never holds, moves or has access to your money; it only reads your bank's payment alert email afterwards to confirm who paid for which order.

What we read from your Gmail

UPINOW reads payment alert emails from the senders you approve (your bank, or a UPI app such as PhonePe or Paytm), searched by sender and time. It never reads anything else in your inbox. Every alert must pass DKIM for its sender and be addressed to your connected Gmail or one of your extra alert emails, or it is never counted as a payment. Your Gmail App Password is encrypted with AES-256-GCM before it is stored, and it is deleted right away if you disconnect your mailbox.

API keys and webhooks

API keys are stored only as a hash; the full key is shown to you once, when it is created, and never again. Webhook payloads are signed with your webhook secret, so your server can verify a payment notification really came from UPINOW.

Signing in and roles

You sign in with your email and password, or with Google. UPINOW's roles (owner, admin, member) already control who can do what inside a business: the owner and admins can change business and payment account settings and manage API keys; any member can view the dashboard; only the owner can export data or delete the account. There is no way yet to invite anyone else into your business, so today you are always its only member, and always the owner. Notifications and profile settings are always your own.

How long we keep your data

How long your orders and payment history stay in UPINOW depends on your plan: 30 days on Free, 12 months on Dukaan and Business, and 24 months on Pro and Custom. If a paid plan ends, its longer window still applies for the next 12 months.

Deleting your account

Deleting your account from Danger zone stops Gmail scanning and expires any open payment links right away. You have 7 days to change your mind by signing in again; after that, everything is deleted for good except invoices, which are kept as tax records.

UPINOW will never ask for your UPI PIN, OTP or bank password.

UPI is a registered trademark of NPCI. UPINOW is an independent payment confirmation tool and is not affiliated with NPCI, BHIM or any bank. Payments go directly from your customer's UPI app to your own bank account.

Read more: Security, Privacy policy, Terms of service and Refund policy.