Privacy Policy

Who we are

ZLIPR PRIVATE LIMITED (CIN U62099KA2026PTC215805), a company registered in India with its registered office at E2, B2 Samhita Square Apartment, Basavanagar Main Road, Marathahalli Colony, Bangalore, Karnataka 560037. In this policy we call it “ZlipR”, “we” or “us”.

For the purposes of the Digital Personal Data Protection Act, 2023, ZlipR is the Data Fiduciary for the data described below, and you are the Data Principal.

What this policy covers

The ZlipR mobile app and the ZlipR web app at app.zlipr.com, in both their shopper mode and their retailer or business mode.

What we collect

What you give us

• Your mobile number. This is how you sign in. We send a one-time password to it and use it to identify your account. Sign-in is handled by Amazon Cognito on our behalf.
• Your profile. Display name, gender, and year of birth. Year of birth is used to confirm you are old enough to use ZlipR and to decide which offers are relevant to you.
• Your UPI ID, if you choose to withdraw cashback. We send it to our payments partner to confirm the name registered against it before a payout, so money does not go to a mistyped ID.
• Store details, if you use ZlipR as a retailer or business: store name, address, area, city, state, PIN code, store location, and a store logo image you choose from your photo library.

What your device gives us

• Location, only while the app is open and only if you allow it. We use it to show offers and stores near you. ZlipR does not track your location in the background.
• Camera, only while a scanner screen is open. The camera reads the QR code or barcode on screen. For bill scanning, only the decoded text of the QR code is sent to us — the photo of your bill is not uploaded or stored.
• Photo library, only for the image you pick when setting a store logo.
• Notification token and basic device details — the push token, your platform (Android or iOS), device name and app version. These are needed to deliver notifications to the right device and to know which app version a problem came from.

What using ZlipR creates

• Offers you save, use, or let expire.
• Bills you scan, and the cashback worked out from them.
• Your cashback balance, withdrawal requests, and transaction history.
• Stores you connect to, and orders or carts if you use in-store buy mode.

What we do not collect

• Your contacts. The app never reads your address book.
• Bank account numbers, debit or credit card details, PAN or Aadhaar. Withdrawals need only a UPI ID.
• Photographs of your bills. Bill scanning sends the QR code’s text, not an image.
• A password. Sign-in is by one-time password to your mobile number.

Why we use it

• To run your account — sign you in, keep you signed in, and show you your own data.
• To give you cashback — match a scanned bill to an offer, calculate what you have earned, credit your wallet, and pay it out to your UPI ID.
• To show you relevant offers — based on where you are, which stores you use, and which offers you have saved.
• To send you notifications you have agreed to, such as cashback credited or an offer about to expire.
• To prevent fraud — detect duplicate bills, fake scans, and multiple accounts, so genuine users are not cheated out of a limited offer.
• To support you — answer your questions and investigate anything that goes wrong.
• To meet legal and accounting obligations.

We do not sell your personal data. We do not run third-party advertising networks inside the app.

Consent, and taking it back

We ask for your consent when you sign up, and separately for location and for notifications when those features are first used. You can withdraw consent at any time — turn the permission off in your device settings, or ask us to delete your account. Withdrawing consent does not undo anything we did while it was valid, and some parts of ZlipR stop working without it: without location we cannot show nearby stores, and without an account there is no wallet.

Who we share it with

• Amazon Web Services, which hosts ZlipR — sign-in, databases, notification delivery, and file storage. AWS processes this data for us and cannot use it for its own purposes.
• Our payments partner, when you withdraw cashback. They receive your UPI ID and the amount, so the transfer can be made.
• Retailers and brands, in aggregate. A retailer can see that a bill was redeemed against their offer and the value of it. They do not receive your mobile number, your profile, or your other shopping history from us.
• Authorities or advisers, where the law requires it, or to establish or defend a legal claim.

Where it is stored, and for how long

Your data is stored on Amazon Web Services infrastructure. We keep it for as long as your account is open. When your account is deleted, your profile and the data attached to it are removed, except for limited records we are required to retain for fraud prevention, accounting, dispute handling, or other legal compliance — those are kept only for as long as that obligation lasts.

Your rights

Under the Digital Personal Data Protection Act, 2023 you can:

• Access a summary of the personal data we hold about you and who we have shared it with.
• Correct or complete anything inaccurate — most of it you can edit yourself in the app under Profile.
• Erase your personal data, by deleting your account.
• Nominate another person to exercise these rights if you die or become incapacitated.
• Complain to us, and if we do not resolve it, to the Data Protection Board of India.

Write to us using the contact below and we will respond within the time the law allows. We may ask you to confirm the mobile number registered to the account before we act on a request.

Turning permissions off

Location, camera, photo library and notification permissions can all be turned off at any time in your phone’s settings, under the ZlipR app. The app keeps working with them off; the features that depend on them do not.

Deleting your account

You can ask us to delete your ZlipR account and the data attached to it at any time. Withdraw any remaining cashback first — deleting the account closes the wallet.

How to delete your account

Children

ZlipR is not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has created an account, contact us and we will delete it.

Security

Data is encrypted in transit. Access to production systems is restricted to the people who need it. Sign-in uses a one-time password rather than a stored password. No system is perfectly secure, but if a breach affects your data we will notify you and the Data Protection Board as the law requires.

Changes to this policy

When we change this policy we update the date at the top of this page. If a change materially affects how we use your data we will tell you in the app before it takes effect.

Contact us

Questions, requests, or complaints about your data go to our Grievance Officer:

Read our Terms of Use.