Privacy Policy

This Privacy Policy explains how 1NR, operated by 1NR ("we", "us", "our"), collects, uses, shares, stores and protects your personal data when you use our website, our Android application and the related digital-payment services we provide (collectively, the "Services").

The Services are intended for our registered business partners — retailers, distributors and their authorised team members — who use them to serve their customers with recharge, bill payment, Aadhaar-enabled payment (AePS), money transfer, wallet and reporting features. By creating an account or using the Services, you agree to this Policy. We handle personal data in accordance with India's Digital Personal Data Protection Act, 2023 (DPDP) and other applicable laws, and — for Aadhaar-based services — the regulations of the UIDAI and NPCI.

1. Information we collect

Depending on how you use the Services, we collect the following categories of personal data:

• Identity data — full name, date of birth, gender and photograph.
• Contact data — mobile number, email address and postal/business address.
• Business & KYC data — PAN, Aadhaar reference (see Section 2), business/GST registration where applicable, and the documents you upload to complete KYC.
• Transaction data — the services you perform, amounts, beneficiary details you enter (e.g. a mobile number, biller id or bank account for a transfer), wallet balances, commissions and the status of each transaction.
• Customer-of-customer data — where you carry out a service for an end customer (for example an AePS withdrawal or a money transfer), you provide us limited data about that person to complete the transaction. You are responsible for having their consent to share it.
• Device & technical data — IP address, device model, operating system, app version, a device fingerprint used to secure your session, and diagnostic/log data.
• Approximate location — coarse or fine location where you grant permission, used for fraud prevention and for services that require it.
• Communications — messages, complaints and tickets you raise with our support team.

2. Aadhaar & biometric information (AePS)

Aadhaar-enabled Payment System (AePS) services require a fingerprint scan to authenticate a customer. This is handled with care:

• Fingerprints are captured only through a UIDAI-certified Registered Device (RD). The device encrypts the biometric into a secure, single-use "PID block".
• The encrypted PID is transmitted for authentication to the UIDAI / NPCI through our authorised banking partner. We never store your or your customer's raw fingerprint, PID block or full 12-digit Aadhaar number, and biometric data is never written to our logs.
• After eKYC we retain only an Aadhaar reference (such as a masked value or the last four digits) as permitted by law — not the full number.
• AePS is used strictly to provide the service the customer requests, with their consent, and never for any other purpose.

3. How we use your information

• To provide the Services and to process and settle the transactions you initiate.
• To verify your identity and meet KYC, AML and other obligations under RBI, UIDAI, NPCI and DPDP rules.
• To secure your account — device binding, "verify it's you" re-authentication, MPIN checks and fraud detection.
• To calculate commissions, generate statements and provide reports.
• To provide customer support and resolve disputes and complaints.
• To send you service, security and transaction notifications.
• To maintain, protect and improve the Services using aggregated, non-identifying analytics.

4. Legal bases for processing

We process personal data on the basis of your consent, the performance of the contract under which we provide the Services to you, our compliance with legal and regulatory obligations, and our legitimate interest in keeping the Services secure and preventing fraud. You may withdraw consent as described in Section 9; withdrawing consent may mean we can no longer provide some or all of the Services.

5. How we share information

We share personal data only as needed to run the Services, and never sell it. Recipients include:

• Authorised service providers — the regulated recharge, bill-payment, banking and AePS providers we route transactions through to fulfil your request.
• Banks & payment networks — including the UIDAI and NPCI for Aadhaar-based and inter-bank transactions.
• Infrastructure providers — hosting, communications (SMS/email) and security vendors that operate under contract and confidentiality obligations.
• Professional advisors — auditors, lawyers and accountants, where necessary.
• Regulators & law enforcement — where we are required to disclose by law, court order or a valid regulatory request.
• Successors — in connection with a merger, acquisition or reorganisation, subject to this Policy.

We do not sell your personal data and do not share it with third parties for their own advertising.

6. App permissions

The app requests device permissions only for specific features, and only when needed:

• Camera — to scan a UPI/QR code.
• Photos / storage — to upload a QR image or KYC documents, and to save receipts you download.
• Location — for fraud prevention and services that require it.
• Notifications — for transaction and security alerts.

You can review or revoke these at any time in your device settings; some features may then stop working.

7. Cookies

We use first-party cookies that are strictly necessary to operate the Services (sign-in sessions, CSRF protection, remember-me and interface preferences). We do not run third-party advertising or cross-site tracking cookies.

8. How we protect your data

Passwords and MPINs are stored only as salted one-way hashes — we never see the plaintext. Sensitive values such as OTPs and API credentials are encrypted (AES-256-GCM). All traffic is served over TLS/HTTPS. Sessions are bound to your device fingerprint and user-agent, repeated bad-MPIN attempts trigger automatic lock-outs, and access to systems is restricted and logged. No method of transmission or storage is completely secure, but we work to protect your data using measures appropriate to its sensitivity.

9. Data retention

We keep personal data only as long as needed for the purposes above or as required by law. Transaction records are retained for the period mandated by RBI (currently up to 10 years from the transaction date); KYC records are retained for the period required after account closure; and audit and security logs are retained for as long as needed for compliance and fraud prevention. When data is no longer required, we delete or anonymise it.

10. Your rights

Subject to applicable law, you may:

• Access — request a copy of the personal data we hold about you.
• Correct — ask us to correct inaccurate or incomplete data.
• Erase — request deletion, subject to our legal and regulatory retention duties.
• Withdraw consent — for processing that relies on your consent.
• Nominate — nominate another individual to exercise your rights in the event of death or incapacity.
• Grievance redressal — raise a complaint with our Grievance Officer (Section 14).

11. Children

The Services are for business use by adults and are not directed at children. We do not knowingly create partner accounts for, or knowingly collect personal data from, anyone under 18. If you believe a minor has provided us data, contact us and we will delete it.

12. Third-party links & services

The Services may link to or route you to third-party sites and apps (for example a bank page or a UPI app). Their privacy practices are governed by their own policies, and we are not responsible for them. Please review those policies before providing your data.

13. Where your data is processed

Your data is processed and stored on servers located in India. Where any processing occurs outside India, we take steps to ensure it receives protection consistent with this Policy and applicable law.

14. Grievance Officer & contact

For any privacy question, request to exercise your rights, or complaint, contact our Grievance Officer at contact@workingninjas.in, or through our contact form. We will acknowledge and address your request within the timelines required by law.

15. Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the "Last updated" date above and, where changes are material, provide a more prominent notice. Your continued use of the Services after an update means you accept the revised Policy.