Privacy Policy
1. Who We Are
RoobaPay Technologies Private Limited ("RoobaPay Technologies", "we", "us", "our") operates corporate.roobapay.com and the following product platforms:
- Yaal AI — voice AI + AI Bot CRM platform (yaalai.com)
- RoobaPay UPI — merchant payment platform (upcoming)
- EDR / XDR — enterprise cybersecurity platform (upcoming)
We act as a Data Fiduciary under the DPDP Act for personal data collected through our websites and, where applicable, as a Data Processor on behalf of our enterprise customers for end-customer data processed through our product platforms (see our Data Processing Agreement).
2. Personal Data We Collect
| Category | Examples | Purpose |
|---|---|---|
| Website visitor data | Name, work email, phone, company, job title (via contact/demo forms) | Responding to enquiries, scheduling demos |
| Account data | Login credentials, billing contact details | Providing and administering the Services |
| Usage data | IP address, device/browser type, pages visited, cookies | Site analytics, security, improving the Services |
| Voice/call data (as Processor) | Call recordings, transcripts, CRM records | Processed strictly on behalf of, and under instructions from, our enterprise customers |
| Payment/merchant data (as Processor) | Merchant KYC records, UPI transaction metadata (RoobaPay UPI, once launched) | Processed under RBI/NPCI-aligned instructions from acquiring/enterprise customers |
We do not knowingly collect more personal data than necessary for the stated purpose ("purpose limitation"), and we do not use pre-ticked consent boxes.
3. How We Collect Data
Directly from you (forms, email, calls with our sales/support team); automatically (cookies and similar technologies — see our Cookie Policy); and, for product usage, from our enterprise customers who are the Data Fiduciary for their own end-customer interactions.
4. Legal Basis & Consent
Where we act as Data Fiduciary, we process personal data on the basis of your consent (e.g., submitting a form) or legitimate uses recognized under the DPDP Act (e.g., responding to a request you initiated). You may withdraw consent at any time by writing to privacy@roobapay.com; withdrawal does not affect processing carried out before withdrawal.
5. How We Use Personal Data
To operate and improve our websites and product platforms; respond to enquiries and provide support; send product updates and marketing communications (opt-out available); comply with legal, regulatory, and contractual obligations (including PMLA, RBI, NPCI, and TRAI-related recordkeeping where applicable); and ensure platform security.
6. Sharing & Sub-processors
We do not sell personal data. We may share personal data with:
- Cloud infrastructure providers — Amazon Web Services (Mumbai region, India) for hosting;
- AI / voice model providers — Sarvam AI, and other named sub-processors, for speech recognition, synthesis, and language processing, under contractual confidentiality and data protection terms;
- Telephony / SIP providers — Twilio, Exotel, and licensed Indian carriers for call routing;
- Payment processors — Razorpay and licensed acquiring banks, for billing (and, in future, for RoobaPay UPI);
- Professional advisors and regulators, where required by law.
A current sub-processor list is available on request at privacy@roobapay.com.
7. Data Localization & Cross-Border Transfer
Personal data collected via our platforms is stored on servers located in India (AWS Mumbai region), consistent with applicable RBI and DPDP data localization requirements. Any cross-border transfer of personal data (e.g., to a sub-processor outside India) will only occur to jurisdictions not restricted by the Central Government under the DPDP Act, and under appropriate contractual safeguards.
8. Data Retention
We retain personal data only for as long as necessary for the purposes described in this Policy, or as required by law (for example, PMLA requires retention of certain KYC/transaction records for 5 years post-relationship, and RBI/TRAI recordkeeping obligations may apply). Website enquiry data not converted to a customer relationship is deleted after 12–24 months of inactivity. Specific retention periods for product/customer data are set out in the Data Processing Agreement with each enterprise customer.
9. Your Rights as a Data Principal
Subject to the DPDP Act, you have the right to: obtain a summary of personal data we hold about you and the processing activities; correct or update inaccurate/incomplete data; request erasure of data no longer necessary for the stated purpose; withdraw consent; and nominate another individual to exercise your rights in case of death or incapacity. To exercise these rights, contact our Grievance Officer below. We aim to respond within 30 days, and in any event within any timeline prescribed by the DPDP Rules.
10. Grievance Officer
In accordance with the DPDP Act, 2023 and the Information Technology Act, 2000, grievances or queries regarding this Policy or your personal data may be addressed to:
Grievance Officer: Jerome Danish J
Email: grievance@roobapay.com
Address: Tamil Nadu, India
Response timeline: We will acknowledge your grievance within 72 hours and resolve it within the timeline prescribed under applicable law.
11. Data Breach Notification
In the event of a personal data breach, we will notify the Data Protection Board of India and affected data principals without delay, in accordance with the DPDP Act and Rules, including the nature of the breach and mitigation steps taken. CERT-In cyber-incident reporting obligations (6-hour rule) will be observed where applicable.
12. Security Measures
We implement technical and organizational measures including AES-256 encryption at rest, TLS 1.3 in transit, role-based access controls, and ISO 27001-aligned / SOC 2-aligned information security practices (implementation in progress), consistent with the IT Act, 2000 and SPDI Rules, 2011.
13. Cookies
See our separate Cookie Policy for details on the cookies and similar technologies used on our websites.
14. Children's Data
Our product platforms and websites are intended for business/enterprise use and are not directed at individuals under 18. We do not knowingly collect personal data from children.
15. Changes to This Policy
We may update this Policy periodically. Material changes will be notified via the website or by email at least 15 days before taking effect.
16. Contact Us
RoobaPay Technologies Private Limited
Email: privacy@roobapay.com
Address: Tamil Nadu, India
CIN: U72900TN2025PTC183888