Legal

Privacy Policy

Effective 8 July 2026

The short version

We collect the minimum a payments product needs: your phone number, your payment records, and (for vendors) bank details for settlement. Your payment signing key never leaves your device. We don't sell data, we don't run ads, and you can ask for a copy or deletion of your data at any time. This policy follows India's Digital Personal Data Protection Act, 2023.

1. What we collect

  • Identity: your mobile number, your role (attendee / vendor / organizer), and a vendor's stall name. Phone ownership may be verified via an OTP.
  • Payment security keys: your device generates a cryptographic keypair. Only the public key is sent to us; the private key that signs payments is stored in your device's secure storage and never transmitted.
  • Transactions: amount, vendor, event, timestamps, and settlement status for each payment — the record both you and the vendor rely on.
  • Funding: the status and cap of your UPI Autopay mandate, and payment-processor references. We never see or store your UPI PIN or bank password.
  • Vendor settlement details: beneficiary name, IFSC, and bank account number, used solely to route settlements. Account numbers are never displayed back in full anywhere.
  • Waitlist and survey responses: what you submit on this site (email, answers), used only to contact you about Surge.
  • Device basics: a push-notification token if you enable notifications. We do not collect your location, contacts, or browsing history.

2. Why we collect it

  • To execute and settle the payments you make, and to prevent double-spends, replay attacks, and fraud.
  • To meet legal and regulatory obligations that apply to payments in India, including our payment partner's KYC requirements for vendors.
  • To notify you about orders and payment outcomes.
  • To contact waitlist signups about launch and pilots.

We do not use your data for advertising, and we do not sell or rent it to anyone — full stop.

3. Who processes it

Your data is handled by a small set of processors, each for a specific job:

  • Razorpay (RBI-authorised payment aggregator) — executes mandates, debits, and vendor settlements; receives the data those require.
  • MongoDB Atlas — our database, storing the records described above.
  • Google Firebase — phone-number verification and push notifications.
  • Railway / Vercel — hosting for our server and this website.

Data may be processed on infrastructure outside India by these providers, consistent with the DPDP Act. We share data with authorities only when legally required to.

4. How we protect it

  • Every payment is signed with ed25519 cryptography on your device; the server verifies signatures and rejects any reuse (replay/double-spend protection).
  • All traffic is encrypted in transit (TLS). Webhooks from our payment partner are signature-verified.
  • Vendor bank account numbers are masked in every interface (last 4 digits only).
  • Access to production data is limited to the operator.

5. How long we keep it

Transaction and settlement records are retained as long as required for financial record-keeping and dispute resolution under Indian law. Waitlist data is kept until launch outreach completes or you ask us to remove it. If you stop using Surge and ask us to erase your data, we delete or anonymise everything not legally required to be retained.

6. Your rights (DPDP Act, 2023)

  • Access: ask what personal data we hold about you and get a copy.
  • Correction: have inaccurate or incomplete data corrected.
  • Erasure: ask us to delete your data, subject to legal retention duties.
  • Grievance: complain and get a response within the timelines below.
  • Nomination: nominate someone to exercise these rights on your behalf.

To exercise any of these, email hello@trysurge.in from your registered contact. We acknowledge within 2 business days and resolve within 15 days. If you are unsatisfied with our response, you may escalate to the Data Protection Board of India.

7. Grievance contact

Grievance officer: Aditya Singh (Surge), hello@trysurge.in, +91 6282779318, Pune, Maharashtra 411021, India. Support hours: 10:00–18:00 IST, Monday to Saturday. Also see Contact.

8. Children

Surge is for users 18 and older. We do not knowingly collect data from anyone under 18; if you believe we have, tell us and we will delete it.

9. Changes

If this policy changes materially, we'll notify you in the app or via your registered contact and update the effective date above.