Privacy Policy

Vexoli is operated by Vexoli (the “operator”, “we”, “us”). Vexoli is a UPI payment gateway for businesses in India: merchants integrate with Vexoli through our API, hosted cashier and payment links, customers pay by UPI, payments are automatically verified, and merchants receive settlements to their bank account or VPA.

For privacy questions, contact us at support@vexoli.theraphael.online. For formal complaints, see the Grievance Redressal section below.

Merchant account and KYC data. When a business opens a merchant account we collect the account holder’s name, email address and phone number, business name and business type, the bank account number / IFSC or VPA nominated for settlements, and know-your-customer (KYC) documents submitted for verification — such as PAN, GSTIN where applicable, and identity / address / business-registration documents for the proprietor, partners or directors. We also store the credentials you configure in the panel, such as webhook endpoints, in encrypted form.

Order and customer data. For each payment order we record the merchant’s order reference, amount, currency, description, status and timestamps, together with the customer details the merchant or the customer provides for that order — typically the customer’s name, email address and phone number. We do not collect or store UPI PINs, bank passwords or card credentials; UPI payments are authorised inside the customer’s own UPI app.

UPI transaction references. To verify and reconcile payments we record transaction references associated with a payment, including the UPI transaction reference / UTR, the payer VPA where it is made available through verification channels, the assigned UPI ID the payment was made to, the verified amount and the verification result.

Device, log and usage data. When you visit our website, cashier or merchant panel we automatically record technical data such as IP address, browser and device type, pages and API endpoints accessed, timestamps, error logs and security events. API calls made with merchant keys are logged against the merchant account that made them.

Support communications. Messages you send us through the contact form, by email, or in a grievance, including the contact details you provide so we can reply.

We use the data above only for the following purposes:

• Creating, operating and securing merchant accounts, including KYC verification before settlements are enabled.
• Creating payment orders, presenting the cashier, and automatically verifying UPI payments against the order amount and references.
• Maintaining the merchant wallet and ledger, calculating fees, and paying settlements to the merchant’s nominated bank account or VPA.
• Sending payment status notifications, webhooks and receipts, and providing the order-tracking and settlement reports merchants rely on for reconciliation.
• Processing merchant-approved refunds back to the customer’s source account and resolving duplicate or wrong-amount payments.
• Preventing fraud, duplicate claims and abuse, investigating disputed or unmatched payments, and keeping audit records.
• Providing support, responding to grievances, and meeting our legal, accounting, tax and regulatory obligations in India.

We do not sell personal data, and we do not use payment data for advertising.

We share personal data only in the following limited circumstances:

• With the merchant you paid. A merchant can see the orders, customer details supplied for those orders, payment status and transaction references for its own transactions — and nothing belonging to any other merchant.
• With service providers. Infrastructure, hosting, communications and verification providers that process data on our behalf under contract, only to the extent needed to run the service, and subject to confidentiality and security obligations.
• For legal obligations. Where disclosure is required by law, a court or regulator in India, or is necessary to establish, exercise or defend a legal claim, prevent fraud, or protect the rights and safety of our users.

We do not share personal data with third parties for their own marketing.

We keep merchant account and KYC records for as long as the account remains open and for the period afterwards that accounting, tax and payments law in India requires us to retain transaction records. Order, ledger, settlement and transaction reference records are retained for the same legally required period so that payments can be reconciled, audited and disputed. Device and security logs are kept for a shorter period proportionate to security monitoring. When data is no longer needed for these purposes it is deleted or anonymised. Data that must be retained by law is kept only for that purpose and is not used for marketing or product purposes.

Data is transmitted over encrypted (TLS) connections. Secrets such as API keys, webhook secrets and settlement credentials are stored encrypted, are never displayed in full after creation, and access to production systems and personal data is restricted to authorised personnel on a need-to-know basis and is logged. Payments are confirmed only through our automatic multi-layer verification — a browser or app callback alone is never treated as proof of payment. No system is completely secure, but we review and update these practices as the service evolves, and we will notify affected merchants of a personal-data breach where the law requires it.

Vexoli uses only strictly-necessary cookies. These are session cookies that keep a merchant signed in to the panel, protect forms and sessions against forgery, and keep the cashier flow working. We do not use advertising, cross-site tracking or third-party analytics cookies on our payment pages or merchant panel. Because these cookies are essential for the service to function and to remain secure, the service cannot operate without them; you can block cookies in your browser, but sign-in and checkout will then not work.

Subject to records we must retain by law, you may ask us to:

• Access the personal data we hold about you and receive a copy of it.
• Correct personal data that is inaccurate or incomplete.
• Delete your personal data, or close your merchant account, where retention is not legally required.
• Withdraw consent where processing is based on consent, without affecting processing already carried out.

To exercise any of these rights, write to support@vexoli.theraphael.online from the email address registered on your account so we can verify your identity. Merchants can also correct most account details directly in the merchant panel. Customers should contact the merchant they paid for order-specific requests such as delivery or a refund decision, and contact us for requests about the payment data we hold. We respond to verified rights requests within 30 days.

If you have a complaint about how your personal data is handled, or about any part of the Vexoli service, you may write to our Grievance Officer at grievance@vexoli.theraphael.online. Please include your registered email address and, where the complaint concerns a specific payment, the Order ID, so we can locate your records.

We acknowledge every grievance within 48 hours of receipt and aim to resolve it within 30 days. If your grievance remains unresolved after 30 days, you may escalate it to the operator, Vexoli, by writing to the same address with “Escalation” in the subject line, and it will be reviewed by the operator directly. You may also use the Grievance Redressal section on our Contact page.

We may update this policy when the service or the law changes. Material changes will be notified to registered merchants by email or in the merchant panel before they take effect, and the current version will always be available on this page with its last-updated date.