Effective date and last updated: 6 October 2026 · Applies to: NxtBanking (a product of Laraware Private Limited), its websites, APIs, dashboards and partner platforms.

1. Who we are

This Privacy Policy explains how Laraware Private Limited ("NxtBanking", "we", "us") collects, uses, shares and protects personal data when you visit our websites, use our APIs, dashboards and apps, or when a business that uses our platform processes your data through us. We act as a data fiduciary for the data we collect directly, and as a data processor for data our business customers (distributors, retailers, white-label partners) collect from their own end users.

NxtBanking is a software and API infrastructure provider. Where a service involves a regulated activity (for example BBPS bill payments, AEPS cash withdrawal, money transfer or prepaid recharge), that activity is carried out by the licensed or authorised entity concerned (such as a Bharat Bill Payment Operating Unit, a sponsor bank, a Payment Aggregator or a payment system operator) under its own licence and rules. NxtBanking does not hold customer funds as a bank, does not issue payment instruments and does not claim any licence or authorisation that it has not been granted.

2. Laws that apply

We handle personal data in line with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, the Digital Personal Data Protection Act, 2023 and rules made under it as they come into force, the Prevention of Money Laundering Act, 2002, the Aadhaar Act, 2016 and applicable RBI and NPCI directions for payment services.

3. Information we collect

Account and business information

Name, mobile number, email, business or shop name, address, PIN code.
PAN, GSTIN, business registration documents and bank account details for onboarding.
Photograph, address proof and other KYC documents required by law.

Transaction information

Transaction reference, amount, date and time, biller or operator, service type, status and refund status.
For AEPS: bank name, masked Aadhaar reference and transaction outcome. See section 4 on Aadhaar.
For BBPS: biller category, customer identifier used to fetch a bill (for example consumer number), bill amount and payment channel.
For recharge: mobile or DTH number, operator, circle and plan.

Technical information

IP address, device type and identifiers, browser, operating system, approximate location, pages visited, API logs and error logs.
Cookies and similar technologies. See our Cookie Policy.

Communications

Support tickets, call recordings where permitted, emails and chat messages, and form submissions.

4. Aadhaar, biometric and sensitive data

We do not store Aadhaar numbers in clear form, biometric templates, fingerprints, iris scans or PINs. Biometric data captured through a registered device is encrypted at the device and passed to the bank or NPCI as required to complete the transaction.
Where an Aadhaar number must be referenced, only the masked form (last four digits) is retained, as permitted by UIDAI.
Card numbers, CVV, UPI PIN and net-banking passwords are never collected or stored by us.
Sensitive personal data is collected only with your consent or where the law requires it, and only for the purpose stated at collection.

5. Why we use your information

To create and verify your account, perform KYC and risk checks, and meet anti-money-laundering obligations.
To carry out the transactions you request and to reconcile, settle and refund them.
To detect, prevent and investigate fraud, misuse and security incidents.
To provide customer support and resolve complaints.
To send service, billing, security and regulatory notices.
To improve our products, measure performance and develop new features, using aggregated or de-identified data where possible.
To comply with legal, regulatory, tax, audit and law-enforcement requirements.
To send marketing messages, only where you have agreed. You can withdraw at any time.

We process personal data on the basis of your consent, to perform a contract with you, to comply with a legal obligation, and for legitimate uses recognised by the DPDP Act, 2023 such as preventing fraud and ensuring security. Consent is free, specific, informed and can be withdrawn as easily as it was given. Withdrawal does not affect processing already done, and may limit the services we can offer.

We do not sell personal data. We share it only with:

Banks, NPCI, BBPS operating units, billers, telecom operators and sponsor banks, as needed to complete a transaction.
KYC, identity and verification providers (for example PAN, bank account, UPI and GST verification services) acting on our instructions.
Service providers such as cloud hosting, SMS and email delivery, analytics, fraud-scoring and support tools, bound by confidentiality and data protection terms.
Our business customers, for transactions made through their platform.
Regulators, courts and law-enforcement agencies, where required by law or to protect rights and safety.
A successor entity, in a merger, acquisition or restructuring, subject to this policy.

Where data is processed outside India, it is only on lawful terms and with safeguards equal to those required by Indian law.

8. How long we keep data

Data	Retention
Transaction records	At least 5 years from the transaction, or longer if the law or a regulator requires
KYC and onboarding records	At least 5 years after the business relationship ends (PMLA)
API and security logs	12 months, unless needed for an investigation
Support tickets and call records	3 years
Marketing preferences	Until you withdraw consent
Website analytics	Up to 26 months, in aggregated form

After the retention period, data is deleted or irreversibly anonymised. Data under legal hold is kept until the hold ends.

9. How we protect data

Encryption in transit (TLS 1.2 or higher) and encryption of sensitive data at rest.
Role-based access, multi-factor authentication for staff and admin accounts, and audit logs.
Network segregation, web application firewall and regular vulnerability scanning and penetration testing.
Background checks and confidentiality undertakings for staff with access to personal data.
An incident response process. Where a personal data breach occurs, we notify affected users and the Data Protection Board of India and CERT-In as the law requires, within the prescribed time.

Details are in our Data Protection and Information Security Policy.

10. Your rights

Subject to law, you may:

Access a summary of the personal data we hold about you and who we shared it with.
Correct or update inaccurate or incomplete data.
Erase data that is no longer needed, except where we must retain it by law.
Withdraw consent for any optional processing, including marketing.
Raise a grievance and have it resolved within the time stated below.
Nominate another person to exercise these rights on your behalf in case of death or incapacity.

Write to legalteam@laraware.com from your registered email or mobile number. We may ask you to verify your identity first. We acknowledge requests within 48 hours and aim to resolve them within 30 days.

11. Children

Our services are for persons aged 18 and above. We do not knowingly collect personal data of children. If you believe a child's data has been provided to us, contact us and we will delete it.

12. Cookies

We use cookies for essential site functions, security, analytics and, with consent, marketing. See the Cookie Policy for details and how to manage them.

13. Third-party links

Our sites may link to third-party sites such as billers, banks or social networks. Their privacy practices are their own, and we recommend reading their policies.

14. Changes to this policy

We may update this policy to reflect changes in law or our services. The latest version, with its effective date, is always on this page. For material changes we will give notice by email or in the dashboard.

15. Grievance Officer and contact

If you have a concern about how your personal data is handled, write to the Grievance Officer, Laraware Private Limited, B-2/64, Vibhutikhand, Gomtinagar, Lucknow, Uttar Pradesh 226010, India, email legalteam@laraware.com. We acknowledge within 48 hours and resolve within 30 days. If you are not satisfied you may approach the Data Protection Board of India once it is operational, or the relevant authority under applicable law.

Contact us

Purpose	Contact
General and customer support	support@laraware.com
Refund and failed transaction queries	refunds@laraware.com
Legal, compliance and grievance escalation	legalteam@laraware.com
Phone	0731-4621515
Registered and correspondence address	Laraware Private Limited, B-2/64, Vibhutikhand, Gomtinagar, Lucknow, Uttar Pradesh 226010, India