Privacy Policy
Effective Date: October 14, 2026 • Last Updated: October 14, 2026 • App Version: 8.1
1 Introduction & Overview
Welcome to Zyx Pay (“we”, “our”, or “us”). We operate the digital payment gateway platform available at https://zyxpay.cyou and the companion Android synchronization application Zyx Pay (Package Name: com.zyxpay.gateway).
This Privacy Policy explains how our website and Android mobile application collect, use, process, and safeguard information when merchants and users interact with our automated payment verification services.
2 Android App Sensitive Permissions & Justifications
In accordance with Google Play Developer Program Policies, our companion mobile application explicitly requests only permissions that are strictly necessary to perform its core functionality as an automated Mobile Financial Service (MFS) transaction matching utility. Below is a detailed disclosure of every permission requested:
Purpose: The application automatically listens for transaction confirmation messages sent by authorized mobile financial service (MFS) provider numbers:
- bKash: Sender
16247orbKash - Nagad: Sender
16167orNAGAD - Rocket: Sender
16216or16216 - Upay: Sender
16268orupay
Data Extracted: The app only parses the Transaction ID (TrxID), Sender Phone Number, and the Amount.
Strict Privacy Guarantee: The app completely ignores and discards personal text messages, bank OTPs, two-factor authentication codes, and conversations with contacts. No personal communications are ever recorded, viewed, or transmitted.
Purpose: Used exclusively on-demand when the merchant taps the Scan QR button inside the app to pair the phone with their merchant account dashboard (/dashboard/devices).
The camera stream is processed locally in real-time to decode the QR text token. No photographs, videos, or camera data are ever stored on the device or uploaded to our servers.
Purpose: Allows the application to keep a reliable background synchronization service running so that customer transactions can be verified instantly even when the app is in the background or the screen is turned off.
A persistent notification is always displayed in the Android system notification tray informing the user that the synchronization service is actively running.
Purpose: Enables encrypted HTTPS/TLS communication with the official backend API at https://zyxpay.cyou/api to transmit verified payment confirmation hashes.
Purpose: Notifies merchants when a transaction matches successfully or if device connectivity is interrupted. After device restart, the background receiver ensures transaction matching resumes seamlessly without manual launch.
3 Information We Collect on the Web Platform
When merchants register or customers make payments on our platform, we collect:
- Merchant Profile: Full name, business title, email address, hashed passwords, and webhook URLs.
- Payment Numbers: bKash, Nagad, Rocket, or Upay phone numbers added by the merchant to receive customer funds directly.
- Transaction Records: Order ID, transaction code, paid amount, payment method, customer email/phone (if provided by checkout), and timestamp.
- Technical Logs: Server access logs, IP addresses, and browser user-agent strings for fraud prevention, rate limiting, and security auditing.
4 How We Use Information
Collected information is used strictly for the following purposes:
- To match incoming customer payment confirmation SMS with pending web orders in real-time.
- To send instant webhook notifications to the merchant’s website or e-commerce store upon payment completion.
- To generate financial reports, audit trails, and hosted invoice checkout links.
- To manage merchant package subscriptions, renewals, and device connection limits.
- To prevent fraudulent transactions, spam, and unauthorized API exploitation.
5 Third-Party Sharing & Disclosure Policy
We DO NOT sell, rent, lease, or monetize your personal or business data to any third parties, advertisers, or marketing agencies.
Data is only transmitted:
- Between your paired Android device and your authenticated merchant account on our secure web server.
- To your configured webhook endpoints when a transaction is completed.
- When required by law, subpoena, or lawful court order from competent law enforcement authorities.
6 Data Security & Encryption
We employ robust technical and organizational measures to protect your data against unauthorized access, loss, or alteration:
- All communication is enforced over HTTPS (TLS 1.3) encryption.
- Passwords are irreversibly hashed using standard BCrypt with random salts.
- API and device keys use cryptographically secure pseudo-random tokens.
- Database queries utilize parameterized prepared statements to eliminate SQL injection vulnerabilities.
7 Data Retention & Account Deletion (Google Play Compliance)
We retain merchant transaction logs and device pairings only for as long as the merchant maintains an active account for reconciliation and audit purposes.
Merchants may request full deletion of their account, connected Android devices, payment numbers, and associated transaction logs at any time by:
- Submitting a ticket from the Support Contact Page, OR
- Sending an email directly to support@zyxpay.com with the subject line “Account Deletion Request” from your registered merchant email address.
Upon verification, your account, devices, API tokens, and private data will be permanently wiped from our databases within 7 business days.
8 Children’s Privacy
Our services and applications are exclusively intended for commercial business merchants aged 18 and older. We do not knowingly solicit or collect personal information from children under the age of 13 (or under 16 in certain jurisdictions). If we discover that a minor has registered an account, we will immediately take steps to remove the account and purge all associated data.
9 Modifications to this Privacy Policy
We may update our Privacy Policy periodically to reflect changes in our service features, regulatory frameworks, or Google Play policy compliance. The latest revision date will always be indicated at the top of this page. Significant changes will be announced on our official Telegram channel and platform notice banners.
10 Contact Information & Support
If you have questions, feedback, or concerns regarding this Privacy Policy or our data handling practices, please contact our team through any of our official channels: