1. Overview & Commitment
At GbkPay ("we", "our", or "us", operating via gbkpay.org), we take privacy and cryptographic confidentiality with the utmost seriousness. This Privacy Policy outlines how merchant, business, and transaction metadata is collected, secured, and utilized across our payment gateway aggregator infrastructure, Android background listener applications, and REST APIs.
2. Information We Collect
To deliver real-time automated payment verification and partner settlement services, we collect:
- Account Information: Business legal name, contact email address, phone numbers, and verified merchant KYC credentials.
- Transaction Metadata: Carrier transaction IDs (TrxID), amounts, payment channel type (e.g. bKash, Nagad, Rocket, Upay), timestamps, and webhook settlement statuses.
- Listener Telemetry: SIM network status, battery level, signal quality, and sync ping status from authorized GbkPay Connect Android listener devices.
3. Android Listener App Data Handling
The GbkPay Connect Android Listener is engineered with strict privacy boundaries:
- It monitors ONLY incoming SMS messages originating from verified carrier sender IDs (e.g.
bKash,16216,Nagad). - Personal text messages, contacts, call logs, media files, and photos are strictly ignored and never read, parsed, or transmitted.
- All extracted TrxID tokens are immediately hashed and transmitted over TLS 1.3 encrypted HTTPS channels.
4. Data Retention & Cryptographic Security
All financial records and webhook dispatch logs are retained in compliance with regional financial compliance regulations. All data at rest is encrypted using AES-256 standards, and all API communications require mutual authentication or HMAC-SHA256 signatures.
5. Merchant Rights & Inquiries
Merchants have the right to request export of their processed transaction logs, rectify account details, or request account deactivation. For any privacy queries or security audits, contact our Data Security Desk at support@gbkpay.org.