Privacy Policy

1. Information We Collect

Account Details: Email address and authentication provider profile identifiers (via Google OAuth or email sign-in).
Invoice Data: Client email addresses, project descriptions, agreed fee amounts, currency selections, and due dates.
Deliverable Files: Watermarked preview assets and master files stored in private storage buckets. Previews are served to clients through short-lived signed URLs only after the deposit is verified; masters are released only after full payment.
Payment Records: Ledger entries for deposit and balance payments received against each invoice.
AI Draft Inputs (only when you enable AI drafts): client name and project title sent to Google AI Studio to generate reminder wording. Amounts, pay links, files, and email addresses are never sent. Drafts are produced for your manual review — nothing is emailed automatically.

2. Payment Information Security

GoPayNag does not store or process complete credit card numbers, debit card numbers, or CVV codes. GoPayNag membership subscriptions are processed by Paddle.com (our Merchant of Record), a PCI-DSS Level 1 certified payment provider. Designer–client invoice payments are processed by Razorpay and settle directly into the designer’s Razorpay account. GoPayNag does not hold, receive, pool, route, or reverse client funds. We retain payment status and provider payment identifiers for reconciliation; we do not collect typed payment references such as UTR or transaction IDs.

3. Row-Level Data Isolation

All database records are protected by database-enforced Row Level Security (RLS). Invoices and files are accessible only to the authenticated designer who created them. Client payment portals are accessible only via unguessable, cryptographically generated UUID tokens. Client views never expose private storage paths; previews are served through short-lived signed URLs after the deposit is verified, and finals remain locked until the invoice is paid in full.

How we handle access: your records are encrypted in transit and at rest, and isolation is enforced by the database — no other designer or client can see them. No human opens your data except to resolve a support request you initiate. Our sub-processors with strictly scoped access are Supabase (database & file storage), Paddle.com (membership subscription billing), and Google AI Studio (reminder text generation, only when you enable AI drafts). We never sell personal information, and data access is logged.

4. Data Retention & Privacy Rights

Under India's Digital Personal Data Protection (DPDP) Act and applicable international privacy frameworks (including GDPR), you retain the right to access, rectify, or request deletion of personal information. California residents additionally hold CCPA/CPRA rights to know what is collected, request deletion, and opt out of any sale or sharing of personal information — we do not sell personal information. To exercise any of these rights, contact [email protected]. Financial ledger records are retained only as long as required for statutory accounting and tax compliance; access is restricted, and records containing personal data are deleted or anonymized when retention is no longer required.

5. Contact Data Protection Officer

Data Controller: GoPayNag
Privacy & Support: [email protected]
Registered Address: Office 314, KP Square, Sr. No. 127/1A, Opp. DoubleTree, Haveli, Pimpri Chinchwad, Pune, Maharashtra 411019, India

Last updated: November 2026