Data deletion request

Last updated: 19 September 2026

You can ask us to delete your Supayo account and the personal information associated with it at any time. This page explains exactly how, and is honest about the records we are not permitted to delete.

How to request deletion

Send a request from the email address or mobile number registered on the account, so we can verify it is really you. Use whichever is easiest:

• Email: [email protected] with the subject "Data deletion request".
• WhatsApp: message support from your registered number.
• Phone: 01733137968.

Include your registered name and mobile number. Do not include your password, transaction PIN or any OTP — we will never ask for these, and a request containing them will be handled but the credentials treated as compromised.

Before you request

Deletion is permanent and cannot be undone. Take care of these first:

• Withdraw your wallet balance. We cannot process a withdrawal to a deleted account.
• Let in-flight transactions settle. Anything still processing or pending must reach a final state.
• Export any reports you need. Download your transaction history first; you will not be able to retrieve it afterwards.
• Revoke API keys and tell anyone integrating with them. Deletion stops all API access immediately.
• Close sub-accounts. Accounts you created for staff are deleted with yours.

What gets deleted

• Your profile: name, email address, mobile number and verification documents.
• Your login credentials, transaction PIN and all API keys and secrets.
• Saved preferences, saved customer numbers and device records.
• Support conversations, once any open matter is closed.
• Sub-accounts created under your account, and their profiles.

What we are required to keep

Financial and telecom transaction records are subject to record-keeping obligations under Bangladeshi law, and are also needed to resolve disputes raised by operators, billers or other parties after the fact. We therefore retain transaction records for the period the applicable rules require, even after an account is deleted.

These retained records are minimised to what the obligation requires — transaction identifiers, amounts, timestamps, operator references and status. They are separated from your profile and are not used to contact you, to build a profile, or for any commercial purpose. Once the retention period ends, they are deleted or irreversibly anonymised.

We may also retain information where necessary to resolve an active dispute, to enforce our terms, or to comply with a legal order.

Timeframe

• Acknowledgement: within one working day of a verified request.
• Account closure: immediately once balance and in-flight transactions are settled.
• Deletion of personal data: within 30 days of closure.
• Backup systems: residual copies in encrypted backups are removed as those backups rotate out, normally within a further 90 days.

For the wider picture on what we collect and why, see the privacy policy.