Privacy policy

Last updated: 20 September 2026

This policy explains what Supayo does with personal information when you visit this website, register an account, or use our recharge, bill payment, mobile banking and API services. It applies to all of those together, which we refer to below as the service.

What we collect

We collect three kinds of information.

Information you give us

• Account details: name, mobile number, email address, and identity information such as NID or trade licence details where required for verification.
• Financial details needed to operate your wallet: deposit references, transaction IDs from mobile banking or bank transfers, and withdrawal instructions.
• Anything you send to support, including messages, screenshots and attachments.

Information created by using the service

• Transaction records: the numbers recharged, amounts, operators, billers, timestamps, status and commission.
• Account activity: logins, device and browser details, IP addresses, and actions taken by you or your sub-accounts.
• API usage: registered server IP addresses, request volumes and error rates.

Information from your device

• Standard technical data such as IP address, browser type, operating system, and pages visited.
• Cookies and similar storage used to keep you signed in and to remember preferences. Blocking these will prevent the dashboard from working correctly.

How we use it

• To deliver transactions. Customer numbers and amounts are passed to the relevant operator or biller in order to complete what you asked for.
• To operate your account. Verification, wallet balance, commission calculation, reporting and support.
• To prevent fraud and abuse. Device logs, IP records and transaction patterns are reviewed to detect account compromise, duplicate registrations and misuse.
• To meet legal and regulatory obligations, including record-keeping requirements that apply to payment and telecom services in Bangladesh.
• To improve the service, using aggregated usage data. We do not need your identity to do this and do not use it for that purpose.
• To contact you about your account, service status, rate changes and support responses. Marketing messages, where sent, can be opted out of.

When we share it

We do not sell personal information. We share it only in these situations:

• Mobile operators, billers and payment providers, to the extent needed to complete a transaction you initiated.
• Service providers who host our infrastructure, send messages on our behalf or provide support tooling, under contracts that limit them to acting on our instructions.
• Regulators, law enforcement or courts, where we are legally required to respond to a valid request.
• A successor entity, if the business is merged, acquired or reorganised. You would be notified before your information became subject to a different policy.

How long we keep it

Transaction records are kept for as long as required by applicable financial and telecom record-keeping rules, and for as long as needed to resolve disputes, which can arise months after a transaction. Account details are kept while your account is open and for a period afterwards for the same reasons. Support conversations are kept for a shorter period. Aggregated data that no longer identifies anyone may be kept indefinitely.

Security

We use encrypted connections, hashed credentials, IP-restricted API keys, transaction PINs, device logging and access controls limiting staff to what their role requires. No system is completely secure, and we do not claim otherwise. You are responsible for keeping your password, transaction PIN and API secrets confidential, and for the actions of sub-accounts you create.

We will never ask you for your password, transaction PIN or an OTP. Anyone who does is not from us, regardless of what number or profile they contact you from.

Your rights

• Access. Ask for a copy of the personal information we hold about you.
• Correction. Ask us to fix anything inaccurate. Most account details can be corrected from your dashboard directly.
• Deletion. Ask us to delete your account and associated personal information. See the data deletion page for how to request this and what we are required to retain.
• Objection. Ask us to stop sending marketing communications at any time.

Requests are handled through the contact details below. We may need to verify your identity before acting, to avoid disclosing your information to someone else.

Children

The service is intended for business use by adults. We do not knowingly collect information from anyone under 18. If you believe a minor has provided us with personal information, contact us and we will remove it.

Changes to this policy

We may update this policy. Material changes will be announced in your dashboard or by email before they take effect, and the date at the top of this page will change. Continuing to use the service after that date means you accept the updated policy.

Contact

Questions about this policy, or requests relating to your information, can be sent to [email protected], by phone on 01733137968, or through WhatsApp. Our address is Dinajpur, Bangladesh.