1. Introduction & Scope
Toripe Technologies Ltd. (“Toripe”, “we”, “our”, or “us”) is committed to safeguarding the privacy and data security of our merchants, developers, and platform users. This Privacy Policy details the types of information we collect, how it is processed and protected, and your rights regarding your personal and business data.
This Policy applies to all interactions with Toripe, including our website at toripe.com, our merchant dashboard, our public APIs, the Toripe Android Gateway SIM Listener Application, and our official plugins for WooCommerce, Shopify, and custom frameworks.
2. Information We Collect
We collect only the minimum necessary information required to operate automated payment verification and maintain platform security:
Business name, merchant full name, email address, phone number, physical billing address, company website, and VAT/Trade license registration details provided during signup.
Order identifier, transaction amount, currency, MFS provider (e.g. bKash, Nagad, Rocket, Upay), customer sender phone number (masked), Transaction ID (TrxID), payment timestamps, and merchant webhook endpoint delivery logs.
Device model, Android OS version, battery percentage, active SIM card slots, cellular network provider, WebSocket heartbeat status, and background listener health metrics.
3. SMS Listener App & Android Permissions
The Toripe Android Gateway App operates with Android RECEIVE_SMS and READ_SMS permissions strictly to automate merchant payment matching.
4. How We Use Your Information
We use collected information solely for legitimate business operations and service execution:
- Transaction Matching & Webhook Triggers: Verifying customer payment submissions against inbound SMS receipts to trigger instant order confirmation callbacks on your WooCommerce, Shopify, or custom website.
- Double-Spend & Fraud Prevention: Ensuring the same Transaction ID (TrxID) cannot be submitted twice across different orders or merchant stores.
- Device Uptime Monitoring: Notifying merchants via email or Telegram when their Android SIM listener device loses internet connectivity or battery drops below operational levels.
- Platform Security & Audit Trails: Maintaining cryptographically signed access logs for merchant dashboard logins, API key creations, and sensitive permission changes.
5. Non-Custodial Financial Architecture
Toripe adheres to a strict non-custodial software philosophy. We do not store, process, or transmit sensitive cardholder data (such as 16-digit credit card PANs, CVVs, or PINs) on our systems. All card processing is handled via tokenized sessions through licensed Tier-1 payment partners.
For MFS payments (bKash, Nagad, etc.), funds move directly from the buyer's account to the seller's account. Toripe does not have access to merchant PINs, OTP codes, or withdrawal rights.
7. Security & Encryption Standards
Toripe employs enterprise-grade defense-in-depth security architectures to protect all stored and inflight information:
- End-to-End Transit Encryption: All communications between merchant browsers, Android gateway devices, and Toripe APIs are strictly enforced over TLS 1.3 with HSTS headers.
- Encryption at Rest: Merchant database clusters utilize AES-256 hardware-level volume encryption with regular rotated keys.
- Cryptographic API Hashing: Merchant API secrets and webhook verification signatures are stored using salted cryptographic hashes (Argon2 / SHA-256).
8. Data Retention & Automatic Log Pruning
We retain transaction metadata only for as long as necessary to provide reconciliation, support, and tax audit compliance:
- Raw Webhook & SMS Logs: Automatically sanitized and permanently purged from server memory after 30 days.
- Aggregated Analytics & Order Summaries: Retained for the duration of the active merchant account to power dashboard reporting.
- Account Deletion: Upon merchant request or account termination, all API keys, device credentials, and webhook endpoints are wiped within 14 calendar days.
9. Your Data Rights & Privacy Controls
Merchants and registered users possess comprehensive control over their personal and platform data:
privacy@toripe.com.11. Regulatory Compliance & Global Standards
Toripe operates in compliance with local digital security laws and international privacy frameworks, including the Bangladesh Information & Communication Technology Act, Digital Security regulations, and principles aligned with GDPR standards regarding data minimization, consent, and user access rights.
12. Changes to This Privacy Policy
We may periodically update this Privacy Policy to reflect advancements in our security controls or changes in regulatory guidelines. Any modifications will be posted here with an updated “Last Updated” timestamp. For significant changes, registered merchants will receive an advance notification via email or dashboard bulletin.
13. Data Protection Officer & Contact
If you have questions, feedback, or privacy concerns regarding this policy or wish to exercise your data protection rights, please contact our Data Protection Officer: