<?php
require_once __DIR__ . '/includes/functions.php';
startSecureSession();
$pageTitle = 'Privacy Policy — AdityaHost FamAPI';
$metaDesc  = 'Official Privacy Policy for AdityaHost FamAPI. Learn how we collect, use, store, encrypt and protect your personal data. AES-256 encryption, GDPR-ready.';
$navActive = '';
include __DIR__ . '/includes/public_header.php';
?>

<section class="page-hero">
  <div class="wrap">
    <div class="crumb" style="color:#8ab0ff">Legal</div>
    <h1>Privacy Policy</h1>
    <p>Effective date: 1 August 2026 &middot; Last updated: 22 August 2026</p>
  </div>
</section>

<section class="section">
  <div class="wrap prose">

    <h2>1. Introduction</h2>
    <p>AdityaHost ("we", "us", "our") operates the FamAPI service accessible via <a href="https://adityahost.in">adityahost.in</a> and <a href="https://fampay.adityahost.in">fampay.adityahost.in</a>. This Privacy Policy explains what data we collect, how we use it, and your rights.</p>
    <p>By using our Service, you consent to the data practices described in this policy.</p>

    <h2>2. Information We Collect</h2>
    <h3>2.1 Account Information</h3>
    <ul>
      <li>Name and email address provided during registration.</li>
      <li>Password hash (we never store or see your plain-text password).</li>
      <li>Account preferences and settings.</li>
    </ul>
    <h3>2.2 Payment Credentials</h3>
    <ul>
      <li>The Gmail address you connect for payment verification.</li>
      <li>A 16-character Gmail app password used solely for IMAP access to read FamPay payment emails.</li>
    </ul>
    <h3>2.3 Transaction Data</h3>
    <ul>
      <li>Order IDs, amounts, UTR numbers, and verification statuses created through your API key.</li>
      <li>Payment link configurations and custom note codes.</li>
    </ul>
    <h3>2.4 Usage Data</h3>
    <ul>
      <li>IP addresses, timestamps, and basic server logs for security and abuse prevention.</li>
      <li>API request counts and success/failure rates for service monitoring.</li>
    </ul>

    <h2>3. How We Protect Your Data</h2>
    <h3>3.1 Gmail App Password Encryption</h3>
    <p>Your Gmail app password is encrypted using <strong>AES-256-GCM</strong> (Advanced Encryption Standard with 256-bit keys in Galois/Counter Mode) before it is ever written to disk. It is decrypted only in memory, temporarily, while checking for new payment confirmation emails. After use, the decrypted value is immediately discarded from memory.</p>
    <p>Your app password is never displayed again in the dashboard after initial setup. You can revoke it at any time from your Google account settings.</p>

    <h3>3.2 Data Storage</h3>
    <ul>
      <li>All data is stored on encrypted servers hosted in India.</li>
      <li>Database connections use TLS encryption.</li>
      <li>Regular backups are performed and stored securely.</li>
    </ul>

    <h3>3.3 API Security</h3>
    <ul>
      <li>All API communication requires HTTPS (TLS 1.2+).</li>
      <li>API keys are hashed and cannot be recovered after creation.</li>
      <li>Rate limiting and abuse detection are enforced.</li>
    </ul>

    <h2>4. How We Use Your Data</h2>
    <p>We use your data solely to:</p>
    <ul>
      <li>Provide the payment verification service you signed up for.</li>
      <li>Send you transaction confirmations and account notifications.</li>
      <li>Detect and prevent fraud, abuse, and security incidents.</li>
      <li>Improve our service and develop new features.</li>
      <li>Comply with legal obligations when required.</li>
    </ul>

    <h2>5. What We Do NOT Do</h2>
    <ul>
      <li><strong>We never sell or rent your personal data</strong> to any third party.</li>
      <li><strong>We never read your emails</strong> for any purpose other than detecting FamPay payment confirmations.</li>
      <li><strong>We never touch the money</strong> you collect — funds go directly to your own UPI ID.</li>
      <li><strong>We never use advertising or tracking cookies.</strong></li>
      <li><strong>We never share your data</strong> with marketers, data brokers, or advertisers.</li>
    </ul>

    <h2>6. Cookies &amp; Sessions</h2>
    <p>We use only essential session cookies to keep you logged in:</p>
    <ul>
      <li>Regular user sessions expire after 7 days or on logout.</li>
      <li>Admin sessions expire on logout.</li>
      <li>No third-party tracking or advertising cookies are used.</li>
    </ul>

    <h2>7. Third-Party Services</h2>
    <ul>
      <li><strong>Google (Gmail IMAP):</strong> Accessed only for the payment verification feature you explicitly enable. We only read emails from FamPay.</li>
      <li><strong>FamPay / NPCI:</strong> Involved only through the standard UPI payment flow they operate.</li>
      <li><strong>Cloudflare:</strong> Used for CDN and DDoS protection. Standard security headers are applied.</li>
    </ul>

    <h2>8. Data Retention</h2>
    <ul>
      <li>Account data is retained until you delete your account.</li>
      <li>Transaction records are kept for reconciliation and dispute resolution.</li>
      <li>Server logs are automatically rotated after 30 days.</li>
      <li>Deleted accounts are purged within 30 days.</li>
    </ul>

    <h2>9. Your Rights</h2>
    <p>You have the right to:</p>
    <ul>
      <li>Request a complete copy of all personal data we hold about you.</li>
      <li>Request deletion of your account and all associated data.</li>
      <li>Revoke API access and disconnect your Gmail connection anytime from <a href="integrations.php">Settings</a>.</li>
      <li>Revoke the Gmail app password directly in your Google account.</li>
      <li>Opt out of non-essential communications.</li>
    </ul>

    <h2>10. Children's Privacy</h2>
    <p>The Service is not intended for children under 14. We do not knowingly collect data from children under 14. If we discover such data, it will be deleted immediately.</p>

    <h2>11. Security Incidents</h2>
    <p>In the unlikely event of a data breach affecting your personal information, we will notify affected users promptly via email, along with a description of the incident and remediation steps taken.</p>

    <h2>12. Changes to This Policy</h2>
    <p>We may update this Privacy Policy at any time. The latest version is always available on this page. Material changes will be announced via email or dashboard notification.</p>

    <h2>13. Contact</h2>
    <p>Privacy-related questions or requests: <a href="mailto:support@adityahost.in">support@adityahost.in</a> or <a href="contact.php">contact us</a>.</p>
  </div>
</section>

<?php include __DIR__ . '/includes/public_footer.php'; ?>
