1. Software Nature & Operational Scope

DrutoPay is a specialized, proprietary Software-as-a-Service (SaaS) and automated payment verification infrastructure developed and operated by DrutoPay Technologies ("DrutoPay", "we", "us", or "our").

Our software exists solely to automate the manual, time-consuming verification process of transactional SMS notifications that merchants receive on their dedicated Android devices from recognized Bangladeshi Mobile Financial Services (MFS) providers—including bKash, Nagad, Rocket, and Upay.

2. Zero Fund Holding: Direct-to-Account Principle

The cornerstone of DrutoPay’s technology is our non-custodial, Zero Fund Holding Operating Model:

• Direct Peer-to-Merchant Transfer: When a customer makes a payment on a merchant’s website, the customer transfers money directly from their personal MFS/bank wallet directly to the merchant’s own personal, agent, or merchant MFS account.
• Zero Intermediation: Customer money never enters DrutoPay’s systems, accounts, or digital wallets at any time or under any circumstances.
• No Fund Holding or Storing: DrutoPay does not hold, store, deposit, lock, or intercept merchant or customer funds.
• No Settlement Cycle: Unlike traditional payment aggregators that collect money and disburse it after days (T+2 or T+3), DrutoPay conducts zero settlements. The merchant receives 100% of their money instantly into their own MFS wallet at the second of transaction.

3. Regulatory Compliance & Bangladesh Bank Stance

DrutoPay maintains complete respect for the regulatory guidelines and public warnings issued by Bangladesh Bank and the Government of the People's Republic of Bangladesh concerning unauthorized payment aggregators and unregulated financial institutions.

We proactively audit our merchant base to ensure our software is never utilized as a conduit for circumventing financial regulations, money laundering, or illegal financial schemes.

4. Absolute Prohibition on Betting, Gambling & Unlawful Activities

Any merchant account found or reported to be connected with betting, gambling, or illegal activities will be subject to immediate punitive actions:

• Immediate Permanent Suspension: The merchant account, all linked API keys, webhooks, and device tokens will be permanently terminated without prior notice.
• Strict No-Refund Policy: Any purchased subscription plan, package balance, or service fee is completely NON-REFUNDABLE upon violation of this clause.
• Law Enforcement Handover: DrutoPay actively cooperates with Bangladesh law enforcement agencies (including CID Cyber Police Center, DB, BTRC, and Bangladesh Police). In instances of illegal betting or financial fraud, full merchant audit trails, phone numbers, and IP logs will be handed over to authorities upon lawful subpoena.

5. Android Reader App & SMS Gateway Permissions

To automate payment verification, the merchant installs our proprietary native Android daemon application (DrutoPay Reader) on their dedicated gateway smartphone where their MFS SIM cards are inserted.

The application explicitly requests the following runtime Android permissions for strictly defined technical reasons:

• RECEIVE_SMS & READ_SMS Purpose: To detect incoming transaction confirmations sent by official telecom shortcodes of authorized Bangladeshi MFS operators (such as bKash, 16216, Nagad, Rocket, and Upay). The app parses solely the Transaction ID (TrxID), Amount, and sender to mark orders verified.
• INTERNET & ACCESS_NETWORK_STATE Purpose: To transmit the encrypted verification payload via HTTPS/TLS 1.3 to DrutoPay cloud servers in real-time.
• FOREGROUND_SERVICE & DATA_SYNC Purpose: To keep the SMS verification daemon active 24/7 without being closed or suspended by Android aggressive battery management.
• POST_NOTIFICATIONS Purpose: To display a mandatory, persistent notification in the Android status bar informing the merchant that the gateway daemon is actively running.
• RECEIVE_BOOT_COMPLETED Purpose: To automatically resume background transaction verification whenever the merchant’s phone is restarted.

6. What DrutoPay Reader NEVER Accesses or Collects

We believe in radical privacy and strict data minimization. The DrutoPay Reader application:

• NEVER reads or processes personal SMS, family chats, or messages from standard 11-digit mobile numbers.
• NEVER reads or extracts confidential banking OTPs (One Time Passwords), 2FA codes, or security tokens from non-whitelisted banks.
• NEVER accesses Contacts, Address Book, or Phonebook entries.
• NEVER accesses Device Location (GPS) or geographic tracking data.
• NEVER accesses Photos, Videos, Camera, Microphone, or Internal Storage files.
• NEVER transmits your MFS account PIN or password. (Our software has zero capability to execute debit transactions or send money).

7. Information We Collect & How It Is Used

To deliver our software services, we collect minimal operational information:

• Account Credentials: Merchant name, business email, hashed password (Argon2/Bcrypt), contact phone number, and optional Telegram ID for instant push alerts.
• Verification Metadata: Transaction ID (TrxID), received amount, MFS provider name, timestamp, and order reference ID submitted via REST API.
• Technical Telemetry: Device hardware ID (UUID) for Android phone pairing, merchant dashboard login IP addresses, and webhook delivery HTTP response codes.

8. Data Security, Encryption & Storage

We employ military-grade security protocols to protect all operational data:

• End-to-End Encryption: All communications between the Android Reader app, merchant servers, and DrutoPay cloud are strictly enforced via HTTPS with TLS 1.3 encryption.
• Zero Plaintext Credentials: API Secret Keys and Device Keys are generated using cryptographically secure random bytes.
• Payload Purging: Raw SMS body content is automatically expunged from memory once the TrxID and amount have been extracted and validated.

9. Merchant Data Rights & Account Deletion

Every merchant using DrutoPay retains full ownership over their data:

• Instant Device Revocation: You can unbind or revoke Android gateway devices from your dashboard at any time, immediately halting all SMS sync.
• Data Export: Export your complete transaction verification logs into CSV or Excel formats directly from the dashboard.
• Full Account Deletion: You may request complete purging of your profile, brand identities, and logs by contacting our support team.

10. Compliance Inquiries & Official Support

If you have any questions, compliance inquiries, or law enforcement notices regarding this Privacy Policy, our dedicated team is available 24/7: