Privacy policy

1. What we collect

• Your business name, email address and phone number, given at registration.
• The orders you send: the game, the product, and the player ID or account the top-up is for.
• Your balance, fees and deposits, kept as a ledger.
• Your IP address, recorded against sensitive actions in an audit log.

We do not ask for a PAN, a bank account or a card number to open an account.

2. Supplier credentials

A supplier credential you save is not stored in the Karauti application database. It is sealed with AES-256-GCM and held on a separate server whose only job is to unseal it at the moment an order is placed. It is never shown again after you save it, and it is bound cryptographically to your merchant account, so it cannot be unsealed for anyone else.

3. Who else sees it

The supplier does. Placing an order means signing in to your account with them and sending the player ID, so both reach them. That is the service.

Nobody else does. We do not sell data, we do not share it with advertisers, and we do not pass merchant records to anyone who has not asked lawfully.

4. Cookies

The site sets one cookie, encrypted, which keeps you signed in. It is not used to follow you anywhere else.

The public pages can carry Google Analytics, Google Tag Manager or a Meta pixel when an administrator has configured one. These set their own cookies under their own policies. The signed-in console carries none of them.

5. Email

We use your address to verify it, to reset a password, to warn you about a change to your sign-in, and to tell you about your own account. We do not sell it and we do not run marketing lists from it.

6. How long we keep it

Transactions, fees and ledger entries are business records and are kept. A merchant account is never hard-deleted, because every order and every rupee of the ledger points at it and deleting one would corrupt the other. Closing an account stops it being used; it does not erase its history.

7. Your choices

You can see and correct your business details, your team and your connections in the console at any time. Turn a connection off and its credential stops being used; ask us and we will destroy it. For anything else, write to us.

8. Security

Two-factor is available and enforced at the screens that matter. API keys can be restricted by IP. Sensitive actions are written to an audit log with the address they came from.

9. Changes

This page changes when what we do changes. The date at the top says when it last did.

10. Contact

[email protected]