Last updated: 7 August 2026
Passa Bonus உங்கள் WhatsApp எண், பெயர், மற்றும் பணம் செலுத்திய ரசீதுகளை மட்டுமே சேமிக்கிறது — உங்கள் பரிசுகளைக் கணக்கிட. உங்கள் தகவலை நாங்கள் விற்பதில்லை. எப்போது வேண்டுமானாலும் bonus@passa.gift-க்கு எழுதி உங்கள் தகவலை நீக்கச் சொல்லலாம்.
We collect only your WhatsApp number, name and payment receipts — to track your rewards. We never sell your data. You can ask us to delete it anytime at bonus@passa.gift.
Passa Bonus (“the Service”) is operated by SkandaBio Organics Private Limited (“we”, “us”, “our”), a company incorporated in India with its registered office at 316/6A, Melapachakudi Village, Fathima Nagar Post, Viralimalai, Tamil Nadu – 621316, India. This policy explains what personal data we collect when you or your shop use Passa Bonus, and how we handle it, in line with India’s Digital Personal Data Protection Act, 2023 and applicable law.
From customers who use the loyalty program on WhatsApp:
From shop owners who sign up:
If a shop installs the Passa Android app on its own phone, we also receive the payment notifications that phone shows — see section 5.
We use this data, on the basis of your consent, to:
We do not use your data for advertising and we do not sell it.
To read the amount and reference from a receipt you send, the screenshot is processed by an automated text-recognition service (currently Anthropic, PBC). This processing may occur on servers outside India. We share only the screenshot needed for this purpose, and only to operate the Service. If you would prefer your receipts not be processed this way, please contact us.
Shop owners can install the Passa Android app on the shop’s own phone so that customer payments are credited automatically, without the customer needing to send a receipt. Installing it is optional and it is the shop owner’s choice — customers are never asked to install anything.
With the shop owner’s permission, the app reads payment notifications shown on that phone by UPI apps on a fixed list (Google Pay, PhonePe, Paytm, BHIM and similar). From those notifications it takes the payer’s name and the amount, exactly as the payment app displays them, and sends them to us so the savings reach the right customer. A payer’s name is personal data about that customer; we use it only to work out whose savings to add to, and for nothing else.
What the app never reads. Notifications from every other app on the phone are ignored on the device itself and are never sent to us — not your messages, not your email, not anything else. That filtering happens on the phone, before anything is uploaded.
Bank SMS — only in the version installed outside Google Play. Some shops install a version of the app that also reads bank credit messages, to capture the bank’s reference number for a payment. It reads only SMS that come from a bank sender ID and contain a credit keyword and an amount. One-time passwords (OTPs) and personal messages are excluded on the device and are never sent to us. The version distributed through Google Play does not ask for SMS access at all and contains no SMS-reading code.
Keeping it running. The app shows a permanent, silent notification (“Passa is protecting your payments”) so the phone’s battery manager does not stop it and payments are not missed. It also reports its own health to us every 15 minutes — whether its permissions are still granted, how many captures are waiting to upload, and the phone’s make and Android version — so we can tell a shop when their phone has stopped working.
What we keep. Captures are sent over an encrypted connection (HTTPS). We keep the original captured text for up to 30 days so we can correct mistakes in how it was read, after which only the extracted payment details remain, as part of the shop’s ordinary records (see section 9). The exception is a message our system could not read automatically: we keep its text until someone has resolved it, and then delete it on the same 30-day basis.
Staying in control. A shop owner can switch auto-credit off, or uninstall the app, at any time — the loyalty program keeps working the older way, with receipts. We can also revoke a phone’s access ourselves, which stops it sending anything further. The app asks for no access to contacts, location, photos or files.
Most shops are paid through their own UPI QR code: you pay the shop directly from your UPI app, and we never receive, hold or see that payment. Separately, a shop may choose to switch on in-app payment, which lets you pay from that shop’s Passa Bonus page instead. This is the shop owner’s choice and is off unless they enable it.
How the money moves. A payment made this way is processed by our payment partner Razorpay (Razorpay Software Private Limited). It reaches an account Passa Bonus holds with Razorpay, and Razorpay then transfers it to the shop’s own linked bank account. We use this only to complete the payment and to add your reward automatically, with no receipt needed.
What Razorpay receives about you. To set up the payment we send Razorpay the amount, the shop’s identity and your mobile number. The payment screen itself is Razorpay’s own: it loads from Razorpay into your browser and collects your payment details there — the UPI app, card or bank you choose, and anything you enter — directly, under Razorpay’s privacy policy. We never see or store your card number, UPI PIN or any other payment credential. What we keep is the payment’s reference number, amount, date and your mobile number, so the right reward reaches you.
For shop owners. To be paid this way you must first complete a one-time KYC. The details you give for it — legal business name, business type, contact name and email, PAN, bank account number and IFSC — are held by us and sent to Razorpay to open your linked account. They are business details of the shop, not a customer’s personal data. You can leave in-app payment switched off and keep using your own UPI QR.
We share personal data only with service providers who help us run the Service, and only as needed:
We may also disclose data if required by law. Your reward activity at a shop is visible to that shop’s owner so they can serve you, but never your full payment details.
Our records are stored on servers located in India, and payment processing (section 6) is carried out in India by Razorpay. Certain limited processing (receipt text-recognition, section 4) may take place outside India. We take reasonable steps to protect your data wherever it is processed.
We keep your data for as long as you use the Service and for a reasonable period afterwards to meet legal and record-keeping needs, after which it is deleted or anonymised. You may ask us to delete it sooner (see section 10).
Subject to applicable law, you may ask us to:
To exercise any of these, or to raise a concern, email bonus@passa.gift Step-by-step instructions for deletion are on our Delete your data page. Withdrawing consent may mean we can no longer provide the loyalty program to you.
We use reasonable technical and organisational measures — access controls, restricted dashboards, and India-based hosting — to protect your data against loss, misuse or unauthorised access. Payment KYC details (section 6) are held only for the shop that gave them, are never shown in full in any dashboard, and are never shared with another shop. No system is perfectly secure, but we work to keep your information safe.
Passa Bonus is intended for adults (18 and over). We do not knowingly collect data from children. If you believe a child has used the Service, please contact us and we will delete the data.
We may update this policy from time to time. The “last updated” date above shows the latest version, which is always available at this page.
For any question, request or complaint about your personal data, contact our Grievance Officer:
Sowndariya Saravanan
Grievance Officer, SkandaBio Organics Private Limited
316/6A, Melapachakudi Village, Fathima Nagar Post, Viralimalai, Tamil Nadu – 621316, India
Email: bonus@passa.gift
We aim to respond to data requests within the timeframes required by applicable law.