Information Security

Privacy & Data Protection Policy

Compliant with the Information Technology Act, 2000 & SPDI Rules, India

1. Introduction

KeralaGoldAPI (“we”, “our”, or “us”) respects the privacy of our merchant partners and website visitors. This Privacy Policy outlines how we collect, store, use, and protect your personal and business data when you use our website, APIs, and services.

2. Information We Collect

We collect only the minimal data strictly necessary to provision and bill your API services:

Account Information: Business email address, company/showroom name, website URL, and hashed password.
API Telemetry: Monthly request counts, endpoint paths accessed (e.g. /api/calculate vs /api/rates), timestamp of last request, and IP address for Cloudflare edge security.
Billing Metadata: PhonePe Transaction IDs, subscription tier, and validity dates.

3. Payment Security & Non-Storage of Financial Data

🔒 We NEVER store credit/debit card numbers, CVVs, UPI PINs, or netbanking passwords on our servers.

All payment card processing and UPI transactions are executed directly by PhonePe Private Limited, an RBI-licensed payment aggregator certified under PCI-DSS Level 1 compliance.

4. How We Use Your Information

Collected information is utilized strictly to:

Authenticate your API requests via 256-bit cryptographic key hashing.
Enforce monthly subscription quotas and alert you before limits are reached.
Deliver automated daily 10:15 AM bullion rate change notifications to your WooCommerce store.
Provide priority customer support and billing assistance.

5. Data Security & Cloudflare Edge Architecture

Our infrastructure runs on Cloudflare Workers and Cloudflare D1 serverless database:

All traffic between your e-commerce store and our API is encrypted using modern TLS 1.3 / 256-bit SSL.
Stored passwords are cryptographically salted and hashed using SHA-256 with high-entropy work factors.
API keys are hashed with crypto.subtle — plain keys are never visible in database logs.

6. No Third-Party Data Selling

We do not sell, rent, monetize, or trade your business data or customer shopping habits to any third-party advertisers or data brokers under any circumstances.

7. Contact the Privacy Team

If you have any questions or data access requests regarding this Privacy Policy, please contact our Data Protection Officer at:

Officer: Albin Ouseph
Email: albinouseph12@gmail.com
Phone: +91 7510640182
Location: Thrissur, Kerala, India – 680001