Trust & Safety

1. Your safety comes first

USR Enterprises Private Limited ("ZulePay", "we", "us", "our") operates the ZulePay app — a digital payments platform offering a prepaid Wallet (Main Wallet and Offline Pocket), offline payments through Immutable Single-Use Tokens ("ISUTs"), and merchant solutions including QR payments and settlements.

We do what it takes to earn the trust you place in us. This page explains, in one place, how we protect your money and your identity, and how you can protect yourself. It supplements — and does not replace — the General Terms and Conditions, the Privacy Policy, the Grievance Redressal Policy and the product terms on the Terms & Conditions hub.

2. Secure from the start

1. Authenticated payments. Every payment on ZulePay requires your explicit authentication — your device biometrics (fingerprint or face) or your wallet PIN. App access is protected by your device lock and an app-level PIN/biometric check.
2. Device-bound keys. Your ZulePay identity is a cryptographic key pair (ECDSA P-256) generated on your device. Private keys are held in the device's secure storage and never leave your device — we cannot access them, and they cannot be copied to another device.
3. Encryption everywhere. Your data and traffic are protected with 256-bit encryption in transit and at rest.
4. Regulated custody. Wallet funds are held 1:1 in a regulated escrow account with our partner bank. Customer money is not used for lending or any other purpose.

3. Payment privacy

1. The details of a payment are visible only to you and the person you are transacting with — sender to receiver, customer to merchant.
2. We do not sell your personal data. How we collect, use and protect personal data is governed by the Privacy Policy.
3. You can review your data permissions and request correction or erasure at any time under the Privacy Policy.

4. Risk monitoring and fraud prevention

1. Risk scoring. Every transaction is risk-assessed in real time. Transactions with high risk scores are blocked or held for review, keeping your payment safe.
2. Monitoring. Our security systems monitor for suspicious activity across the platform around the clock.
3. Confirmed fraud is actioned. Fraudulent users are blocked from accessing ZulePay, and fraud complaints are reported to the relevant law-enforcement authorities.
4. Login protection. Logins from a new device require a one-time password ("OTP") sent to your registered mobile number. If you ever receive an OTP you did not request, do not share it — and tell us.
5. Account safeguards. Where we detect unusual activity on your account, we may contact you to verify it and, where necessary, temporarily restrict the account to protect your funds.

5. Offline payments, safer by design

ZulePay's offline payments are built so that a token that is intercepted or misdelivered cannot be replayed:

1. Single-use tokens. Each Digital Cheque is minted as an ISUT that can be spent only once, only by the intended payee, and only within its 30-minute validity window.
2. Destroy-on-generate. The spending power for a cheque is destroyed on your device the moment it is generated — the same money cannot be spent twice while the token is live.
3. Payee-locked and encrypted. Tokens are end-to-end encrypted and locked to the payee's device key; only their device can redeem them.

For the full terms, see the Offline Payments Terms.

6. Lost, stolen or replaced devices

Losing your phone does not mean losing your money. Your balance lives on our regulated books — never inside the handset — and only keys held on your devices can move it.

1. Report it — within 24 hours. If your phone (or phone and SIM together) is lost or stolen, report it as soon as you can, and in any case within 24 hours of noticing: open the app on any other device and tap "Lost phone?" on the login screen (no sign-in needed), use Profile → Security if you can still sign in, or contact support. A report takes effect immediately.
2. What freezes, what keeps working. The moment you report: your lost device is locked out — its keys are revoked, so it can no longer sign in, pay or redeem anything; and all money-out is frozen — payments, transfers and withdrawals included. Money coming to you is not blocked: it keeps landing in your balance. Pending offline cheques expire on their own (30-minute lifetime) and are returned to you. Your Offline Pocket allowance is restored when you recover.
3. Recovery with your SIM intact. Still hold your number (replacement SIM or eSIM)? Recovery is self-serve and immediate: verify the OTP sent to your number, pass a quick identity re-check matched to your KYC tier — Transaction-PIN proof for a minimum-KYC wallet, PAN confirmation plus Aadhaar re-verification for a full-KYC wallet — and enrol the new device. The freeze lifts and your wallet works as before.
4. Recovery when the number is lost too. Cannot receive an OTP? File the FIR through the app's recovery flow — report number, police station and document. Our team reviews it, generally within 24 hours, and then either: re-enables you on a re-issued SIM for the same number with an OTP; or, if you have changed numbers, updates your account only after full document re-KYC and explicit approval — with a safeguard notification sent to your old number.
5. A new device must prove itself. Any new physical device taking over a wallet has to clear two checks together: an OTP to your registered number (you hold the SIM) and a device-genuineness check (a real, uncompromised handset). If the two cannot be verified together, the device cannot be enabled. You are notified on all channels whenever a new device is enrolled.
6. Keys never travel. Recovery never exports or copies keys from your old phone. A freshly generated, verified key pair on the new device is the only way back in — there is no software-key fallback.

These protections are part of the General Terms and Conditions (Section 19).

7. Partners in protection

To aid safe transactions, we work with the cyber-crime ecosystem:

1. National Cyber Crime Reporting Portal — report online fraud at cybercrime.gov.in
2. Cyber Crime Helpline 1930 — call to report financial fraud quickly; early reporting can help intercept funds
3. Law-enforcement cooperation. We work with law-enforcement and security agencies on fraud complaints, and provide lawful assistance in investigations.

8. Your guide to safe transactions

Learn to identify and avoid suspicious payment requests with these habits:

1. Never share your wallet PIN, OTP or password. No ZulePay employee will ever ask for them — anyone who does is a fraudster.
2. Never enter your PIN to receive money. A PIN is only ever needed to send money, never to receive it.
3. Never install remote-control or screen-sharing apps (such as AnyDesk or TeamViewer) at the request of an unknown caller.
4. Verify before you pay. Check the payee name and amount on the confirmation screen before authenticating.
5. Treat Digital Cheques like cash. A cheque is payable to one payee only and lives for 30 minutes — do not generate one except to pay the person handing it to you.
6. Beware of urgency scams — "your KYC expires today", lottery and cashback wins, "verify your account by sending ₹1", or offers to exchange digital money for physical cash.
7. Install ZulePay only from official app stores, and check the developer name before installing.
8. Lost or changed your phone? Report it within 24 hours — the app's "Lost phone?" flow on the login screen works without signing in, or use Profile → Security (see Section 6). The old device is locked out instantly, money-out is frozen, and money sent to you still arrives.

9. How to report suspicious activity

1. In the app: go to Profile → Help & Support and report the transaction or issue.
2. By email or phone: write to support@zulepay.com or call +91 95381 07745. Complaints are acknowledged within 48 hours; the escalation matrix — up to the RBI Integrated Ombudsman — is in the Grievance Redressal Policy.
3. Report cybercrime: register a complaint on the National Cyber Crime Reporting Portal or call the helpline 1930.
4. Act fast. If you have shared an OTP, PIN or a Digital Cheque with someone you now suspect, report it immediately — speed matters.

10. Frequently asked questions

How does ZulePay keep my payments safe?

Every payment requires your biometric or PIN authentication; your keys never leave your device; transactions are risk-scored in real time with high-risk activity blocked; and wallet funds are held 1:1 in a regulated escrow account. See Sections 2 and 4.

What can I do to keep my transactions safe?

Follow the habits in Section 8 — above all, never share your PIN, OTP or password, never enter a PIN to receive money, and never install remote-control apps at an unknown caller's request.

What if someone tries to log in to my account?

A login from a new device requires an OTP sent to your registered mobile number. If you receive an OTP you did not request, do not share it and contact support immediately — someone may be trying to access your account.

Is it safe to pay without internet?

Yes. Offline payments use single-use tokens that expire within 30 minutes and can be redeemed only by the intended payee's device. See Section 5 and the Offline Payments Terms.

I lost my phone. Is my money safe?

Yes. Report it within 24 hours — the "Lost phone?" flow on the app's login screen works without signing in (or Profile → Security, or support). Your lost device is locked out immediately, all money-out is frozen, and money sent to you still lands in your balance. Recover on a new device with your SIM via OTP plus a quick identity check; if the number is lost too, recovery runs through FIR review, generally within 24 hours. See Section 6.

I think I have been defrauded. What should I do?

Report it immediately: in the app (Profile → Help & Support), by email to support@zulepay.com, and to the authorities on the National Cyber Crime Reporting Portal or helpline 1930. Then follow the escalation path in the Grievance Redressal Policy if needed.

Is my personal information secure on ZulePay?

Yes. Your data is protected with encryption in transit and at rest, access is device-bound, and we follow the data-handling commitments in the Privacy Policy.

11. Contact us

USR Enterprises Private Limited CIN: U62011KA2026PTC224718 VO-843, WeWork 10th Floor, RMZ Latitude, No. 69/458/69, Hebbal Kempapura, Bengaluru – 560024, Karnataka, India Email: support@zulepay.com · Phone: +91 95381 07745