Privacy notice
TshongPay is payment infrastructure. We collect only what is needed to move money safely and meet Bhutan's financial regulations.
| Data | Collected at | Where it is kept |
|---|---|---|
| Email, name, phone | Sign-up and your profile | Your account. Visible only to you and authorised TshongPay support staff. |
| Password | Sign-in | Stored only as a salted bcrypt hash. Nobody, including TshongPay staff, can read it. |
| Saved bill accounts | My bills | Your account only. Removed when you delete your account. |
| Payment records | Every payment | Kept for statutory audit (RMA / DRC). After account deletion they are kept without your name, email or phone. |
| Business KYC (CID, TPN, licence, bank) | Merchant onboarding | Your business account, visible to you and HQ compliance staff only. |
Who we share data with
No analytics, advertising or tracking services. Partner banks receive only the payment reference and amount. Merchants receive payment status for their own orders. Bill payers see only a masked name (for example "Karma D.").
Deleting your account
Citizens can delete their account any time from Profile → Delete my account. Your name, email, phone, saved bills and saved payment methods are erased and you can no longer sign in. Business and staff accounts are closed through TshongPay HQ support because payout and tax records must be retained.