Where is my money held?
Customer money is never held by MuffinPay.
- Rupee wallet balances are held in an escrow account at a scheduled commercial bank under our RBI-authorised partner's prepaid payment instrument authorisation
- Digital rupee (e₹) is issued by the Reserve Bank of India and held in wallets of a participating bank
- Other money movement runs through partners licensed or registered in each market
Our Regulated partners page lists the kind of partner for each service.
How does MuffinPay protect my data?
We collect only what a service needs and protect it under the laws of each market we serve.
- Payment data for India programmes is stored in India, as the RBI's payment data storage directions require
- Personal data is handled under India's Digital Personal Data Protection Act, 2023, the EU and UK GDPR, the UAE PDPL and US and Canadian privacy laws where they apply
- Aadhaar e-KYC runs only through an authorised UIDAI Sub-AUA/KUA, with Aadhaar numbers kept in an Aadhaar Data Vault
- Data is encrypted in transit and at rest, and access is limited to the people who need it
Our Privacy Policy explains what we collect and your rights.
What happens if there is a security incident?
Incidents are reported to the authorities and to affected users within the deadlines the law sets.
- In India, cyber incidents are reported to CERT-In within six hours of being noticed, as CERT-In's 2022 directions require
- Our regulated partners report incidents to their regulators, such as the RBI, under their own obligations
- Affected users are told what happened and what to do next
How do I report a vulnerability?
Email info [at] muffinpay.com with “Security” in the subject line, the affected page or system and the steps to reproduce. We acknowledge reports within two working days. Please do not access other people's data or disrupt services while testing. Our contact is also published at muffinpay.com/.well-known/security.txt.
How do I know a message is really from MuffinPay?
MuffinPay uses only muffinpay.com and its subdomains, email addresses ending in @muffinpay.com, and the social accounts on our Trademark and Official Channels page. We will never ask for your OTP, UPI PIN, card PIN, password or wallet recovery phrase.
To report a scam, email info [at] muffinpay.com. In India you can also report cyber fraud online or by calling 1930.