Privacy Policy

Last updated: 18 September 2026 · Applies to upifree.com

QR photos stay on your device. Snapshots only store amount and rule. Analytics record page views, not bank data. — QR decode is local. Snapshots are optional. Hosting logs are technical, not bank secrets.

This policy describes what UPIfree.com ("we") collect when you use the website. Indian users also have rights under the Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023). Calculators and QR tools are built so most work never becomes personal data on our servers. The bill reader and Ask Pikoo are different: those requests go to named processors for that job only.

1. What we never collect

We do not ask for, receive, or store UPI PINs, OTPs, debit or credit card numbers, CVVs, net-banking passwords, Aadhaar numbers, or full bank account numbers. If you paste those into a contact email, we will not use them and we will delete the message.

2. Data inventory

UPI PIN, OTP, CVV, card number, Aadhaar, full account number
Where · Nowhere
Why · Never asked. If you paste them into email we delete the message.
QR photo or generated PNG
Where · Your device
Why · Decode and draw run in the browser. Not uploaded for that work.
Bill / invoice / receipt photo or PDF (Bill reader)
Where · Sent to Sarvam AI for that job, then discarded here
Why · To read printed fields (merchant, date, total). Do not photograph PIN, OTP, or Aadhaar.
Ask Pikoo chat text, and extracted bill fields used for an explanation
Where · Sent to OpenAI for that reply. Not stored as an account on this site
Why · To write a plain-language answer grounded in this site's rules.
Amount, shop vs friend, merchant class
Where · Your browser, then optionally a snapshot
Why · To match a published fee rule. No account required.
Shareable snapshot (token, amount, type, class, matched rule, source)
Where · Short-lived in-memory cache on the host
Why · Only if you tap "Generate shareable link". Anyone with the URL can see it. It can vanish on restart or deploy. Not a user database.
IP address, user-agent, URL
Where · Vercel host logs
Why · Security and uptime. Ordinary for any public website.
Page views and performance timings
Where · Vercel Analytics and Speed Insights
Why · To see which pages load slowly. Not used to build an advertising profile of your bank activity.
Email address and message body
Where · Inbox, if you write to us
Why · To reply. Correspondence, not a customer account.

What we process, where it lives, and why
Data	Where it lives	Why
UPI PIN, OTP, CVV, card number, Aadhaar, full account number	Nowhere	Never asked. If you paste them into email we delete the message.
QR photo or generated PNG	Your device	Decode and draw run in the browser. Not uploaded for that work.
Bill / invoice / receipt photo or PDF (Bill reader)	Sent to Sarvam AI for that job, then discarded here	To read printed fields (merchant, date, total). Do not photograph PIN, OTP, or Aadhaar.
Ask Pikoo chat text, and extracted bill fields used for an explanation	Sent to OpenAI for that reply. Not stored as an account on this site	To write a plain-language answer grounded in this site's rules.
Amount, shop vs friend, merchant class	Your browser, then optionally a snapshot	To match a published fee rule. No account required.
Shareable snapshot (token, amount, type, class, matched rule, source)	Short-lived in-memory cache on the host	Only if you tap "Generate shareable link". Anyone with the URL can see it. It can vanish on restart or deploy. Not a user database.
IP address, user-agent, URL	Vercel host logs	Security and uptime. Ordinary for any public website.
Page views and performance timings	Vercel Analytics and Speed Insights	To see which pages load slowly. Not used to build an advertising profile of your bank activity.
Email address and message body	Inbox, if you write to us	To reply. Correspondence, not a customer account.

3. QR analyser and QR generator

A QR image you open in the analyser is drawn into an HTML canvas in your browser. Decoding (jsQR) runs on the device. The file is not uploaded for that decode. Generated QRs are also drawn locally. If you download a PNG, it saves on your disk, not in our archive.

4. Bill reader

If you use Bill reader, the photo or PDF is sent to Sarvam AI's Document Intelligence API so printed fields can be read (merchant, date, total, GSTIN if shown, UPI ID if printed). We then send those extracted fields (not the raw image, unless the first job failed and a backup read is needed) to OpenAI (model gpt-5.4-mini) to write a short explanation against this site's published UPI fee bands.

We do not keep the file on our servers after the reply is returned. Sarvam and OpenAI process the request under their own terms. Do not photograph UPI PIN, OTP, CVV, Aadhaar, or a full account number. Crop to the slip.

5. Ask Pikoo

The corner chat sends the text you type, plus a fixed knowledge file of this site's rules and tools, to OpenAI (model gpt-5.4-mini) to generate a reply. We do not create a login or store a chat history on our servers after the response is streamed back. Do not paste secrets. For a photo of a bill, use the bill reader, not the chat.

6. Fee calculations

Amount, payment type (shop vs friend), and merchant class are processed in the browser against a public rules file. You can use the calculator without creating an account. We do not currently write those form values to localStorage.

7. Shareable snapshots

Only if you tap "Generate shareable link" do we store a snapshot: amount, payment type, merchant class, matched rule, consumer cost, merchant MDR, source title and URL, and a random eight-character token. No name, no VPA, no photo.

That record lives in an in-memory cache on the server, not a durable customer database. It can disappear when the process restarts or the site is redeployed. Anyone who has the link can see that calculation while it lasts. Do not put secrets in the amount field.

8. Hosting, logs, analytics, cookies

The site is hosted on Vercel. Like most hosts, it may log IP address, user-agent, and URL for security and uptime. Technical logs may be processed outside India by that host. We do not send UPI secrets because we never collect them.

We use Vercel Analytics and Vercel Speed Insights for page views and performance. We do not run Google Ads, Meta pixels, or other advertising trackers. We do not sell lists of users. We do not set advertising cookies. The host may still use first-party technical cookies or beacons that the platform needs to serve the page.

Named processors for optional tools: Sarvam AI (document reading) and OpenAI (explanations and Ask Pikoo). Those companies may process technical data outside India. We send them only what that tool needs for the current request.

9. Email you send us

If you write to editorial@upifree.com or security@upifree.com, we process the address and the body to reply. That is correspondence, not a customer account. Do not include PINs.

10. Your rights (DPDP Act, 2023)

Where we hold personal data (typically an email you sent), you may ask us to tell you what we hold, to correct it, or to erase it, and you may raise a grievance about that processing. Write to editorial@upifree.com. We will not ask you to "verify" by sending a UPI PIN.

We have not appointed a named Data Protection Officer in a public filing. For a complaint about an actual UPI debit, not this website, use your bank and, if needed, the Reserve Bank's Complaint Management System at cms.rbi.org.in.

11. Children

The tools are meant for people who can lawfully operate a bank or UPI account. We do not knowingly build profiles of children.

12. Changes

If this policy changes in a material way, we will update the date at the top of this page. The current version is 18 September 2026.

Questions: Contact · Disclaimer