Privacy policy
What we collect, why we collect it, who else sees it, and how long we keep it.
Effective 11 September 2026.
Who is responsible
Laayo Services Pvt. Ltd. (registration 385869/82/83, PAN 623551868), of New Kanchanjunga Tole, Birtamode-03, Jhapa, Nepal, is responsible for the personal data described here. Contact us at support@laayo.com.np.
The short version
We hold what we need to run a payments platform for your business and to satisfy the rules that apply to one: who you are, that your business is real, and a record of the payments you created. We do not sell data, we do not run advertising, and we do not track you across other websites.
We also want to be clear about what we hold and what we do not. We never see your customers' card details, bank credentials or wallet passwords. If you connect your own Fonepay account, the money never enters an account we control. If you use Collect with Qora, it is collected into our account and held for you until you withdraw it — and for that we also keep your signed collection agreement and a record of every amount we receive, hold and pay out for you.
What we collect
Account and business information
Your name and email address, and your business's trading and legal names, address, PAN and (where applicable) VAT number, registration number, business type, support email and phone number, and website.
Verification records
Documents you upload to verify your business — registration certificate, PAN or VAT certificate, an identity document for the owner, and proof of your bank account — together with the decisions made about them and who made them. These are stored on private storage outside the public web root and are opened only by staff reviewing your submission, whose access is logged.
Bank and Fonepay details
Your settlement bank name, branch, account holder name and account number, and your Fonepay merchant credentials. Fonepay credentials are encrypted at rest and used only to generate QR codes on your account and check the status of the payments you created.
Payment records
For every payment you create: the amount, currency, your own reference and description, our identifier and the Fonepay reference number, status and timestamps, and — where Fonepay reports them to us — the payer's name, bank and the transaction trace identifier. We store this because it is your record of your own sales, and because we are expected to be able to reconstruct a transaction.
Technical and security records
API keys (as hashes), the IP address and time of sign-ins and API calls, webhook delivery attempts and their responses, and an audit log of actions taken on your account — by you, by your team, and by our staff. We keep these to investigate problems, to show you what happened, and to detect misuse.
Why we are allowed to hold it
- To perform our contract with you — running the account, generating QRs, billing you.
- To meet legal obligations — verification, tax and accounting records.
- For our legitimate interests — securing the platform, preventing fraud and abuse, and supporting you when something goes wrong.
Who else sees it
We share only what a given service needs to do its job:
- Fonepay — the amount, your merchant code, the reference number and the remarks you set, in order to generate a QR and report its status.
- Aakash SMS — your phone number and a verification code, to confirm the number is yours.
- Brevo — your email address and the content of the email, to deliver messages such as verification links.
- OpenAI — the PAN or VAT certificate you upload, if you ask us to read it for you, so we can fill your business details into the verification form instead of you typing them. This happens only when you choose the "read my certificate" option; uploading the document without it sends the file nowhere. It is sent for that one reading, and under OpenAI's API terms it is not used to train their models. You can always fill the form in by hand instead.
- Laayo Services Pvt. Ltd. — Qora is a product of this company, and its staff administer the platform. Their access is logged, and a support session opened against your account is read-only and shown to you.
- Authorities — where we are required by Nepali law to disclose, and where we are permitted to, we will tell you.
We do not sell personal data, and we do not share it for anyone else's marketing.
Where it is held
Qora's data is stored in its own database, on servers we operate. Some processors named above operate outside Nepal, which means the data they handle is processed abroad.
How long we keep it
- Account and payment records — for as long as your account is open, and afterwards for as long as tax and accounting law requires.
- Verification documents — for the life of the account and the retention period that applies to verification records afterwards. Replacing a document deletes the file it replaced.
- Audit and security logs — retained so that a past action can still be explained.
- Verification codes and idempotency keys — short-lived by design and pruned automatically, in minutes and hours respectively.
Security
Traffic is encrypted in transit. Fonepay credentials, two-factor secrets and similar values are encrypted at rest. Passwords are hashed and are not recoverable. Secret API keys are stored only as hashes and shown once. Verification documents sit on private storage that is not reachable from the web. Access by our staff is logged against the individual, and a support session cannot make changes to your account.
No system is perfectly secure. If a breach affects your data we will tell you and the relevant authorities without undue delay.
Your choices
You can see and correct most of what we hold from the dashboard. For anything else — a copy of your data, correction of something you cannot edit, or deletion of data we are not required to keep — write to support@laayo.com.np and we will respond within 30 days.
Some data we cannot delete on request, because we are required to keep it: completed transaction records and verification documents are the usual examples. We will tell you when that applies and why.
Cookies
We set a session cookie so you stay signed in, and a cookie carrying the token that protects forms against cross-site request forgery. Your theme preference is stored in your browser. We use no advertising or cross-site tracking cookies, and no third-party analytics that profile you.
Children
Qora is for registered businesses and is not directed at children.
Changes
If we change this policy in a way that materially affects you, we will tell you by email before it takes effect. The date at the top of this page is always the date of the current version.
Contact
Laayo Services Pvt. Ltd.
New Kanchanjunga Tole, Birtamode-03, Jhapa, Nepal
support@laayo.com.np