WalyPay Privacy Policy
Last updated: May 15, 2026
At WalyPay we value your privacy. This Policy explains what data the WalyPay mobile application (the "App"), available on Google Play, collects, how we use it, with whom we share it, and the rights you have over it.
1. Data Controller
2. Data we collect
The App collects only the data needed to perform its core function of detecting and recording payments received through Yape and Plin:
- Payment app notification content: when a notification is issued by Yape or Plin, we read its text to extract the amount received, the sender's name, and the transaction date/time.
- Device identifier: used to link the device to the merchant account and prevent duplicates.
- WalyPay account credentials: email and password (hashed) required to authenticate the merchant.
- Basic technical data: App version, device model, and anonymized crash logs.
We do not read notifications from apps other than Yape and Plin. All other system notifications are discarded with no storage.
3. How we use the data
- Detect incoming Yape and Plin payments and register them on the merchant account.
- Sync transactions with the merchant's web dashboard at walypay.me.
- Notify the merchant of received transactions.
- Prevent fraud and duplicate payments.
- Improve App stability and security.
4. Special permissions used
The App declares and uses the following sensitive Android permissions:
- Notification access (NotificationListenerService): Essential to detect incoming Yape and Plin payments. Without it, the App cannot fulfill its core function. The App strictly filters and only processes notifications from the official Yape (
pe.com.bcp.bcv) and Plin packages.
- Background execution (FOREGROUND_SERVICE): Needed to keep notification listening active so payments are not missed when the screen is off or the App is not open.
- Internet access: To send detected payment data to the WalyPay server.
- Wake Lock: To prevent the system from suspending the service while processing a payment notification.
5. Who we share data with
- We do not sell, rent, or transfer your data to third parties for commercial or advertising purposes.
- Data is stored on WalyPay servers (Hostinger, location: Europe/USA) and is only accessible by the merchant who owns the account and by authorized WalyPay staff for technical support.
- We only share data when required by a competent authority through a valid legal request.
6. Storage and security
- Encryption in transit: all communication between the App and our servers uses HTTPS/TLS.
- Encryption at rest: passwords are stored with a cryptographic hash (bcrypt). Sensitive database data is protected with access controls.
- Retention period: transaction records are kept while the merchant account is active, and up to 5 years after account closure for tax and accounting reasons. After that period data is deleted or anonymized.
7. Your rights
As a user you have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate or incomplete data.
- Delete your account and all associated data (see section 8).
- Object to the processing of your data.
- Portability: receive a copy of your data in a structured format.
To exercise any right, write to [email protected]. We will respond within 30 days.
8. Account and data deletion
You can request full deletion of your WalyPay account and data at any time through two channels:
- From the App: open WalyPay → Profile → "Delete my account". Confirm the action. Your account and data will be deleted within 7 days.
- From the web: send an email to [email protected] from the email registered to your account with the subject "Account deletion request". We will process the request within 7 business days.
What is deleted? All associated personal data (email, device, settings, detected transaction history). Some records may be retained in backups for up to 30 days before permanent deletion, or longer if the law requires retention (e.g. tax records).
9. Minors
The App is not intended for users under 18, as it is designed for professional commercial use. We do not knowingly collect data from minors under 13. If we detect that a minor has created an account, we will delete it.
10. Changes to this Policy
We may update this Policy periodically. When we make significant changes, we will notify you via a prominent in-App notice or by email to the registered address. The "Last updated" date at the top will always indicate the current version.
11. Regulatory compliance
This Policy is governed by Peru's Personal Data Protection Law No. 29733 and, where applicable, by the European Union's General Data Protection Regulation (GDPR) for European users.
12. Contact
For any inquiry about this Policy or about how we handle your data: