Effective Date: 24 January 2026
Last Updated: 9 October 2026
Pay KureGhor, operated by Code KureGhor, located at 312/4 M, Section-1, Mirpur, Dhaka-1216, Bangladesh (“we,” “us,” or “our”), processes information to provide account management, payment requests, invoices, payment verification, and related support.
This Privacy Policy explains what information is processed through our services, why it is used, and when it may be shared. It applies to website visitors, account holders, merchants, and customers whose information is submitted through a Pay KureGhor integration or checkout.
The information we receive depends on how you use the service and which features the merchant enables.
We collect registration and profile information such as your first and last name, email address, phone number, and account authentication information.
If Google sign-in is enabled and you choose to use it, we receive the profile information authorized through that sign-in process, such as your name and email address.
We process merchant and brand information, support contact details, configured payment accounts, integration settings, API credentials, device keys, and callback or webhook addresses.
Some integrations require payment-provider credentials or access tokens to communicate with the provider.
We may receive customer names, email addresses, phone numbers, billing or invoice addresses, invoice items, quantities, prices, discounts, payment amounts, and other information submitted by a merchant through checkout, payment links, invoices, or an API.
Merchants may also submit additional order information or metadata. They should avoid including personal information that is unnecessary for the transaction.
We process payment methods, transaction references, invoice identifiers, amounts, charges, timestamps, payment statuses, submitted payment references, and relevant responses received from payment providers.
When a merchant connects a device for SMS-based verification, we receive and store the message content and sender identifier forwarded through that connection, together with the associated merchant account and receipt timestamp.
The stored information can include the full forwarded message, rather than only the transaction ID or amount. Depending on the message, this may include phone numbers, account identifiers, transaction references, payment amounts, or account balances.
The information we receive depends on what the connected device or forwarding application sends. Merchants should configure forwarding to exclude unrelated personal messages and unnecessary sensitive information.
We process connected-device information such as the merchant email used for connection, device keys, device IP addresses, and connection status.
Our website also uses session and authentication information. Technical logs may contain request details and information needed to diagnose errors, maintain service availability, or investigate misuse.
If you contact us, we process the information you provide, including correspondence, transaction references, and supporting material needed to investigate your request.
Do not send passwords, wallet PINs, one-time passwords, or unnecessary sensitive information through support channels.
We receive information:
Directly from users during registration, checkout, or support interactions.
From merchants through invoices, payment links, and API requests.
From connected devices and SMS-forwarding integrations.
From payment providers through enabled integrations.
Through website sessions and service-operation records.
A customer may therefore have information processed by Pay KureGhor without creating a Pay KureGhor account.
We use information to:
Create and administer accounts.
Provide checkout, invoices, payment links, and merchant integrations.
Verify payment information and record transaction status.
Associate payment records with the relevant merchant and invoice.
Deliver payment confirmations, account notifications, and support responses.
Manage subscriptions, charges, and transaction limits.
Investigate discrepancies, suspected fraud, and unauthorized activity.
Maintain and troubleshoot the service.
Meet applicable legal obligations and resolve disputes.
Where applicable law requires a legal basis, processing is based on providing the requested service, complying with legal obligations, legitimate operational and security interests, or consent where required.
For supported SMS-based payments, our system searches stored messages associated with the merchant and compares payment details such as the sender identifier, message format, transaction reference, amount, and whether a message has already been used.
For supported API-based payments, our system processes information returned by the relevant payment provider. Certain payment references are submitted for manual review.
These checks may automatically update payment status. Missing messages, incorrect references, disconnected devices, or provider errors can affect the result.
If you believe a payment result is incorrect, contact the merchant or our support team and provide the relevant transaction reference so the issue can be reviewed.
Information may be disclosed where necessary to provide the service, investigate issues, or comply with law.
The merchant associated with a transaction and its authorized account users may access relevant customer, invoice, payment, and verification information.
Payment status and configured transaction details may also be sent to the merchant’s systems through APIs, callbacks, webhooks, or notifications.
Relevant transaction and integration information may be exchanged with the payment provider used for a payment.
Hosting, infrastructure, email, SMS, and technical-support providers may process information as needed to operate the service.
Authorized personnel may access relevant records to administer the platform, review payments, investigate fraud, or respond to support requests.
We may disclose information where required by applicable law or a valid legal request, or where legally permitted and reasonably necessary to protect users, investigate fraud, or establish or defend legal claims.
Information sharing should be limited to what is necessary for the relevant purpose.
Merchants determine what customer and order information they submit and how they use information available through their accounts.
For information processed on a merchant’s instructions, our role may be that of a service provider or data processor, depending on the arrangement and applicable law. For our own account administration, security, billing, and legal obligations, we determine the purposes of processing.
The merchant’s privacy policy applies to its own business activities. For questions about an order or the merchant’s use of your information, contact the merchant directly.
We use cookies and similar mechanisms for website sessions, authentication, and available sign-in preferences.
Disabling these cookies may prevent login or affect checkout and other features.
We retain information for as long as reasonably necessary to provide the service, maintain transaction records, investigate disputes, prevent misuse, and meet applicable legal obligations.
Retention depends on the type of information, whether the account remains active, unresolved transactions or complaints, and any legally required retention period.
Account closure does not necessarily result in immediate deletion of all transaction records. Records subject to legal or dispute-related retention may be kept after closure.
We recognize that account credentials, payment records, and forwarded messages require careful protection.
No internet-based service or electronic storage method can guarantee absolute security. Users and merchants should protect their credentials, restrict device access, and report suspected compromise promptly.
Where legally required, we will provide notifications concerning a personal-data breach.
Depending on applicable law and our role in processing the information, you may be entitled to request access, correction, deletion, restriction, portability, or to object to certain processing.
Where processing relies on consent, you may withdraw that consent. Withdrawal does not affect processing lawfully carried out beforehand.
You may also request account closure or assistance disconnecting a device. Some requests may need to be directed to the merchant responsible for the information.
We may verify your identity before acting on a request. Certain information may need to be retained to meet legal obligations, investigate fraud, or resolve an existing dispute.
To submit a privacy request, contact abuse@codekureghor.com.
If our hosting or service providers process information outside your country, your information may be transferred to and processed in those locations.
Any such processing must comply with applicable legal requirements.
Merchant accounts are intended for adults and authorized business representatives.
Merchants must comply with applicable requirements when collecting information from children. If you believe a child’s information has been submitted unlawfully, contact us so we can review the matter.
Payment-provider pages, merchant websites, Google sign-in, and other external services operate under their own privacy policies.
Review those policies to understand how the relevant provider processes information you submit directly to it.
We may update this Privacy Policy when our services or information-handling practices change.
The updated version will show its effective date. Material changes will be communicated through the platform or available account contact details where appropriate or legally required.
For privacy questions or requests, contact:
Legal business name: Code KureGhor
Business address: 312/4 M, Section-1, Mirpur, Dhaka-1216, Bangladesh
Privacy email: abuse@codekureghor.com
Support email: org@codekureghor.com
Website: www.codekureghor.com