What they may do · DPDP §6(4)
What HP PAY (HPCL) does with your data
HP Pay pools your data across HPCL group companies to build 'singular profiles' for marketing, logs third-party sites you used before visiting, offers biometric login, and may keep your information after you close your account.
-
Shares your data with partners
Passed to group companies, advertisers or analytics firms you never chose.
What this costs you. Your number and habits travel to companies you have never heard of and never agreed to. This is the step where the spam calls start.
Show me where they say that
HP PAY (HPCL)’s own policy says “We may disclose your Personal Information to any of our Agents or Third Parties insofar as reasonably necessary for the purposes set out in this Privacy Policy and for the purpose of providing our products and services to you.”
Our summary shares with Agents — defined as HPCL's distributors, dealers, CFA and contractors — and with group companies, financial institutions, legal advisers and consultants, government authorities, providers of communication, marketing, storage, analytics, fraud-detection and research services, and any acquirer in a merger or restructuring.
-
Builds an advertising profile of you
They watch what you view, tap and buy, and use it to decide which ads you see.
What this costs you. Your attention gets priced. What you hesitate over becomes a bid — and a profile built to predict you is a profile built to persuade you.
Show me where they say that
HP PAY (HPCL)’s own policy says “to our group companies including affiliates, associates, joint ventures or are otherwise controlled by / under the common control of HPCL to enable us to assimilate the information and create singular profiles, which may enable us to offer personalized products or services, cross-sell products or services offered by other members of the group companies of HPCL, and undertake relevant marketing initiatives, etc., which are broadly in line with the purpose mentioned herein.”
Our summary data is assimilated across HPCL group companies to create 'singular profiles' used for personalised offers, cross-selling and marketing initiatives. The policy separately permits providing third parties with statistical information about customers and allowing them to contact the user.
-
Follows you onto other websites and apps
Their tracking carries on after you leave, through pixels and SDKs embedded elsewhere.
What this costs you. You get recognised on sites that have nothing to do with them. Closing the app does not close the file.
Show me where they say that
HP PAY (HPCL)’s own policy says “Data about how you use our websites or mobile applications including through the use of cookies or other tracking software. This includes data such as access dates and times, website or app features or pages viewed, website or app crashes and other system activity, type of browser, and third-party sites or services used before or in the course of interacting with our services.”
Our summary usage data gathered through cookies or other tracking software includes third-party sites or services the user used before or during their interaction with the service. The policy also states it may receive information about the user from business partners, technical sub-contractors, analytics providers and search information providers.
-
Keeps your records long-term
Held on after you stop using the service.
What this costs you. Years after you delete the app, the record is still sitting there — and every year it sits there is another year it can leak.
Show me where they say that
HP PAY (HPCL)’s own policy says “To ensure compliance with Applicable Laws, we may need to retain information even after you have terminated your account (if any) with us or stopped using our products or services. We may also keep your contact information and other details for fraud prevention and for the exercise/defence of a legal claim or for providing evidence in legal proceedings.”
Our summary information may be retained after account termination for legal compliance, fraud prevention and legal claims, with no stated period. Anonymised and aggregated data may continue to be used post-termination for analytics, research and other business purposes.
-
Processes your face or other biometrics
Face matching, liveness checks or similar.
What this costs you. You can change a leaked password in a minute. You cannot change your face. A biometric breach is permanent in a way nothing else is.
Show me where they say that
HP PAY (HPCL)’s own policy says “We have provided multiple levels of security to safeguard the HP Pay Application by login/logout option and HP Pay Biometric Login (“Enable Biometric Login”) that can be enabled by you.”
Our summary the app provides an optional 'HP Pay Biometric Login'. The profile-details table separately lists KYC information 'such as videos or other online/ offline verification documents as mandated by relevant regulatory authorities'. The policy does not state that biometric identifiers are transmitted to or stored by HPCL.
What the policy does not mention
These are uses HP PAY (HPCL)’s policy is silent on. Silence is not a promise — it means the document does not say, and we do not infer either way.
- Trains AI models on your content
HP PAY is one app. How many are on your phone?
Most people carry twenty to forty. Add yours and see the total in one screen — how many share your data, profile you for ads, or follow you across the web. Then take it back from all of them at once.
Manage my data with Saaph.in →Free to check · no account needed · built in India for the DPDP Act
Questions
What does HP PAY (HPCL) do with my personal data?
According to HP PAY (HPCL)'s own privacy policy, read on 2026-08-14, it discloses 5 of the six uses we track: shares your data with partners, builds an advertising profile of you, follows you onto other websites and apps, keeps your records long-term, processes your face or other biometrics.
Can I withdraw my consent from HP PAY (HPCL)?
Section 6(4) of India's Digital Personal Data Protection Act 2023 gives you the right to withdraw consent for processing you agreed to. The Act's substantive provisions commence in stages up to May 2027, so a request made now asks for voluntary compliance and puts the date on record. Processing a company carries out under a legal obligation — such as KYC records the RBI requires — cannot be withdrawn.
Does HP PAY (HPCL) track me for advertising?
Yes — HP PAY (HPCL)'s published policy discloses this. The exact sentence it is based on is quoted on this page, with the date we read it and a link to the source.
Every use above is one HP PAY (HPCL) declared in its own published privacy policy, which we
read on 2026-08-14. Quotes are verbatim; the summary beside each one is ours
and is labelled as ours. Nothing here is inferred.
Saaph.in is a DPDP consent and request management platform operated by Ronin Works
Private Limited. It is a communication facilitator, not your legal or authorised
representative. The DPDP Act 2023 commences in stages up to May 2027, so a request
made today asks for voluntary compliance and records the date you asked.
Our privacy policy