AutoPay Scan helps you see all the recurring debits running through your bank account using India's RBI-licensed Account Aggregator framework. The scan is free. You give explicit, time-bound consent every time. We never see your transactions — only structured information about your active mandates. We don't sell your data. We don't share it with advertisers. We use it only to show you your auto-debits and to help you act on them. You can revoke your consent anytime, and we'll delete the related data.
1. About these Terms
These Terms of Use ("Terms") govern your use of the AutoPay Scan feature available at scan.mitigata.com (the "Platform"), operated by Alphawave Technologies Private Limited, a company incorporated under the Companies Act, 2013, having its registered office at 2nd Floor, Gayathri Mansion, ORR, Bellandur, Bangalore, 560103 ("Mitigata", "we", "us", or "our").
By accessing or using AutoPay Scan, you ("User", "you", or "your") agree to be bound by these Terms, our Privacy Policy, and any additional terms applicable to specific services (such as Cyber Insurance or the Assistance Service) that you separately purchase or subscribe to. If you do not agree with these Terms, please do not use AutoPay Scan.
2. Eligibility
To use AutoPay Scan, you must:
- Be at least 18 years of age and competent to enter into a legally binding contract under the Indian Contract Act, 1872;
- Be a holder of one or more bank accounts with a bank that is integrated with India's Account Aggregator (AA) framework;
- Be using AutoPay Scan in respect of accounts of which you are the lawful primary or joint holder; and
- Not be a person prohibited from using the Platform under any applicable law or by any regulatory authority.
3. What AutoPay Scan does
AutoPay Scan is a tool that, with your explicit and revocable consent, retrieves structured information about recurring-debit instructions linked to your bank account(s) through India's RBI-licensed Account Aggregator framework. Specifically, AutoPay Scan:
- Allows you to initiate a consent request through an RBI-licensed Account Aggregator that we've partnered with;
- Receives, on your authorisation, a Financial Information data package from your bank (acting as Financial Information Provider, or "FIP") regarding active recurring-debit mandates and similar standing instructions on your account;
- Displays this information to you in a consolidated dashboard, including the merchant or biller name (where available), the mandate amount, the frequency, and the next-debit date;
- Where supported, provides direct links or guidance to enable you to cancel or modify a mandate through your bank or the originating merchant;
- Optionally, where you have additionally consented, allows our AI agent (and/or our human Assistance team, if separately subscribed to) to assist you in interpreting and acting on the dashboard.
4. What AutoPay Scan is not
- AutoPay Scan does not cancel mandates on your behalf. Cancellation must be effected by you, either through your bank's app/website or directly with the merchant.
- AutoPay Scan does not have access to and does not process individual transactions, transaction descriptions, balances, or transaction-level financial information.
- AutoPay Scan is not a banking or payments service. We don't initiate, route, modify, or reverse any transaction.
- AutoPay Scan does not guarantee the accuracy, completeness, or timeliness of mandate information received from your bank through the AA framework. We rely on the data your bank shares.
- AutoPay Scan is not investment advice, legal advice, tax advice, or insurance advice. Decisions you take based on the information shown to you (including cancelling a mandate) are entirely your own.
5. The Account Aggregator framework
AutoPay Scan operates within India's Account Aggregator framework, established by the RBI under the Master Direction — Non-Banking Financial Company — Account Aggregator (Reserve Bank) Directions, 2016, as amended.
Within this framework, when you use AutoPay Scan:
- Your bank acts as the Financial Information Provider ("FIP").
- Mitigata acts as a Financial Information User ("FIU").
- Decimus Financials Limited, an RBI-licensed NBFC, acts as the Account Aggregator. The Account Aggregator is the consent-management entity. It does not store your financial data.
By proceeding with the AA-based consent flow, you authorise the secure transfer of your specified Financial Information from your bank to Mitigata. The consent you provide is granular, time-bound, purpose-bound, and revocable, in accordance with the AA framework. Any revocation will, going forward, prevent further data sharing, but does not retroactively reverse data already shared.
6. Consent and authorisation
Your use of AutoPay Scan requires explicit consent at multiple stages:
- Initiation: You initiate the scan by entering your registered mobile number on scan.mitigata.com and choosing your bank.
- AA Consent: You're redirected to your chosen Account Aggregator's consent flow. There, you authenticate (typically via OTP linked to your mobile number registered with the bank), select the account(s) for which to grant consent, and approve a granular, time-bound consent artefact.
- Data receipt and display: Upon successful consent, the AA facilitates the encrypted transfer of the requested Financial Information from your bank to Mitigata. We then display this in your dashboard.
- Optional AI Agent access: To allow our AI agent to discuss your specific mandate data with you, you must provide an additional, separate consent.
You may revoke any of these consents at any time, either through the dashboard or, for AA-level consent, through the Account Aggregator's interface. Upon revocation, we'll cease further data processing and delete or anonymise the relevant data.
7. Authentication and security
- AutoPay Scan does not require you to set a password with us. Authentication is performed through your mobile-number OTP and through the AA partner's authentication flow.
- You are responsible for the security of the mobile number and email associated with your AutoPay Scan use, and for promptly notifying us of any suspected unauthorised access.
- You agree not to use anyone else's bank account, mobile number, or identity to use AutoPay Scan.
- You agree not to attempt to circumvent any security feature of the Platform, conduct any reverse-engineering, or interfere with the AA framework's protocols.
8. Free service; future paid features
AutoPay Scan is currently offered to you free of charge. Mitigata reserves the right, with reasonable advance notice, to introduce charges or change feature limits on the free tier. Any such change will not retroactively apply to data already processed under the previous terms.
If you separately subscribe to Group Cyber Insurance, the Mitigata Assistance Service, or any other paid product, those products are governed by their own product-specific terms presented at the time of purchase.
9. Permitted use
You agree to use AutoPay Scan only for personal, lawful purposes. You agree not to:
- Use AutoPay Scan for any commercial purpose without our prior written consent;
- Use AutoPay Scan in respect of any account that is not lawfully held by you;
- Submit false, misleading, or fraudulent information;
- Resell, redistribute, scrape, or otherwise systematically extract data from the Platform;
- Use the Platform in any manner that could damage, disable, overburden, or impair our infrastructure;
- Use the Platform to violate the rights of any third party;
- Use any automated means (bots, scrapers, etc.) to access the Platform other than authorised APIs.
10. Intellectual property
All content on scan.mitigata.com — including the Platform's design, code, text, graphics, logos, dashboards, the AI agent's responses, the underlying knowledge base, and the AutoPay Scan reports themselves (excluding the underlying customer data which belongs to you) — is the intellectual property of Mitigata or our licensors and is protected under applicable Indian and international intellectual-property laws.
You're granted a limited, non-exclusive, non-transferable, revocable licence to use the Platform for your personal, non-commercial use, in accordance with these Terms.
11. Disclaimers
AutoPay Scan is provided on an "as is" and "as available" basis. To the maximum extent permitted by applicable law:
- We make no warranty that AutoPay Scan will be uninterrupted, error-free, or completely secure;
- We make no warranty regarding the accuracy or completeness of any data received from your bank through the AA framework — we display what your bank shares;
- We don't warrant that any specific mandate, when cancelled by you, will result in any specific outcome (refund of past debits, prevention of future debits in time, or cessation of service from the merchant);
- We don't endorse or take responsibility for any merchant, biller, OTT service, or other entity whose mandate appears in your dashboard.
12. Limitation of liability
To the maximum extent permitted by applicable law, in no event shall Mitigata, its directors, employees, agents, or partners be liable for any indirect, incidental, consequential, exemplary, or punitive damages arising out of or in connection with your use of AutoPay Scan, including: loss of profits, loss of data, loss of goodwill, or losses arising from a mandate you chose not to cancel, chose to cancel, or could not cancel through us.
Our aggregate liability in respect of any claim shall not exceed INR 10,000 for the free service, or 12 months of fees paid for paid services, whichever is greater. Nothing in this clause limits any liability that cannot be limited under applicable Indian law (including liability for fraud, gross negligence, or wilful misconduct).
13. Indemnity
You agree to indemnify, defend, and hold harmless Mitigata and its directors, employees, agents, and partners against any claims, demands, losses, liabilities, damages, costs, and expenses (including reasonable legal fees) arising out of: (a) your breach of these Terms; (b) your use of AutoPay Scan in respect of any account you don't lawfully hold; (c) your violation of any applicable law in your use of the Platform; or (d) your infringement of any third-party rights.
14. Suspension and termination
We reserve the right to suspend or terminate your access to AutoPay Scan, with or without notice, if we reasonably suspect a breach of these Terms, fraudulent or unauthorised use, if continued operation would be unlawful, if required by a regulatory authority or court, or if we discontinue AutoPay Scan as a feature with reasonable advance notice.
You may stop using AutoPay Scan at any time. You may also revoke any active consents and request deletion of your data through the channels described in the Privacy Policy.
15. Changes to these Terms
We may update these Terms from time to time to reflect changes in our services, applicable law, or our business practices. Material changes will be communicated to you with reasonable advance notice through the Platform, by email, or by SMS, before they take effect. Your continued use of AutoPay Scan after the effective date of the updated Terms constitutes acceptance of the updated Terms.
16. Governing law and disputes
These Terms shall be governed by and construed in accordance with the laws of India. Subject to the dispute-resolution clause below, the courts of Bangalore shall have exclusive jurisdiction.
In the event of any dispute, the parties shall first attempt to resolve the matter amicably through good-faith discussions for 30 days. If unresolved, it shall be referred to arbitration under the Arbitration and Conciliation Act, 1996, before a sole arbitrator appointed by mutual consent. The seat and venue of arbitration shall be Bangalore. The language of the arbitration shall be English.
17. Grievance redressal
In compliance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the Digital Personal Data Protection Act, 2023, we have appointed a Grievance Officer:
| Name | Abhishek Srivastav |
|---|---|
| Designation | Grievance Officer |
| grievance@mitigata.com | |
| Postal address | Gayathri Mansion, 2nd Floor, ORR, Bellandur, Bangalore, 560103 |
| Working hours | Monday to Friday, 10:00–18:00 IST (excluding public holidays) |
| Acknowledgement | Within 24 hours of receipt |
| Resolution | Within 15 days of receipt, in line with the IT Rules |
We collect your mobile number, email, and the mandate-level data your bank shares through the Account Aggregator. We do not collect or see your individual transactions or balances. We use this data to show you your active mandates and help our AI agent answer your questions about them. We do not sell your data. We do not share it with advertisers or data brokers. Limited sharing happens only with our AA partner, our cloud and security service providers, and where law requires. We store your data in India, encrypt it, and apply strict access controls. You can ask us to delete your data at any time, and we will.
1. About this Privacy Policy
This Privacy Policy describes how Alphawave Technologies Private Limited ("Mitigata", "we", "us", or "our") collects, uses, shares, retains, and protects your personal data when you use AutoPay Scan at scan.mitigata.com. It is issued in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 and rules made thereunder, and other applicable Indian law.
For the purposes of the DPDP Act, you are a "Data Principal" and Mitigata is a "Data Fiduciary".
2. Data we collect
2.1 Data you provide directly
| Data | When collected | Why |
|---|---|---|
| Mobile number | When you initiate the scan | To authenticate you, identify your bank in the AA flow, and communicate scan results |
| Email address (optional) | If you choose to receive your report by email | To deliver your report and follow-ups |
| Name (optional) | If you provide it for personalisation | To personalise the dashboard and AI agent responses |
| Choice of bank(s) | When you select bank(s) for scanning | To route the AA consent request |
2.2 Data received through the Account Aggregator
With your explicit, granular consent through an RBI-licensed Account Aggregator, we receive structured Financial Information about active recurring-debit mandates linked to your selected bank account(s). Specifically, this includes:
- The merchant or biller name associated with the mandate (where the bank shares this);
- The mandate amount or upper limit;
- The frequency of the recurring debit (monthly, quarterly, etc);
- The mandate validity period and next-debit date;
- The mandate type (UPI AutoPay, NACH, Standing Instruction);
- Mandate identifiers and reference numbers shared by your bank for cancellation guidance;
- Limited account-identification information (such as masked account number) sufficient to associate the mandates with the correct account in your dashboard.
2.3 Data we do not collect
- Your individual transaction history, transaction descriptions, or balances;
- Your debit/credit card details, CVV, OTPs, internet-banking credentials, or UPI PIN;
- Your full Aadhaar number, biometrics, or full PAN;
- Personal data from anyone under 18.
2.4 Data we collect automatically
| Data | Purpose |
|---|---|
| Device and browser information | Security, fraud prevention, ensuring compatibility |
| IP address and approximate location (city-level) | Security, fraud prevention, debugging |
| Usage logs (pages visited, features used, time spent) | Service improvement, analytics |
| Cookies and similar technologies | Session management, preferences, analytics |
3. How we use your data
We use your personal data only for the following specified purposes, in line with DPDP Act principles of purpose limitation and data minimisation:
- To deliver AutoPay Scan: showing you your dashboard of active mandates;
- To enable AI agent assistance, where you've additionally consented;
- To send you the scan report, follow-up summaries, and important service-related communications;
- To recommend, in a non-pressured manner, complementary products such as Cyber Insurance and the Assistance Service. You can opt out of marketing at any time;
- To improve AutoPay Scan and develop new features, using aggregated and anonymised insights — never to sell your individual data;
- To detect and prevent fraud, abuse, and security incidents;
- To comply with our legal and regulatory obligations.
We will not use your data for any new, materially different purpose without obtaining a fresh consent from you.
4. Legal basis
Under the DPDP Act, we process your personal data on the following bases:
- Consent: Most of our processing relies on your free, specific, informed, unconditional, and unambiguous consent. The AA-flow consent and any optional consents are examples.
- Legitimate uses: As permitted under Section 7 of the DPDP Act, we may process limited data for fulfilling a contract, complying with a legal obligation, or protecting against fraud and security incidents.
5. How we share your data
With the Account Aggregator and your bank
In the AA flow, your data is exchanged between your bank (FIP), the Account Aggregator (consent manager), and Mitigata (FIU) per the RBI's AA framework specifications.
With service providers (Data Processors)
We use carefully-vetted third-party service providers to deliver AutoPay Scan, including cloud-infrastructure providers (hosted within India), communications providers (for SMS, email, OTP delivery), analytics and security providers, and customer-support tools (only where you initiate a support conversation). These providers are contractually bound to process your data only on our instructions, only for the purposes specified, and only with appropriate security safeguards.
With AI / language model providers
If you choose to interact with our AI agent and grant the additional consent, your queries and a tokenised, masked version of your scan data may be processed by language-model infrastructure to generate responses. Sensitive identifiers are tokenised or masked before any model invocation. We do not use your conversation data to train external vendors' models. External inference is under contracts requiring confidentiality, no-retention beyond the inference window, and no use for the provider's own purposes.
With authorities and as required by law
We may share data with regulators, law-enforcement, or courts where required by Indian law (IT Act 2000, DPDP Act 2023, RBI directions), by a binding court order, or where reasonably necessary to investigate fraud or threats to safety. We will, where lawfully possible, notify you before complying.
We do not sell your data
We do not sell, rent, lease, or trade your personal data to advertisers, data brokers, or any other third party for profit. This is a foundational commitment of the Mitigata business model.
6. Storage, security, and retention
Data localisation
We store your personal data on infrastructure located in India. Where any limited cross-border processing is necessary (certain analytics or model-inference providers), we'll only do so to jurisdictions permitted under the DPDP Act and applicable government notifications.
Security measures
- Encryption in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent);
- Strict access controls on a need-to-know basis, with role-based permissions and audit logs;
- Regular security testing, including vulnerability assessments and penetration tests;
- Tokenisation and masking of sensitive identifiers before AI/ML processing;
- Continuous monitoring and incident-response procedures;
- Employee training on data protection and confidentiality.
Retention
| Data category | Retention period |
|---|---|
| AutoPay Scan results (active mandate dashboard) | Up to 12 months from last scan, unless you delete earlier |
| Conversation logs with AI agent | Up to 12 months from conversation, unless you delete earlier |
| Account profile data (mobile, email) | Until you request deletion, or 24 months of inactivity |
| Aggregated and anonymised analytics | May be retained indefinitely (cannot be associated with you) |
| Records required by law | For the period mandated by the relevant law |
7. Your rights
Under the DPDP Act, you have the following rights in respect of your personal data:
| Right | What it means |
|---|---|
| Right to information | Ask for a summary of personal data we are processing about you and what we've done with it. |
| Right to correction | Ask us to correct inaccurate, complete incomplete, or update outdated personal data. |
| Right to erasure | Ask us to delete your personal data, except where we're required by law to retain it. |
| Right to withdraw consent | Withdraw any consent you've given, at any time, with the same ease with which you provided it. |
| Right to grievance redressal | Raise concerns with our Grievance Officer. |
| Right to nominate | Nominate another individual to exercise your rights in case of your death or incapacity. |
To exercise any of these rights, contact our Grievance Officer at grievance@mitigata.com. We'll acknowledge your request within 24 hours and respond within the timelines required under applicable law.
8. Cookies
We use cookies for: strictly necessary purposes (session management, security, authentication — these can't be disabled while using the Platform); performance and analytics — to understand how AutoPay Scan is used; and preferences — to remember your settings. You can control cookies through your browser settings. Disabling certain cookies may affect functionality.
9. Children's data
AutoPay Scan is not intended for use by individuals under 18. We do not knowingly collect personal data from minors. Under the DPDP Act, processing of children's personal data requires verifiable parental consent, and certain types of processing (such as targeted advertising) are prohibited. Mitigata's policy is to avoid all processing of children's data on this Platform.
10. Marketing
We may send you service-related messages (always — these are essential to the service: scan completion, consent expiry reminders) and marketing messages about other Mitigata products (only if you have not opted out). You can opt out of marketing at any time via the unsubscribe link in our emails or by writing to our support email. Opting out of marketing will not stop service-related messages.
11. Data breaches
In the unlikely event of a personal-data breach affecting your data, we'll notify the Data Protection Board and affected Data Principals within the timelines and in the manner prescribed under the DPDP Act and rules. We'll also describe the nature of the breach, the data affected, the consequences, and the mitigation measures we've taken.
12. Changes to this Policy
We may update this Privacy Policy from time to time. Material changes will be notified to you in advance through the Platform, by email, or by SMS, before they take effect. Your continued use of AutoPay Scan after such notification will constitute acceptance.
13. Contact — Grievance Officer
| Grievance Officer | Abhishek Srivastav |
|---|---|
| grievance@mitigata.com | |
| Postal address | Gayathri Mansion, 2nd Floor, ORR, Bangalore, 560103 |
| Working hours | Monday to Friday, 10:00–18:00 IST (excluding public holidays) |
| Acknowledgement | Within 24 hours of receipt |
| Resolution | Within 15 days, or as required by applicable law |