Last updated: September 2026
At Esaalat, the Payment Verification Platform, we are committed to protecting your privacy and being transparent about how we collect, use, and share your personal information. This Privacy Policy explains our practices in clear, honest terms. Esaalat verifies that the payments you receive in your own e-wallet match the orders you create. We do not hold or move your funds, we are not a bank or a money transfer service, and we do not carry out identity or document verification.
To provide our payment verification service, we collect the following information:
Esaalat Agent is the Android app that merchants install on the phone receiving their e-wallet payment alerts. Its only purpose is to detect those alerts, extract the payment details on the device, and send them to Esaalat so the matching order is verified automatically. There is no wallet provider API. The SMS alert is the only source of payment information. This section describes the data that app handles.
The app asks for one Android permission to do its work: Receive SMS, so that it is notified when a new wallet payment alert arrives. It may also ask for notification permission, purely so it can show a brief notice while an alert is being processed; that permission is optional and monitoring works without it. It starts listening only from the moment you grant access, and never reads messages that arrived before that. Access is granted only after you have read the in-app disclosure and explicitly consented. Esaalat is not a general-purpose SMS reader: the app has no inbox, search, export, backup or forwarding feature, and SMS access is used for nothing other than the payment verification described here.
Only messages that pass two deterministic filters are ever read. First, a sender filter you control: you configure in the app which sender identifiers (names or numbers) belong to each of your monitored wallets, and messages from any other sender are discarded before their content is read. Second, a format filter: the message must look like a supported payment alert, meaning it carries an amount together with a payment signal. Personal messages, promotions, one-time passwords and malformed messages are ignored.
Parsing happens on your device. From a matching alert the app extracts only the transaction direction (money in or money out), the amount, an operation or reference number when one is present, and the time the alert was received. The app does not collect your message history, contacts or conversations, and it never uploads the raw SMS text: only the extracted fields and a one-way SHA-256 hash of the alert are transmitted, so that the same alert is not counted twice. That data is sent to Esaalat's servers over HTTPS and is never shared with advertisers, analytics providers or data brokers.
An incoming alert is held on the device encrypted with a device-bound Keystore key, only until its payment details have been extracted and never longer than 7 days, after which nothing readable remains. The app also keeps a short local activity log of the last 200 alerts it processed. It shows the amount, time and outcome but never the message text, so you can see what it processed. It runs no background task between messages and stays inert until an SMS actually arrives.
The app does not use SMS sending, MMS, WAP push, call logs, contacts, location or accessibility services, and it does not read other apps' notifications. It contains no advertising, marketing, analytics or tracking SDK.
We use your information for the following purposes:
We are transparent about when and why we share your data:
If you are a service provider (merchant), clients who use your services through Esaalat can view certain information about you, including your business name and relevant transaction details necessary to complete the payment.
We use a small number of vendors to run the platform: cloud hosting, email delivery for account and payment notifications, and a bot protection service that checks accounts are created by people rather than automated scripts. These vendors process your data only on our instructions and are contractually bound to protect it. We do not share your data with banks, payment processors or e-wallet providers, because money moves directly between your customer and your own wallet and Esaalat only verifies the alerts your wallet sends you.
We may disclose your information when required by law, a court order, or a valid government request, or when we need to establish, exercise or defend a legal claim.
In the event of a merger, acquisition, or sale of assets, your information may be transferred to the new entity, subject to the same privacy protections.
We implement industry-standard security measures to protect your information, including encryption, secure servers, and access controls. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.
We retain your personal information for as long as necessary to provide our services and to comply with our legal obligations. Transaction records are kept while they may still be needed to verify a payment, resolve a dispute, or meet accounting and legal requirements.
You have the following rights regarding your personal information:
To exercise these rights, please contact us using the information provided below.
We use cookies and similar technologies to keep you signed in and to protect your session. You can control cookies through your browser preferences.
Our platform may contain links to third-party websites or services. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies.
Our services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected such information, we will take steps to delete it.
We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on our website and updating the 'Last Updated' date. Your continued use of our services after such changes constitutes acceptance of the updated policy.
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: