We built Xlock to protect devices — protecting the data around them matters just as much. This policy explains what we collect, why, and the control you keep over it.
This Privacy Policy describes how Pay5x Infotech Pvt Ltd ("Xlock", "we", "us") handles information when you visit our website, use our device-financing security platform, or interact with a device enrolled on it.
Xlock provides lenders, NBFCs and retailers with tools to remotely lock, unlock, track and recover smartphones sold on installment plans. Delivering that service involves handling two broad kinds of information: data about the businesses that use our platform, and data about the financed devices those businesses manage.
We act as a data processor on behalf of our business customers for device and borrower data they upload, and as a data controller for the account and website data we collect directly. Where our customer sets the purpose of processing, their own privacy notice also applies to the end customer.
Depending on how you interact with us, we may collect:
To secure a financed device, the Xlock agent on that device processes a limited set of information strictly for enforcement purposes:
We do not read personal content. Xlock does not access photos, messages, contacts, browsing history or app content on a financed device. Enforcement is limited to locking the screen, showing payment reminders and the anti-theft signals listed above.
We use information to:
We do not sell personal data, and we do not use device data for advertising.
Where applicable law (such as India's Digital Personal Data Protection Act, 2023, or the GDPR) requires a lawful basis, we rely on one or more of: performance of a contract, our legitimate interest in securing financed assets, compliance with a legal obligation, and consent — including the consent obtained at the point of sale when a device is enrolled.
We keep information only as long as needed for the purposes above or as required by law. Device data is retained while a device remains enrolled and for a limited period afterward for audit and dispute-resolution purposes, then deleted or de-identified.
Security is the core of what we do. We apply AES-256 encryption in transit and at rest, tamper-proof provisioning, role-based access controls, continuous monitoring and independent audits aligned with SOC 2 and ISO 27001 practices. No system is perfectly secure, but we work continuously to protect your information.
Subject to your jurisdiction, you may have the right to:
To exercise these rights, contact us at pay5xinfotech@gmail.com. If your data was uploaded by a lender or retailer, we may direct your request to them as the controller.
Xlock is a business platform and is not directed to children. We do not knowingly collect personal data from anyone under 18. If you believe a minor's data has reached us, please contact us so we can remove it.
We are based in India and may process data on servers located in other countries. Where we transfer personal data across borders, we use appropriate safeguards such as contractual protections to keep it secured to the standards described here.
We may update this policy from time to time. When we make material changes, we will revise the "Last updated" date above and, where appropriate, notify you through the platform or by email. Continued use after an update means you accept the revised policy.
Questions about this policy or your data? Reach our privacy team:
See how Xlock protects financed devices and the data around them — in a 20-minute walkthrough.