Privacy policy

This policy explains what personal data RewardingStore collects, why, who we share it with, how long we keep it, and the rights you have over it. It is written for India's Digital Personal Data Protection Act, 2023 (the DPDP Act) and its rules, and the Information Technology Act, 2000 and its rules.

The short version

• You can browse without an account. We then keep only what's needed to run your visit.
• With an account, we keep your name, email, your saved addresses and pincode, your watchlist and alerts, and what we need to send your notifications.
• We don't sell your data and we don't show ads. We use one analytics tool, Microsoft Clarity, to see how visitors move through the site, with personal details hidden.
• We share data only with the service providers who run the service for us, and only what they need.
• You can see, correct or delete your data, and withdraw consent, at any time.

What we collect

When you browse (with or without an account)

• Your chosen pincode, kept for your visit so we can show local prices.
• Products you recently viewed, kept for your visit to show you a "Recently viewed" row.
• Technical data: your IP address, browser and device type (user agent), and the time of your requests. This is recorded in our session store and server logs, and by our network and security provider. We use it to run the site, keep it secure, and prevent abuse.
• How you use the site: the pages you view and how you click, scroll and move around them, recorded by Microsoft Clarity so we can see where the site is confusing or broken. What you type, your saved addresses and your contact details are hidden from these recordings. Clarity runs without cookies, and we don't tell it who you are.

When you create an account

• Name and email address. If you sign up with a password, we store it only as a one-way hash, never in readable form.
• If you sign in with Google: Google shares your name, email address and a Google account identifier with us. We don't receive your Google password or anything else from your Google account.
• The date of your last sign-in, and the days on which you used the site. We keep a simple record of which days an account was active so we can understand how many people use the service. That record doesn't list which pages you viewed.

When you use account features

• Addresses you save: label, recipient name, phone number, address lines, city, state and pincode. You add these yourself, and they are used only to price products for that location. We don't deliver anything, and we don't share your address with the platforms.
• Your watchlist, starred categories and price alerts, including the target prices you set.
• Telegram: if you link Telegram, we store your Telegram chat identifier and when you linked it, so our bot can message you.
• Browser notifications: if you allow them, we store the push subscription your browser gives us (an endpoint address and encryption keys), your browser's user agent, and when it was last used.
• Notification preferences and a log of the alerts we sent you, which channel we used, and whether delivery succeeded.
• Pincode requests: if you ask us to cover a pincode, we store the pincode and, if you give it, your email address so we can tell you when it's added.
• Messages you send us, and our replies.

We do not collect financial information, government identifiers, or any sensitive personal data, and we never ask for them.

Why we use it, and on what basis

We process your personal data with your consent, which you give when you create an account or turn on a feature, or for the legitimate uses the DPDP Act allows. We use it to:

• Provide the service: show local prices, keep your watchlist, and evaluate and send your price alerts.
• Run your account: sign-in, password reset, and keeping you signed in.
• Keep the service secure and working: prevent abuse and fraud, debug problems, and protect our systems and users.
• Understand usage, such as how many accounts are active in a month and where visitors get stuck, so we can improve the service.
• Communicate with you about your account, your requests, and important changes to these terms or this policy.
• Meet legal obligations and respond to lawful requests from authorities.

We do not use your data for advertising, we do not build advertising profiles, and we do not sell or rent your personal data to anyone.

Who we share it with

We share personal data only with service providers who process it on our behalf and under our instructions, and only as much as each one needs:

• Hosting and infrastructure providers, which run our servers and database and store our backups.
• Our network and security provider, which delivers the site and protects it from attacks. It processes technical data such as IP addresses.
• Microsoft Clarity, our analytics provider, which receives the usage recordings described above.
• Google, if you choose to sign in with Google.
• Telegram, if you link it: messages we send you pass through Telegram and are subject to Telegram's own privacy policy.
• Your browser's push service (for example Google, Mozilla or Apple, depending on your browser), if you enable browser notifications. It delivers the notification to your device.
• An email delivery provider, to send account emails such as password resets.

We may also disclose personal data if the law requires it, to comply with a lawful request by a government authority, or to protect the rights, safety or property of our users, the public or ourselves.

We do not share your personal data with the platforms whose prices we track. When you follow a link to a platform, you leave RewardingStore, and that platform's own privacy policy applies to what you do there.

Where your data is stored

Our service providers may store and process data on servers in India or in other countries. When data is transferred outside India, we do so only as the DPDP Act permits, including any restrictions the Government of India notifies, and we protect it as this policy describes.

How long we keep it

• Account data: while your account is open. When you ask us to delete your account, we delete or anonymise your personal data within 30 days. The exceptions are data we must keep by law, and copies in our encrypted backups. Backup copies are removed when those backups expire on their normal rolling schedule.
• Session data (your pincode, recently viewed products, technical data) expires after a period of inactivity, and old sessions are cleared out regularly.
• Server and security logs are kept only as long as needed for security and troubleshooting, and for any minimum period the law requires.
• Alert delivery logs are kept while your account is open, so we can investigate a missed or duplicated alert.
• Usage recordings are kept for 30 days, or up to 13 months for a recording we save to investigate a problem.
• If you stop using your account and don't sign in for a long time, we may delete it. Where the law requires, we will notify you first so you can keep it.

Your rights

Under the DPDP Act you have the right to:

• Access: get a summary of the personal data we hold about you and how we use it, and the identities of those we've shared it with.
• Correct and update inaccurate or incomplete data. You can change most of it yourself in your account.
• Erase: have your personal data deleted when it's no longer needed for the purpose you gave it for, unless we must keep it by law.
• Withdraw consent at any time, as easily as you gave it. For example, unlink Telegram, turn off browser notifications, or delete your account. Withdrawing consent doesn't affect processing that happened before, but some features will stop working without the data they need.
• Grievance redressal: complain to us and have the complaint dealt with (see below).
• Nominate someone to exercise these rights on your behalf if you die or become unable to.

To exercise any of these, email [email protected] from your account's email address. We may need to verify that the request is yours. We'll respond within the time the law allows, and in any case within 30 days.

Children

RewardingStore is intended for adults. You must be 18 or older to create an account, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

Security

We protect your data with reasonable security practices, including encrypted connections (HTTPS) to our site and to our database, hashed passwords, access limited to the people who need it, and encrypted backups. No system is perfectly secure. If a personal data breach occurs, we will notify you and the Data Protection Board of India as the law requires.

Cookies

We use only the cookies and browser storage the site needs to work. We have no advertising cookies, and our analytics tool runs without cookies. See our Cookie policy.

Grievances

If you have a concern about how we handle your personal data, email [email protected] with "Complaint" in the subject line.

We will acknowledge your complaint within 24 hours and aim to resolve it within 15 days. If you're not satisfied with our response, you may complain to the Data Protection Board of India.

Changes to this policy

We may update this policy as the service or the law changes. The "Last updated" date at the top of this page shows when it last changed. If a change materially affects how we use your personal data, we'll tell you in advance, for example by email or a notice on the site, and ask for your consent again where the law requires it.