Skip to main content

CARDADVISOR

Privacy Policy

Last updated:

This Privacy Policy explains how Devchandra Sah, operating as CardAdvisor ("CardAdvisor", "we") handles information when you use this website. We are committed to data minimisation: the core recommendation engine works without any account or personal identifier.

1. What we collect

  • Spending profile inputs — spend categories, monthly amounts, income range, and card preferences you enter in the profiler. These are not directly identifying and are stored against a random session ID, not your name or email.
  • Email address — only if you opt in to T&C change alerts, submit a card suggestion, or create an account. Used solely for that stated purpose.
  • Community content — if you post a review, the display name you choose, your star rating, review text, helpful-votes, and reports are stored against your account. Your display name and reviews are shown publicly. You can edit or delete your reviews at any time, and deleting your account erases them.
  • AI chat messages — if you use the AI assistant, your question and its answer are stored for 90 days so we can check the assistant's accuracy. Your IP address is stored only as a one-way hash.
  • Usage analytics — page views and feature usage events to help us improve the product. Collected in aggregate; not linked to your identity unless you are logged in.
  • Technical & activity data — your IP address, an approximate location (city/country) derived from it, and your device/browser type, recorded with activity events for security, abuse-prevention, and analytics. We do not store precise GPS location. This data is automatically purged after 90 days.

We do not collect your actual salary, phone number, Aadhaar number, PAN, credit card numbers, or bank account details — and please don't type them into the AI chat either.

2. How we use it

To generate personalised card recommendations, send the alerts or updates you requested, respond to suggestions and feedback, secure the service against abuse, and improve the product experience. We never sell your data to third parties, and there are no paid placements in our rankings.

3. Your rights (DPDP Act 2023)

Under India's Digital Personal Data Protection Act 2023, you have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request erasure of your personal data
  • Withdraw consent at any time (e.g. unsubscribe from alerts)
  • Nominate a person to exercise these rights on your behalf

To exercise any of these rights, contact our Grievance Officer at grievance@cardadvisor.in. We will respond within 48 hours on business days.

4. Cookies & local storage

We use browser local storage to remember your profiler session (so you don't lose progress on page refresh) and your wallet card list. We use a small number of first-party identifiers:

  • Login cookies (ca_access, ca_refresh) — secure, httpOnly session cookies set only when you sign in.
  • Analytics identifiers (ca_vid, ca_session_id) — random IDs used for anonymous analytics; neither ever contains personal data. ca_vid is a session cookie, cleared when you close your browser. ca_session_id is held in your browser's local storage and persists until you clear site data, which lets our own admin activity log see that a browser has visited on more than one day. Both are purged from our activity logs after 90 days.
  • Google Analytics identifiers (_ga and its_ga_* companion) — first-party cookies set by Google Analytics 4 so aggregate traffic can be measured. They hold a random ID, not personal data, and we run GA4 with every advertising signal denied.

We do not use advertising cookies, cross-site tracking cookies, or sell cookie data to any party.

4a. Optional answers you give on a page

Some pages ask one question whose answer makes the page's answer more useful to you — for example, roughly how much you have already spent on a card, so we can tell you how far you are from its milestone rather than only what the milestone is. These answers are held in your browser's local storage under keys beginning ca_state:.

  • They are never sent to us. The code that stores them contains no network call at all, and a build check fails if one is ever added. Our analytics can record that a question was answered — never what the answer was.
  • They expire. Each value has a lifetime (30 days for milestone spend); past it, the value is ignored rather than used to compute a stale figure.
  • They are optional in the ordinary sense of the word. Nothing is hidden behind them, no account is involved, and every page works fully if you ignore the question.
  • We do not ask for bank logins, card numbers or PAN, and linking a bank or card account is not a feature of this site.

4b. If you upload a statement

The profile builder offers one optional shortcut that does involve a file. Rather than setting each spend slider by hand, you can upload a card or bank statement (CSV or PDF, up to 5 MB) and we read your spend per category from it. It is a shortcut and nothing more: every part of the site works if you never use it, and the sliders produce the same kind of profile.

  • The file is read and discarded inside the same request. It is held in memory on our server while it is parsed, never written to a database and never written to disk. There is no upload history and nothing for you to delete afterwards, because nothing was kept.
  • Only the per-category monthly totals come back, and they land in the same spend fields you would otherwise have filled in yourself. Individual transactions, merchant names, account numbers, balances and the file's own name are not stored and are not passed to anyone.
  • It does leave your device. The parsing happens on our server, not in your browser, so for the length of one request the file crosses the network. If you would rather that did not happen, use the sliders — they reach the same place.

5. Retention & security

We retain personal data only as long as needed for the purpose it was collected. Activity-log data (IP address, approximate location, device type) and AI chat messages are automatically purged after 90 days. Email addresses for alert subscriptions are retained until you unsubscribe. We apply reasonable technical and organisational safeguards; however, no method of internet transmission is 100% secure.

In the event of a data breach that is likely to harm your interests, we will notify affected users and the relevant authority as required by applicable law.

6. Third-party processors

We use the following service providers who may process your data on our behalf:

  • Hosting: Oracle Cloud Infrastructure (servers in India/US regions)
  • Content delivery & security: Cloudflare, which sits in front of our origin server — all traffic to this site passes through it, so it processes your IP address and request metadata to provide DNS, TLS, caching and bot protection
  • Behaviour analytics: Self-hosted on our own servers — this data does not leave our infrastructure
  • Web analytics: Google Analytics 4, used for aggregate traffic measurement. Google processes this data on servers outside India. We run it with Consent Mode and all advertising signals denied (ad_storage, ad_user_data, ad_personalization), and we do not send it your name, email, or other directly identifying data
  • Product analytics: PostHog, used for aggregate, anonymous usage metrics. PostHog processes data on servers in the United States; it runs with autocapture disabled and session-only storage, and we do not send it your name, email, or other directly identifying data. This involves a cross-border transfer of pseudonymous usage data as permitted under the DPDP Act, 2023
  • AI assistant: Google Gemini. Messages you send to the AI assistant are processed by Google on servers outside India. We do not send Google your name, email, IP address, or account details. This is a cross-border transfer as permitted under the DPDP Act, 2023
  • IP geolocation: Used to derive approximate city/country from your IP for analytics and security purposes; no precise location is stored

"Apply" links take you to the card issuer's own website, which is governed by their own privacy policy. We have no control over data collected there.

7. Contact & Grievance Officer

Grievance Officer: Devchandra Sah, CardAdvisor
Email: grievance@cardadvisor.in
Response time: within 48 hours on business days

This policy is governed by the laws of India, including the Digital Personal Data Protection Act 2023 and the Information Technology Act 2000.