Skip to main content

CARDADVISOR

Privacy Policy

Last updated:

This Privacy Policy explains how Devchandra Sah, operating as CardAdvisor ("CardAdvisor", "we") handles information when you use this website. We are committed to data minimisation: the core recommendation engine works without any account or personal identifier.

1. What we collect

  • Spending profile inputs — spend categories, monthly amounts (and any merchants you name), income range and card preferences you enter in the profiler, and, only if you give them, a self-reported credit score, whether you have missed a payment, your city, your employment type, the cards you already hold and a short note. With an account, the profile builder also keeps the name you set there. A profile is stored against a random ID, not your name or email, unless it is your account's own profile.
  • What a shared results link shows — your recommendations page link carries your profile's random ID. Anyone you share it with can see the ranked cards, your spend split (with any merchants you named), income range and card preferences. Your credit score, missed-payment answer, name, city, employment type, cards held and note are returned only to you: to your account, or to the browser that built the profile.
  • Email address — only if you sign up for T&C change alerts, enter the monthly giveaway, add one (optionally) to a comment you post without an account, submit a card suggestion, apply for an API key, send a partnership enquiry, or create an account. Used solely for that stated purpose: we never add you to a mailing list. News and offers, offered by a box on the giveaway form and on our recommendation, comparison and wallet pages, are a separate choice described below. Card alerts start only after you confirm your address from the email we send you, and every alert carries a link to stop them. An API key application or partnership enquiry also keeps the name, company and website you give us, so we can reply. Whenever we email you, we keep a short record of that email (your address, its subject, and whether it was delivered) so we can check it reached you. We never keep what the email said.
  • Next-card emails — only if you ask for them on your wallet page and confirm your address from the email we send. We store your address, the wallet it is for, when and with which wording you agreed, and which cards we have already suggested, so we never send the same card twice. We use it only to send these emails, at most one a month. You can stop at any time with the link in every email.
  • News and offers — only if you leave the "Send me more exciting news and offers" box ticked when you enter the giveaway, or ask for them in the box on our recommendation, comparison or wallet pages, and they start only when you confirm your email. From then on we keep, with that address, a copy of the interest list of the browser you asked from (see "Your interest list" below): the cards, points programmes and transfer partners you look at, hold or compare here, linked through your browser's analytics ID (ca_session_id). We use it only to decide which update is worth sending you: an offer or a change on a card you looked at, or a better card, and in a month we have sent you nothing, a short note on what changed for those cards. At most one a week, each naming the card it is about. We store your address, when and with which wording you agreed, that list, and which updates we have sent. Stop at any time with the link in every email: stopping deletes the list at once and your address within 30 days, and a request you never confirm is deleted after 35 days. Erasing this browser's data (section 5a) deletes the copy and stops the updates following this browser; the subscription itself stays until you stop it from an email.
  • Giveaway entries — your name, your email, the tee text you suggest and the month you entered. Until you confirm your email, we send a reminder every other day until the month ends, at most four reminders, and every one has a link to stop them. If you win, we show your name, your email with most of it hidden (for example ra•••@gmail.com) and your tee line on our winners page, unless you ask us not to. So that one device enters only once a month, we also record your browser's analytics session ID (ca_vid) and IP address with the entry. We delete the session ID and IP address 90 days after you enter, and the whole entry 180 days after you enter. From November 2026 an entry includes the links and screenshots of the posts you send us to show you shared CardAdvisor. We use them to check your entry, and a post you send from 29 October 2026 is also shown on the giveaway page once we approve it, with your first name, the link and the screenshot if you sent one (the form says so before you send). Posts sent before that date are seen only by us. We delete them all 90 days after you send them, and take one off the page sooner if you ask.
  • Comments — if you comment on a page, the name you give, your comment, the helpful votes it gets and any reports are stored, and your name and comment are shown publicly. Without an account you may add an email address: it is kept with the comment and never shown to anyone. With an account, comments are stored against it; you can edit or delete them, deleting your account hides them at once, and signing in again shows them again.
  • AI chat messages — if you use the AI assistant, your question and its answer are stored so we can check the assistant's accuracy. Without an account, a conversation is deleted 90 days after its last message. With an account, your conversations are kept with it, listed under My Conversations in your account, and erased when the account is erased. No IP address is stored with them.
  • Usage analytics — the pages you open and what you do with our tools: the cards you view, compare or add to a wallet, the transfers and merchants you look up, and the Apply links you follow. We record these on our own servers against your browser's analytics ID (ca_session_id, section 4), and each one also carries the IDs of the wallet and spend profile this browser holds, never what is in them. They are not linked to your name or email unless you are signed in (then they are also linked to your account) or have asked for news and offers (above). We use them to improve the site and to build the interest list below, and we delete them after 90 days.
  • Your interest list — from those events we keep, for each browser, a list of what it has looked at here: cards, compared pairs, points programmes and transfer partners, spend categories and merchants, best-card lists, guides, and cards you applied for, each weighted by what you did with it (a compare counts for more than a view), with a visit counting half as much after a month. With it we keep the newest wallet, spend profile and, if you are signed in, account seen on that browser. We use it to choose the one card our home page suggests to you under "Picked for you", worked out from your own spend profile or wallet when this browser has one, and, only if you asked for news and offers, to choose those emails. We rebuild it every hour from the last 90 days of events, so it never holds anything older, and it never leaves our servers. You can erase it, with the events behind it, using the button in section 5a.
  • Technical & activity data — your IP address, an approximate location (city/country) derived from it, and your device/browser type, recorded with activity events for security, abuse-prevention, and analytics. We do not store precise GPS location. This data is automatically purged after 90 days.

We do not collect your actual salary, phone number, Aadhaar number, PAN, credit card numbers, or bank account details — and please don't type them into the AI chat either.

2. How we use it

To generate personalised card recommendations, choose the card our home page suggests to your browser, send the alerts and updates you asked for and the emails an account or a form you sent needs, respond to suggestions and feedback, secure the service against abuse, and improve the product experience. We never sell your data to third parties, and there are no paid placements in our rankings.

3. Your rights (DPDP Act 2023)

Under India's Digital Personal Data Protection Act 2023, you have the right to:

  • Access the personal data we hold about you
  • Request correction of inaccurate data
  • Request erasure of your personal data
  • Withdraw consent at any time (e.g. unsubscribe from alerts)
  • Nominate a person to exercise these rights on your behalf

To exercise any of these rights, contact our Grievance Officer at grievance@cardadvisor.in. We will respond within 48 hours on business days.

4. Cookies & local storage

We use browser local storage to remember your profiler session (so you don't lose progress on page refresh) and your wallet card list. We use a small number of first-party identifiers:

  • Login cookies (ca_access, ca_refresh) — secure, httpOnly session cookies set only when you sign in.
  • Analytics identifiers (ca_vid, ca_session_id) — random IDs that say nothing about you on their own. ca_vid is a session cookie, cleared when you close your browser. ca_session_id is held in your browser's local storage and persists until you clear site data or use the erase button in section 5a. It ties this browser's visits together, on different days too, and it is what the interest list and "Picked for you" in section 1 are built on. Events carrying either ID are deleted after 90 days.
  • Where your visit came from (ca_src_ref, ca_src_utm, ca_src_carried in the tab's session storage; ca_src_last in local storage) — the page that linked you here and any campaign tags on the address you arrived at (utm_source, utm_medium, utm_campaign), sent with our own analytics events so we can see how readers find us. When you open one of our pages in a new tab, that tab is credited to the same visit. These hold no ID; the local-storage copy is ignored after 30 minutes without activity on the site and deleted the next time a page finds it out of date.
  • Google Analytics identifiers (_ga and its_ga_* companion) — first-party cookies set by Google Analytics 4 so aggregate traffic can be measured. They hold a random ID, not personal data, and we run GA4 with every advertising signal denied.
  • Sign-in markers (ca_signin_intent_v1, ca_claim_ok_v1, local storage) — when you ask for a sign-in or verification link, sign up, reset your password or sign in, your browser notes that it started the sign-in (a short code derived from the address, kept for a day) and which account it signed into. That is how the wallet and profile this browser holds join your account only when the sign-in began here; a link someone else sent you signs you in but asks before saving anything to that account.
  • Addresses you typed into a form (ca_alert_email, ca_alert_token, ca_giveaway_email, ca_giveaway_entry_v1, local storage) — the email address you gave for card alerts or the giveaway, so you need not type it again, with the code that lets this browser manage that alert sign-up and the id of this month's giveaway entry. They stay until you clear site data or use the erase button in section 5a.
  • Small reminders (ca_updates_asked_v1, ca_next_move_seen_v1, ca_human_input, local storage) — when this browser last asked for news and offers, so the sign-up box does not ask again for six months; that our home page has shown you a "Picked for you" card, so it keeps room for one; and whether anyone has ever scrolled or moved a pointer here, which helps us tell readers from automated visits. None holds an ID. The erase button in section 5a clears them.

We do not use advertising cookies, cross-site tracking cookies, or sell cookie data to any party.

4a. Optional answers you give on a page

Some pages ask one question whose answer makes the page's answer more useful to you — for example, roughly how much you have already spent on a card, so we can tell you how far you are from its milestone rather than only what the milestone is. These answers are held in your browser's local storage under keys beginning ca_state:.

  • They are never sent to us. The code that stores them contains no network call at all, and a build check fails if one is ever added. Our analytics can record that a question was answered — never what the answer was.
  • They expire. Each value has a lifetime (30 days for milestone spend); past it, the value is ignored rather than used to compute a stale figure.
  • They are optional in the ordinary sense of the word. Nothing is hidden behind them, no account is involved, and every page works fully if you ignore the question.
  • We do not ask for bank logins, card numbers or PAN, and linking a bank or card account is not a feature of this site.

4b. If you upload a statement

The profile builder offers one optional shortcut that does involve a file. Rather than setting each spend slider by hand, you can upload a card or bank statement (CSV or PDF, up to 5 MB) and we read your spend per category from it. It is a shortcut and nothing more: every part of the site works if you never use it, and the sliders produce the same kind of profile.

  • The file is read and discarded inside the same request. It is held in memory on our server while it is parsed, never written to a database and never written to disk. There is no upload history and nothing for you to delete afterwards, because nothing was kept.
  • Only the per-category monthly totals come back, and they land in the same spend fields you would otherwise have filled in yourself. Individual transactions, merchant names, account numbers, balances and the file's own name are not stored and are not passed to anyone.
  • It does leave your device. The parsing happens on our server, not in your browser, so for the length of one request the file crosses the network. If you would rather that did not happen, use the sliders — they reach the same place.

5. Retention & security

We retain personal data only as long as needed for the purpose it was collected. Activity-log data (the events in section 1 with their IP address, approximate location and device type) and AI chat messages are automatically purged after 90 days, and so are our records of the emails we send you. The interest list is rebuilt every hour from those 90 days of events, so it goes with them. Giveaway post links and screenshots are deleted after 90 days. Giveaway entries lose their session ID and IP address after 90 days and are deleted after 180 days; a winner's name, masked email and tee line are shown on the winners page while their draw is one of the last three, unless they ask us to take them off, and we keep them as the record of the draw. Error reports (the page, what went wrong and your browser type, never your IP address) lose your browser's session ID after 90 days and are deleted after 180 days. Alert and next-card email subscriptions follow the same rule: an address that never confirms is deleted 7 days after we send the confirmation email, and once you stop them, the address, the cards you tracked and the history of cards suggested are deleted within 30 days. An address that was never confirmed is never sent an alert. If you delete your account, it is closed immediately and what is stored against it is kept, so signing in again restores it; to have it erased, write to our Grievance Officer (section 7). We apply reasonable technical and organisational safeguards; however, no method of internet transmission is 100% secure.

In the event of a data breach that is likely to harm your interests, we will notify affected users and the relevant authority as required by applicable law.

5a. Erasing what this browser built

Without an account, the spend profile you build (with the recommendations made from it) and your wallet are kept on our servers under random IDs that your browser keeps. When your browser creates one, we also give it a private key that never appears in a link, so only that browser can erase it. You can erase all of it here, at once, from our servers and from this browser. The same button erases this browser's activity record: the events kept against its analytics ID, the interest list made from them, and, if you asked for news and offers, the copy kept for those emails and their link to this browser. It also takes the ID off any error reports. Then the ID itself is removed, so the next page you open starts a new, empty record. It also clears the email addresses this browser remembers for card alerts and the giveaway, and the small reminders in section 4. A card alert sign-up and a news and offers subscription are separate choices: each stays until you end it from the link in any of its emails. Signed in, the button erases this browser's activity record only, since your profile and wallet belong to your account (section 5).

6. Third-party processors

We use the following service providers who may process your data on our behalf:

  • Hosting: Oracle Cloud Infrastructure (servers in India/US regions)
  • Email delivery: Resend, which sends every email we send you (sign-in and verification links, alerts, replies to forms) from servers outside India, and tells us whether each one was delivered. It receives your email address and the email itself. This is a cross-border transfer as permitted under the DPDP Act, 2023
  • Content delivery & security: Cloudflare, which sits in front of our origin server — all traffic to this site passes through it, so it processes your IP address and request metadata to provide DNS, TLS, caching and bot protection
  • Behaviour analytics: Self-hosted on our own servers. The events stay on our infrastructure; only the IP address goes out, to the geolocation service below
  • Web analytics: Google Analytics 4, used for aggregate traffic measurement. Google processes this data on servers outside India, a cross-border transfer as permitted under the DPDP Act, 2023. We run it with Consent Mode and all advertising signals denied (ad_storage, ad_user_data, ad_personalization). It gets the address of the page you are on without its query string (only campaign tags such as utm_source are kept), and nothing at all from the sign-in, email verification and password pages, or from the pages our emails open to confirm an address (the giveaway's included) or stop an email subscription. We do not send it your name, email, or other directly identifying data
  • AI assistant: Google Gemini. Messages you send to the AI assistant are processed by Google on servers outside India. We do not send Google your name, email, IP address, or account details. This is a cross-border transfer as permitted under the DPDP Act, 2023
  • IP geolocation: ip-api.com. When a new IP address reaches our analytics we send that address, and nothing else, to ip-api.com, which answers with an approximate city and country, the network operator, and whether the address belongs to a hosting provider or a proxy. We use the answer for analytics and to tell automated traffic from readers, and we store no precise location. ip-api.com processes the address on servers outside India; this is a cross-border transfer as permitted under the DPDP Act, 2023

"Apply" links take you to the card issuer's own website, which is governed by their own privacy policy. We have no control over data collected there.

7. Contact & Grievance Officer

Grievance Officer: Devchandra Sah, CardAdvisor
Email: grievance@cardadvisor.in
Response time: within 48 hours on business days

This policy is governed by the laws of India, including the Digital Personal Data Protection Act 2023 and the Information Technology Act 2000.