Privacy Policy

1. About Us and This Policy

1.1 Data Controller

VerifyDeals is operated as a sole proprietorship under Indian law. The proprietor and data controller is:

• Name: Vishal Rajesh Mulchandani
• Platform: VerifyDeals (www.verifydeals.in)
• Contact: support@verifydeals.in
• Grievance Officer: Vishal Rajesh Mulchandani, support@verifydeals.in

1.2 Scope of This Policy

This Privacy Policy applies to all personal data collected through the Platform, including via the website, any future mobile applications, and all interactions with VerifyDeals' services. It does not apply to third-party websites or services linked from the Platform — those are governed by their own privacy policies.

1.3 Applicable Law

VerifyDeals processes personal data in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), and other applicable Indian law. VerifyDeals will update this Policy as required when the Digital Personal Data Protection Act, 2023 ("DPDPA") and its rules come into effect.

2. Personal Data We Collect

2.1 Data You Provide at Registration

When you create an Account, we collect:

• First name and last name
• Email address
• Mobile number
• Password (stored as a one-way hash — we cannot read your password)

2.2 Data You Provide for Withdrawals

When you add a payout method to withdraw your cashback, we collect:

UPI details:

• UPI ID
• Beneficiary name

Bank account details:

• Account holder name
• Account number (stored encrypted)
• IFSC code
• Bank name and branch name

Payout requests additionally record: payment method, amount, fee, GST, TDS, OTP verification status, gateway references, and risk flags.

2.3 Data Collected Automatically

When you use the Platform, we automatically collect technical and behavioural data including:

• Device hash (a hashed identifier derived from your device characteristics)
• User agent hash (a hashed identifier derived from your browser and operating system)
• IP address hash (a hashed version of your IP — raw IP is not stored in primary tables)
• Timezone
• Session identifiers (stored in your browser's localStorage and sessionStorage)
• Click data: click ID, partner ID, deal ID, network ID, UTM parameters, referrer information, clicked-at timestamp, and conversion status
• Traffic channel and influencer attribution data where applicable
• Risk flags generated by our fraud detection systems

2.4 Data from Google OAuth

If you choose to register or log in using Google, we receive from Google your email address, first name, last name, and Google profile name. We do not receive your Google password.

2.5 Communications Data

We collect and retain the content of support queries, emails, and other correspondence you send to us.

2.6 Data We Do Not Currently Collect

• Date of birth (not collected at registration or otherwise)
• PAN card or Aadhaar card (KYC document collection is not yet implemented)
• Raw IP address (only a hashed version is stored)
• SMS, WhatsApp, or push notification data (these channels are not operational)

3. How We Use Your Personal Data

3.1 To Provide and Operate the Platform

• Create and manage your Account
• Track affiliate clicks and attribute cashback to your Account
• Validate and confirm cashback transactions
• Process withdrawal requests to your nominated UPI ID or bank account
• Send transactional emails via Brevo (cashback alerts, OTPs, account notifications)
• Manage the referral programme and calculate referral rewards

3.2 Fraud Detection and Platform Security

• Detect and prevent fraudulent activity, multiple account creation, and abuse
• Investigate suspicious transactions and referral patterns
• Protect the integrity of the cashback and withdrawal systems

3.3 Legal and Regulatory Compliance

• Comply with applicable Indian law including tax obligations and TDS requirements
• Respond to lawful requests from government authorities, courts, or regulators
• Maintain financial records as required by law

3.4 Platform Improvement

We use aggregated and anonymised data to understand Platform usage patterns and improve our services. We do not currently use any third-party analytics tools such as Google Analytics, Mixpanel, or Hotjar.

3.5 Communications

• Transactional emails: OTPs, cashback status updates, withdrawal confirmations, and account alerts (cannot be opted out of while your Account is active)
• Marketing emails: promotional offers and Platform updates (you may opt out at any time via the unsubscribe link in any email or by contacting support@verifydeals.in)

4. How We Share Your Personal Data

We do not sell your personal data. We share data only as strictly necessary to deliver our services.

4.1 Affiliate Networks — Admitad and Trackier

We integrate with affiliate networks Admitad and Trackier to sync deal listings, coupons, and campaign data. We do not send your personal identifiable information (name, email, phone) to these networks as part of standard operation. Anonymised click-level tracking data may be shared to attribute and validate commissions.

4.2 Email Service Provider — Brevo

We use Brevo (formerly Sendinblue) to send transactional emails and OTPs. Brevo receives your email address, your name, and the email content. Brevo's privacy policy is available at brevo.com.

4.3 Google — OAuth Authentication

If you use Google to log in, Google processes your authentication request and shares your profile data (email, name) with us. Your use of Google OAuth is also subject to Google's Privacy Policy at policies.google.com/privacy.

4.4 Payment Processing

Withdrawal payments are processed via our payment infrastructure. Your bank account number is stored encrypted. Payment gateway details are transmitted securely to our payment processing partner at the time of payout.

4.5 Legal Authorities

We may disclose your personal data to government authorities, courts, regulators, or law enforcement where required by applicable law, court order, or lawful governmental authority.

4.6 Business Transfers

If VerifyDeals is involved in a merger, acquisition, restructuring, or sale of assets, your personal data may be transferred to the successor entity. You will be notified of any such transfer.

5. Cookies, Local Storage, and Tracking

5.1 How We Track Sessions

VerifyDeals does not currently use browser cookies set by the server. Instead, the Platform uses your browser's localStorage and sessionStorage. The following keys are used:

• vd_auth_token — your authentication token, required to stay logged in
• vd_user — your cached profile data for display purposes
• vd_session_id — your session identifier used for click attribution
• vd_deals_wishlist — your saved deals
• vd_favorite_stores — your saved store preferences
• vd_session_interest_signal (sessionStorage) — short-lived session behaviour signal used for tracking attribution

5.2 Affiliate Tracking

When you click an affiliate link, a tracking request is sent to our backend recording your session identifier, click details, and device/browser hashes for cashback attribution. If you disable JavaScript or clear your localStorage, cashback attribution may fail.

5.3 Third-Party Cookies

The Platform loads certain assets from public CDNs (Font Awesome, Flatpickr). These CDN providers may set their own cookies or record your IP address in their access logs. We do not use any advertising, retargeting, or third-party analytics cookies.

6. Data Storage and Security

6.1 Where Your Data Is Stored

Your personal data is stored on servers hosted by Contabo GmbH, located in India. All data remains within India and is not transferred to servers outside India as part of our primary infrastructure. Limited data sharing with Brevo (EU-based) occurs solely for sending emails.

6.2 Security Measures

• Passwords are stored as one-way hashes and cannot be read or recovered by us
• Bank account numbers are stored in encrypted form
• IP addresses and device identifiers are stored as hashes, not in raw form
• Authentication uses short-lived access tokens (15-minute expiry) with refresh token logic
• OTPs expire after 10 minutes
• All API endpoints use role-based access controls

6.3 Data Retention

• Account and profile data: retained while your Account is active and as required by law thereafter
• Financial and transactional records: minimum 8 years in accordance with Indian tax and accounting law
• Click and session tracking logs: retained until status changes or expiry jobs run; anonymous clicks marked as orphaned after 24 hours
• OTPs and short-lived tokens: expire automatically (OTPs: 10 minutes; access tokens: 15 minutes)
• Fraud investigation records: retained for as long as necessary for the investigation and any legal proceedings

7. Your Rights

7.1 Right to Access

You may request a copy of the personal data we hold about you by contacting support@verifydeals.in. We will respond within 30 days.

7.2 Right to Correction

You may update your name, email, phone number, and payout details directly from your Account profile. For other corrections, contact support@verifydeals.in.

7.3 Right to Delete Your Account

You may delete your Account directly from the profile page on the Platform. Certain data may be retained where required by law. Financial records, transaction history, and fraud investigation records cannot be deleted where retention is legally required.

7.4 Right to Withdraw Consent for Marketing

You may opt out of marketing emails at any time by clicking the unsubscribe link in any marketing email or by contacting support@verifydeals.in. Transactional emails cannot be opted out of while your Account is active.

7.5 Data Portability

A formal data export feature is not currently available. If you require a copy of your data, contact support@verifydeals.in and we will provide it within 30 days.

7.6 Right to Lodge a Complaint

If you believe your data has been handled unlawfully, you may contact our Grievance Officer at support@verifydeals.in. If your grievance is not resolved, you may approach the relevant authority under applicable Indian law.

8. Children and Minors

The Platform is strictly intended for users aged 18 years and above. We do not knowingly collect personal data from persons under the age of 18. If we become aware that a User is under 18, the Account will be terminated and all associated data deleted. If you believe a minor has registered, please notify us at support@verifydeals.in.

9. Third-Party Websites and Retailer Links

The Platform contains links to Retailer and other third-party websites. When you click an affiliate link and land on a Retailer's website, you are subject to that Retailer's own privacy policy. VerifyDeals has no control over and accepts no responsibility for the data practices of any third-party website.

10. Changes to This Privacy Policy

VerifyDeals may update this Privacy Policy from time to time. Where a material change is made, we will notify you by email and/or by a prominent notice on the Platform. The updated Policy will take effect no earlier than 7 days after notice is given. Your continued use of the Platform after the effective date constitutes acceptance of the changes.

11. Grievance Officer and Contact

• Name: Vishal Rajesh Mulchandani
• Designation: Proprietor, VerifyDeals
• Email: support@verifydeals.in
• Subject Line: "Privacy Grievance — [Your Name] — [Nature of Complaint]"

All grievances will be acknowledged within 48 hours and resolved within 30 days of receipt.