Privacy Policy

You give us (only when you choose to apply, contact us or subscribe):

• Identity and contact: name, mobile number, e-mail address, city.
• Profile for eligibility: employment type, approximate monthly income, loan amount needed, the product you are interested in and your Card Finder answers (spend categories, fee preference, travel needs).
• Your messages to us.

Collected automatically: IP address, device and browser type, pages visited, referring site, approximate location derived from IP, and cookie or similar identifiers (see Cookie Policy).

We do not collect your PAN, Aadhaar, date of birth, bank account or card numbers, passwords, OTPs, credit reports, contacts, photos, files, SMS or call logs. If a Lender needs such data it will ask you directly on its own secure platform.

• To show you cards and loans, run rule-based pre-checks and pass your enquiry to the Lender you choose (performance of the service you asked for).
• To contact you about that enquiry by call, SMS, e-mail or WhatsApp.
• To track whether an application you started was completed, so that Lenders can pay the referral fee that keeps the Platform free.
• To improve the Platform, fix errors, prevent fraud and abuse, and keep it secure.
• To send you updates or offers only if you opt in; you can opt out at any time.
• To comply with law, respond to lawful requests and enforce our Terms.

We use data only for the purpose you gave it for, and we do not sell personal data.

We rely on your free, specific, informed and unambiguous consent, given by ticking the consent box when you submit a form. You may withdraw consent at any time by e-mailing grievance@cardsparrow.com; withdrawal is as easy as giving consent, does not affect processing already done, and may mean we cannot complete your enquiry. For automatic data we rely on your consent to non-essential cookies and on legitimate uses permitted by the DPDP Act for essential ones.

• The Lender you apply to and, where applicable, its authorised sourcing or affiliate partner, so they can process your application. The Lender becomes an independent Data Fiduciary for your data and its own privacy policy applies.
• Affiliate networks (such as Cuelinks, vCommission or EarnKaro) receive only an anonymous click or lead identifier to attribute referrals, not your name or contact details.
• Service providers (Data Processors) who host our servers, send SMS/e-mail/WhatsApp messages, provide analytics or support tools, under contracts that require them to protect your data and use it only on our instructions.
• Authorities where the law requires, or to protect our rights or the safety of users.
• A successor if our business is transferred, subject to this policy.

We do not share your data with anyone else for their own marketing.

Our servers and databases are located in India. Some processors (for example e-mail or analytics providers) may process data outside India in countries not restricted by the Central Government under the DPDP Act, with contractual safeguards.

• Enquiry and lead data: up to 24 months from your last interaction, so that we can support you, resolve disputes and reconcile referral fees; then deleted or anonymised.
• Contact messages: 12 months.
• Server logs and security records: up to 12 months.
• Longer where a law requires or a dispute is pending.

We erase personal data when the purpose is served or when you withdraw consent, unless retention is required by law.

Under the DPDP Act you may:

• Access a summary of the personal data we hold and how it has been processed;
• Correct, complete or update inaccurate data;
• Erase your data (unless we must retain it by law);
• Withdraw consent;
• Grievance redressal through our Grievance Officer, and, if unsatisfied, a complaint to the Data Protection Board of India;
• Nominate a person to exercise your rights if you die or become incapacitated.

To exercise a right, e-mail grievance@cardsparrow.com from the address or phone number you used with us. We respond within the timelines set by the DPDP Rules.

We use HTTPS/TLS encryption in transit, encryption and access controls at rest, role-based access for staff, logging, regular patching and backups. Admin access is password-protected and rate-limited. No system is completely secure; if we become aware of a personal data breach that affects you we will notify you and the Data Protection Board as the law requires. We will never ask you for an OTP, PIN, password or CVV.

The Platform is for adults. We do not knowingly collect data from anyone under 18. If you believe a child has given us data, write to grievance@cardsparrow.com and we will delete it.

We use essential cookies to make the site work, and, with your consent, analytics cookies to understand usage. Details, and how to control them, are in our Cookie Policy.

We may update this policy as our services or the law change. The date at the top shows the current version; significant changes will be highlighted on the site or sent to you where we have your contact details.

Data Fiduciary: CardSparrow, Mumbai, Maharashtra, India.

Grievance Officer / Data Protection contact: Grievance Officer (to be appointed) — grievance@cardsparrow.com — +91 98765 43210 (Mon–Fri, 10 am – 6 pm IST).