Privacy Policy

Last updated: August 2026  ·  Effective date: August 2026

1. Who We Are (Data Fiduciary)

DigitalRateCard ("we", "us", "our") is operated as a technology platform that enables local businesses to create digital storefronts. For the purposes of the DPDP Act, 2023, we are the Data Fiduciary processing the personal data of our users and their customers.

Contact: support@digitalratecard.com  ·  digitalratecard.com

2. Personal Data We Collect

We collect the following categories of personal data:

• Store Owner Account Data: Full name, business name, email address, phone number, WhatsApp number, business address, business category.
• Authentication Data: Hashed passwords (bcrypt, not stored in plaintext).
• Business Operations Data: Product/service catalog, pricing, invoices, orders, expense records, customer leads received.
• Customer Lead Data: Name and phone number of customers who submit enquiries to a store (collected on behalf of store owners).
• Usage Data: Store page views, item clicks, enquiry clicks (aggregated, no individual tracking).
• Payment Reference Data: UPI IDs, payment references recorded on invoices (no card numbers stored).
• Technical Data: IP addresses (for security/rate limiting), browser user-agent.

3. Purpose and Legal Basis for Processing

Under Section 4 of the DPDP Act, 2023, we process personal data for the following purposes:

• Providing the Service: Creating and managing your digital store, catalog, invoices, orders and analytics.
• Account Security: Authentication, session management, rate limiting, fraud prevention.
• Communication: Sending account activation emails, password reset emails, lead notification emails, and monthly summary reports — all of which you opt into by using our service.
• Legal Compliance: Retaining records as required under Indian law.

We process data on the basis of consent (provided at signup) and legitimate interest (security, service improvement). We do not sell personal data to third parties.

4. Sensitive Personal Data or Information (SPDI)

Under the IT (SPDI) Rules, 2011, we note that:

• We do not collect passwords in plaintext — passwords are bcrypt-hashed.
• We do not store payment card details, bank account numbers, or financial passwords.
• UPI IDs entered by store owners are stored and used solely for display on their own invoices.
• Phone numbers of customers (leads) are collected on behalf of store owners and visible only to the respective store owner.

5. Data Sharing

We share personal data only in the following limited circumstances:

• Store owners and their customers: Customer enquiry data (name, phone) is shared with the store owner whose store was visited.
• Email delivery: We use Hostinger SMTP to deliver transactional emails. Email content passes through their servers securely.
• Legal obligation: We may disclose data if required by a court order, law enforcement request, or applicable Indian law.

We do not share, sell, rent, or trade your personal data with advertisers or data brokers.

6. Your Rights as a Data Principal (DPDP Act, 2023)

Under Sections 11–13 of the DPDP Act, 2023, you have the following rights:

• Right to Information (Section 11): You can request details of the personal data we hold about you.
• Right to Correction and Erasure (Section 12): You can request correction of inaccurate data or erasure of your personal data when it is no longer necessary for the purpose for which it was collected.
• Right to Grievance Redressal (Section 13): You can raise a grievance with us and receive a response within a reasonable time.
• Right to Nominate (Section 14): You may nominate another individual to exercise your rights in the event of death or incapacity.

To exercise any of these rights, email us at support@digitalratecard.com with your registered email address and request details. We will respond within 30 days.

7. Data Retention

• Active accounts: Data is retained for as long as your account is active.
• Deleted accounts: Upon account deletion request, personal data is deleted within 30 days, except where retention is required by law (e.g., invoicing records may be retained for up to 8 years under GST law).
• Inactive accounts: Accounts inactive for more than 2 years may be archived or deleted.
• Lead data: Customer enquiry data is retained as long as the store account is active.

8. Security Measures

We implement the following security measures in accordance with the IT (SPDI) Rules, 2011 — Rule 8 (Reasonable Security Practices):

• Passwords hashed using bcrypt (cost factor 12).
• CSRF protection on all state-changing requests.
• Rate limiting on authentication and form submission endpoints.
• HTTPS enforced for all data transmission.
• Session cookie flags: HttpOnly, Secure, SameSite=Lax.
• Session ID rotation on login/logout.
• Input validation and parameterized database queries (SQL injection prevention).
• File upload validation (MIME type, extension, size limits).

No system is 100% secure. In the event of a data breach, we will notify affected users and the relevant authorities as required under applicable law.

9. Cookies

We use a single session cookie (PHPSESSID) strictly necessary for authentication. We do not use third-party tracking cookies, advertising cookies, or analytics trackers.

If you access the public storefront without logging in, no cookies are set.

10. Children's Privacy

Our service is not directed at children under 18 years of age. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a minor, please contact us immediately.

11. Third-Party Links

Store pages may contain links to WhatsApp, Instagram, YouTube, or other platforms. We are not responsible for the privacy practices of these third-party services.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email. Continued use of the service after changes constitutes acceptance of the updated policy.

13. Grievance Officer

In accordance with the IT Act, 2000 and the DPDP Act, 2023, a Grievance Officer is designated to address concerns:

• Name: DigitalRateCard Support Team
• Email: support@digitalratecard.com
• Response time: Within 30 days of receiving the grievance.

14. Contact Us

For any privacy-related questions, data requests, or grievances:

Email: support@digitalratecard.com
Website: digitalratecard.com