We are the Data Fiduciary for the personal data described here, as that term is used in India’s Digital Personal Data Protection Act, 2023 (the DPDP Act). You are the Data Principal. If you do not agree with this Policy, please do not use the Site.
1. Our approach in short
WeVouch is an information service. We do not sell vouchers, process payments or handle money, so we never ask for and never store payment card numbers, CVVs, bank account numbers, UPI PINs or net-banking credentials. Any page that appears to ask you for these while claiming to be WeVouch is not us. Please report it to contact@wevouch.co.in.
We collect the minimum we need to run the Site, answer your questions and improve our accuracy.
2. Personal data we collect
a) Data you give us directly
Most of the Site works without giving us anything: comparing vouchers needs no account. You give us data in two situations — if you sign in, and if you write to us.
| What | When | Why |
|---|---|---|
| Name, email address and profile picture | When you sign in with Google | To identify your account and show you as signed in |
| Which credit cards you hold, by name | When you save a card on the cards page | To tell you which of your cards to pay with |
| Email address | Contacting support or reporting a wrong rate | To reply to you |
| Name (optional) | Contacting support | To address you correctly |
| Message content | Emails and correction reports | To answer you and fix errors in our data |
We ask you not to include your card number, statement PDFs, account numbers or any other financial identifier in a correction report. A rate, a date and the seller name are enough. If you send us more than that, we will delete the excess.
Signing in, and the cards you save
Signing in uses Google. We never see or receive your Google password. Google tells us your name, email address and profile picture, and nothing else. You can revoke our access at any time from your Google account.
When you save a card we store the name of the card and the bank that issued it — for example “HDFC Bank, Infinia”. That is the whole record.
We never ask for and have nowhere to store a card number, the last four digits of one, an expiry date, a CVV or a PIN. There is no field for any of these anywhere on the Site. If you send one to us by any other route we will delete it rather than store it.
You can remove a saved card at any time from the cards page, and delete your whole account, including every saved card, from your data. Deletion is immediate and we do not keep a copy.
b) Data collected automatically
- IP address, in server and security logs
- Browser type, operating system, device type, screen size
- Pages viewed, time on page, referring URL, outbound links clicked
- Approximate location derived from IP, at city or state level only
We do not collect precise GPS location, contacts, photos, microphone or camera data.
c) Data we do not collect
We do not knowingly collect sensitive categories such as health data, biometric data, caste, religion, sexual orientation or political affiliation. Please do not send these to us.
3. Why we process your data, and on what basis
Under the DPDP Act we process personal data either with your consent, or for certain legitimate uses permitted by law, such as replying to a request you sent us.
| Purpose | Basis |
|---|---|
| Replying to your email or correction report | Voluntary provision for a specified purpose |
| Operating, securing and debugging the Site | Legitimate use, to keep the service available and prevent abuse |
| Verifying whether a published rate is in force | Your consent, where you submit a report |
| Meeting legal, regulatory or law-enforcement obligations | As required by applicable law |
We do not use your data for automated decision-making that produces legal or similarly significant effects about you. We do not build advertising profiles, and we do not sell your personal data to anyone.
4. Withdrawing consent
You can withdraw consent at any time, as easily as you gave it, by writing to contact@wevouch.co.in. Withdrawal applies going forward; it does not undo processing already carried out lawfully. Where consent was our only basis for holding data, we will delete it on withdrawal unless law requires us to keep it.
5. Cookies and analytics
The Site runs no advertising cookies and sets no tracking identifiers of any kind.
It does count one thing. When a page loads we record whether the device was an Android phone, an iPhone or iPad, or a desktop computer, and add one to a running total for that day. We are deciding whether to build a mobile app, and which one to build first.
What is stored is a number per device type per day, and nothing else. No identifier, no address, no session, no page, no referrer — there is nothing recorded that could be linked back to you, and nothing that could be joined into a history of what you looked at. If your browser sends Do Not Track or Global Privacy Control, we do not count you at all.
We do not run third-party advertising cookies or cross-site retargeting pixels. Blocking non-essential cookies will not stop the comparison features from working.
6. Who we share data with
We share personal data only with service providers (“Data Processors”) who process it on our instructions, under contract, and only for the purposes above:
| Provider | Role |
|---|---|
| Vercel Inc. | Website hosting, delivery, server logs |
| MongoDB Atlas | Storing the voucher comparison data, your account and your saved cards |
| Google LLC | Signing you in, and telling us your name, email address and profile picture when you do |
| Functional Software, Inc. (Sentry) | Recording technical errors so we can fix them |
When something breaks on the Site we send the technical details of the failure to Sentry so we can find it. We strip anything that looks like an email address, a password, a key or a database address before the report leaves our servers, and we do not send session identifiers or browsing activity. Error reports are for fixing faults, never for analytics.
We may also disclose data where we are legally required to. That means a court order, a lawful request from a government or law enforcement agency, or establishing or defending a legal claim. It also covers a successor entity after a merger or restructuring, in which case this Policy keeps applying until you are told otherwise.
We do not sell, rent or trade personal data.
7. Where your data is stored
Your account, your saved cards and anything you write to us are stored in India, in MongoDB Atlas’s Mumbai region. The servers that answer this site run in Mumbai too.
Two things do leave the country, and neither is stored abroad by us. Signing in goes through Google, which operates globally and holds your Google account itself — we receive only your name, email address and profile picture. Technical error reports go to Sentry, scrubbed of anything identifying before they are sent; those are used to fix faults and are never combined with your account.
For those, we transfer data only to jurisdictions not restricted by the Government of India under the DPDP Act, and we require contractual safeguards obliging the provider to protect it to a standard consistent with this Policy. Should we ever move where your data is stored, we will update this section before the move, not after.
8. How long we keep data
| Data | Retention |
|---|---|
| Your account, and the cards saved on it | Until you delete it. Deletion is immediate and we keep no copy |
| Messages you send us through the site | 3 months, then deleted automatically |
| Device counts, and searches that found nothing | 3 months, then deleted automatically |
| Support correspondence by email | 24 months from last message |
| Server and security logs | 90 days |
| Rate reports | Retained as anonymised evidence records; identifying details removed once verified |
We delete or anonymise personal data once the purpose it was collected for is served, unless retention is required by law.
9. Your rights
Under the DPDP Act you have the right to:
- Access a summary of the personal data we hold about you and how we process it
- Correct, complete, update or erase your personal data
- Nominate another individual to exercise your rights in the event of your death or incapacity
- Grievance redressal, meaning a first response from us before you approach the Data Protection Board of India
To exercise any of these, write to contact@wevouch.co.in from the email address concerned. We will respond within 30 days. We may ask you to verify your identity before acting, in order to protect your data from someone impersonating you.
If you are not satisfied with our response, you may complain to the Data Protection Board of India.
10. Your duties as a Data Principal
The DPDP Act also places duties on you: not to impersonate someone else when providing data, not to suppress material information, and not to file false or frivolous complaints. Please provide accurate information, and keep it up to date.
11. Children
The Site is intended for users aged 18 and over. We do not knowingly collect personal data from children under 18, and we do not carry out behavioural tracking or targeted advertising directed at children. If you believe a child has provided us personal data, write to contact@wevouch.co.in and we will delete it.
12. Security
We use reasonable technical and organisational safeguards. That means encryption in transit over HTTPS, access controls, least privilege credentials, and regular review of what we store. No system is perfectly secure, and we cannot guarantee absolute security. In the event of a personal data breach, we will notify the Data Protection Board of India and affected users as required by the DPDP Act.
13. Links to other sites
WeVouch links out to voucher platforms and merchant sites. Once you click through, you are on their site and their privacy policy applies, not ours. We have no control over how they collect or use your data, and we encourage you to read their policies before transacting.
14. Changes to this Policy
We may update this Policy as the product changes or the law does. The date above will change, and we will announce material changes on the Site. Continued use after the effective date means you accept the updated Policy.
15. Grievance Officer and contact
In accordance with the DPDP Act and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021:
- Grievance Officer: Tanish Anam
- Email: contact@wevouch.co.in
- Address: 364/5, Shiv Kund, Nagina Bagh, Ajmer, Rajasthan 305001, India
- Response time: acknowledgement within 48 hours; resolution within 30 days
General queries: contact@wevouch.co.in