Privacy policy

1.What this policy covers

This policy explains what CredSpy collects when you use credspy.com, why we collect it, where it is stored, and what you can ask us to do with it. It covers the website, the card finder, the AI advisor and the partner console.

CredSpy is a comparison service. We are not a bank, a lender or a broker, and we do not take your credit card application. When you press Apply you leave for the issuer’s own website, and from that point the issuer’s privacy policy governs everything you type there.

We never see the application form you fill in on a bank’s site, and we never receive your card number, CVV, PIN or net-banking credentials. Nobody at CredSpy will ever ask you for them.

2.Using CredSpy without an account

Most of the site works without signing up, and most of what you do stays on your own device rather than reaching us at all.

• Card finder (AI Match): your answers — income band, monthly spending, credit standing — are held in your browser’s local storage. They are sent to the ranking endpoint once, scored, and discarded server-side. We do not store the answers or the resulting shortlist against you.
• AI advisor: the conversation is kept in your browser so the page and the floating widget show one thread. Your messages are sent to the model to be answered; we do not build a profile from them.
• Compare tray, shortlist and recently viewed cards: browser storage only.
• Clearing your browser data, or pressing “Start over” in the finder, removes all of the above.

3.When you create an account

An account lets you save cards, keep a wallet of the cards you hold, and follow an application you started through us. To do that we store what you give us:

• Name, email address and mobile number.
• Optional profile details you choose to add — city, monthly income and employment type — which are used to check eligibility rules and to rank cards for you.
• The cards you save, compare or add to your wallet.
• Applications you began through a CredSpy link, and the status the issuer reports back.

Your session is a signed token held in your browser’s local storage, not a third-party cookie. Signing out removes it from the device.

4.Applications and how a referral is attributed

When you open a card through a partner’s link or storefront we set two first-party values so the referral can be credited correctly: an affiliate identifier and a click identifier. They are stored as cookies and in browser storage for 30 days.

If you then apply, we record that an application began — which card, which partner, and the status the issuer later reports. We do not receive the contents of the application.

• These values identify a partner and a click, not you.
• They expire after 30 days, and are cleared when you sign in as a different user or sign out.
• Declining or clearing cookies does not stop you using the site; it only means a referral may not be credited.

5.If you join the partner programme

Partners are paid real money, so the programme collects more than a visitor account does. We hold what is needed to verify you and to make a payment:

• PAN, and a GST number if you have one.
• Bank account name, account number and IFSC.
• Your contact details, the links you create, and the clicks and applications those links produce.

These are used to verify your identity, to pay you, and to meet tax obligations. They are not used for marketing and are not shared with issuers.

6.What appears publicly

The partner leaderboard is a public page. To anyone who is not signed in it shows a shortened name and an earnings band — “₹10K+”, “Under ₹1K” — never an exact figure. Partners see their own real numbers when signed in.

Nothing else about a visitor or a partner is published.

7.Who we share data with

We do not sell personal data, and we do not pass your details to issuers so they can market to you.

Data reaches a third party only in these cases:

• The issuer, when you choose to apply — and only what you type on their own form.
• Our hosting, database and email providers, who process data on our instructions in order to run the service.
• The affiliate networks that report whether an application was approved, which is how a partner’s commission is confirmed.
• A regulator or court, where we are legally required to respond.

8.How long we keep things

Account data is kept while your account is open. Application and commission records are kept for as long as tax and accounting rules require, because they are financial records.

Card-finder answers and advisor conversations are not retained server-side at all, so there is nothing to delete beyond your own browser.

9.Your rights

You can ask us to:

• Send you a copy of the personal data we hold about you.
• Correct anything that is wrong — most of it you can edit yourself from your profile.
• Delete your account and the data attached to it, except records we are required to keep.
• Stop sending you marketing email, which you can also do from the unsubscribe link on any of it.

Write to us and we will respond within 30 days. We may ask you to confirm your identity first, so that nobody else can make a request about your data.

10.Security

Traffic to and from the site is encrypted. Passwords are stored as one-way hashes and cannot be read back, by us or by anyone else. Access to production data is limited to the people who need it to operate the service.

No system is perfect, and we will tell you promptly if a breach affects your data.

11.Children

Credit cards in India are issued to adults, and CredSpy is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will remove it.

12.Changes to this policy

When this policy changes, the date at the top of the page changes with it. Material changes are announced on the site rather than made quietly.