Privacy Policy

Last updated: 28 July 2026 · Effective from: 28 July 2026

1. What data we collect

a. Information you give us

• Registration details: your name, mobile number and email address.
• Card details you choose to save: for each card you add, we store only the bank/issuer name, the card type (debit or credit) and the last 4 digits of the card. We do not collect or store your full card number, CVV, PIN, card expiry date, or any net-banking/UPI passwords — and you should never enter them.
• Alternate / family contact details: the name and mobile number of a trusted person you add as an emergency or “Family Circle” contact.
• Communications: messages you send to us (e.g. support requests to support@blockmycard.in) and any information in them.
• Payment information (for optional paid features): if you purchase a paid feature, payment is processed by a third-party payment gateway (currently Razorpay, Cashfree and/or Easebuzz). We receive a confirmation of payment and limited transaction details; we do not store your full card, UPI or bank credentials.

b. Information we collect automatically

• Technical and usage data: IP address, device type, browser, operating system, pages viewed, referring pages, and access timestamps (log data).
• Preferences: language, dark mode and font-size settings, typically stored on your device.
• Cookies and similar technologies: used to keep you signed in, remember preferences, and understand usage. See Section 6.

c. Information about people you add

When you save an alternate or family contact, you are sharing another person’s details. You confirm that you have their permission to do so. They may contact us to have their details removed.

2. How we use your data

We use your data to:

• create and manage your account and sign you in (including from another device if your phone is lost);
• store the card contact details and helpline information you choose to save, and show them to you when you need them;
• show relevant bank block-helplines, blocking steps and templates;
• enable optional features such as family contacts and paid blocking templates;
• respond to your support requests and communicate service-related updates;
• operate, secure, debug and improve the Service;
• prevent fraud, abuse and misuse; and
• comply with applicable law and lawful requests from authorities.

Legal basis (DPDP Act): we process your data based on the consent you give when you register and save details, and for certain legitimate uses permitted under the Act (such as complying with law). You may withdraw consent at any time (see Section 8).

3. What we do NOT do

• We do not sell your personal data.
• We do not use your saved card details for advertising or share them with advertisers.
• We do not require your full card number, CVV, PIN or passwords.
• We are not able to see, use or transact on your cards; only your bank can block or operate your card.

4. When we share data

We share personal data only as needed to run the Service:

• Service providers (Data Processors): hosting/infrastructure, database, communications (SMS/email) and payment-gateway providers who process data on our behalf under contract. Our website is hosted on Vercel, and user data is stored using Supabase (a managed database platform). Payments (if any) are processed by Razorpay, Cashfree and/or Easebuzz.
• Legal and safety: where required to comply with law, a court order, or a lawful request by a government authority, or to protect the rights, safety and property of users, the public or BlockMyCard.
• Business transfer: if we are involved in a merger, acquisition or asset sale, your data may be transferred, subject to this Policy.

We require our processors to protect your data and use it only for the purposes we specify.

5. Data storage, location and security

• Your data is stored using Supabase. Where any data is stored or processed outside India, we do so only as permitted under the DPDP Act and applicable law.
• We use reasonable technical and organisational safeguards — such as encryption in transit (HTTPS), access controls, and restricted internal access — to protect your data. As an early-stage service, we are formalising our security practices and will update this section as they mature.
• No method of transmission or storage is completely secure. You are responsible for keeping your login credentials confidential. Please do not save any information you are not comfortable storing, and never enter your full card number, CVV or PIN.

6. Cookies and tracking

We use cookies and similar technologies to keep you signed in, remember your preferences, and measure and improve usage. We use Google Analytics, a third-party analytics service, to understand how visitors use the Service; Google Analytics sets its own cookies and processes data in accordance with Google’s privacy policy. You can control cookies through your browser settings; disabling some cookies may affect how the Service works.

7. How long we keep your data

We keep your personal data for as long as your account is active, and by default for a period of up to one year from the date of your subscription/registration, after which it may be renewed if you continue using the Service or deleted if your account becomes inactive. If you delete a saved detail, close your account, or ask us to erase your data, we will delete it within a reasonable period, except where we must retain certain information to comply with law, resolve disputes or prevent fraud. We may retain anonymised, non-identifying data.

8. Your rights

Under the DPDP Act, you have the right to:

• Access a summary of the personal data we process about you;
• Correct, complete or update inaccurate or incomplete data;
• Erase your personal data where it is no longer needed;
• Withdraw consent at any time (this will not affect processing already carried out, and may mean we can no longer provide the Service);
• Nominate another individual to exercise your rights in case of death or incapacity; and
• Grievance redressal — raise a complaint with us and, if unresolved, with the Data Protection Board of India.

You can exercise most of these directly from your account, or by writing to us at support@blockmycard.in. We will respond within the timelines required by law.

9. Children

The Service is intended for individuals aged 18 and above. We do not knowingly collect the personal data of children (as defined under the DPDP Act) without verifiable consent of a parent or lawful guardian, and we do not carry out tracking or targeted advertising directed at children. If you believe a child has provided us data, please contact us and we will delete it.

10. Third-party links

The Service links to third-party websites such as your bank’s site, RBI (rbi.org.in), the National Cyber Crime Reporting Portal (cybercrime.gov.in) and others. We are not responsible for the privacy practices or content of those sites. Please review their privacy policies separately.

11. Changes to this Policy

We may update this Policy from time to time. We will post the updated version here with a new “Last updated” date and, where the changes are significant, notify you through the Service. Your continued use after an update means you accept the revised Policy.

12. Grievance Officer and contact

If you have questions, requests or complaints about your data or this Policy, please contact:

We aim to acknowledge grievances promptly and resolve them within the timelines prescribed under the DPDP Act. If you are not satisfied with our response, you may approach the Data Protection Board of India.

13. Governing law

This Policy is governed by the laws of India, and any disputes are subject to the exclusive jurisdiction of the courts at Mumbai.