Privacy Policy

Last Updated: 20 May 2025 · Effective Date: 20 May 2025

Welcome to CouponDrop & Grab ("we", "us", "our", or the "Platform"), accessible at coupondropngrab.in. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you access or use our Platform. By using CouponDrop & Grab, you consent to the data practices described in this policy.

This policy is published in accordance with the Information Technology Act, 2000 ("IT Act"), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), and the Digital Personal Data Protection Act, 2023 ("DPDP Act") of India.

Table of Contents

1. Information We Collect

We collect and process the following categories of personal data to operate the Platform and provide our services:

1.1 Account Information (via Google OAuth)

When you sign in using your Google account, we receive and store:

Full name as registered with your Google account
Email address associated with your Google account
Profile picture URL from your Google account
Google unique identifier (for account linkage)

1.2 Financial Information

UPI ID(s) you provide for the purpose of processing coin-to-INR withdrawal requests
Transaction history including withdrawal amounts, timestamps, and payout statuses

1.3 Platform Activity Data

Coupon/promo codes you upload or share on the Platform
Coin balance and earning/redemption history
Coupon usage data — which coupons you have grabbed, redeemed, or reported

1.4 Technical & Usage Data

The following data is collected automatically by our hosting provider (Vercel) and database (Supabase) for security, debugging, and analytics. This data is strictly stored securely on the backend, is not visible to other users or on your public dashboard, and is only accessible to authorised administrators:

IP address, browser type and version, operating system
Device identifiers, screen resolution, and language preferences
Pages visited, clickstream data, time spent on pages, and referral URLs
Error logs and performance metrics for debugging and platform stability

2. How We Use Your Information

We process your personal data only for specific, lawful purposes. Your data is used for:

Account Creation & Management: To create, authenticate, and maintain your user account via Google OAuth
Coin Crediting & Balance Management: To credit coins to your account when your shared coupons are used by other users, and to maintain accurate balance records
Withdrawal Processing: To process your requests to convert earned coins to INR and transfer funds to your UPI ID via our payment partner
Fraud Prevention & Platform Integrity: To detect, investigate, and prevent fraudulent activities including fake coupon uploads, duplicate account creation, and abuse of the coin/reward system
Communication: To send you transaction confirmations, withdrawal receipts, policy updates, and essential service notifications
Platform Improvement: To analyse usage patterns, diagnose technical issues, and improve the user experience, performance, and features of the Platform
Legal Compliance: To comply with applicable laws, regulatory requirements, legal processes, or enforceable governmental requests

3. Data Storage & Security

3.1 Infrastructure

Your data is stored on Supabase, a managed database platform hosted on Amazon Web Services (AWS) infrastructure. Supabase data centres utilised by our Platform may be located outside India. By using the Platform, you consent to the transfer and storage of your data on servers that may be situated outside India, subject to adequate data protection safeguards.

3.2 Security Measures

We implement reasonable security practices and procedures as required under the IT Act and SPDI Rules, including but not limited to:

Row Level Security (RLS): Database-level access controls ensure users can only access their own data
Encrypted Connections: All data transmitted between your browser and our servers is encrypted using TLS/SSL (Transport Layer Security / Secure Sockets Layer) protocols
No Plain-Text Storage of Sensitive Data: Sensitive information such as UPI IDs is never stored in plain text in application logs or publicly accessible tables
Access Controls: Administrative access to the database and backend systems is restricted to authorised personnel only, protected by multi-factor authentication
Regular Audits: We periodically review our security practices to identify and address vulnerabilities

While we take commercially reasonable steps to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your personal data.

4. Third-Party Services

We integrate with the following third-party services to operate the Platform. Each third-party service provider has its own privacy policy governing the use of your data:

Google OAuth (Google LLC): Used for secure user authentication. Google may collect data in accordance with its own Privacy Policy.
Supabase Inc.: Provides our database, authentication, and backend services. Data is stored on AWS infrastructure. See Supabase Privacy Policy.
Cashfree Payments: Processes UPI-based withdrawal payouts. Your UPI ID and withdrawal amount are shared with Cashfree solely for the purpose of completing the transaction. See Cashfree Privacy Policy.
Vercel Inc.: Our hosting and infrastructure provider. Vercel collects technical and usage data to ensure platform security and performance. See Vercel Privacy Policy.
Cuelinks: We use Cuelinks as our affiliate marketing aggregator. When users click on shared coupon codes, their traffic is routed through Cuelinks to the respective brand's website. Cuelinks may collect clickstream and purchase data. See Cuelinks Privacy Policy.
Advertising Networks (Future): We may in the future integrate third-party advertising networks (such as Google AdSense) to display advertisements on the Platform. If and when such integrations are introduced, this Privacy Policy will be updated accordingly, and any applicable ad-related data collection will be disclosed.

5. Cookies & Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience on the Platform:

5.1 Essential / Session Cookies

These cookies are strictly necessary for the Platform to function. They manage your authentication session after signing in via Google OAuth and maintain your logged-in state across pages. These cookies cannot be disabled without breaking core Platform functionality.

5.2 Analytics Cookies

We may use analytics cookies (including first-party and third-party cookies) to understand how users interact with the Platform — such as which pages are most visited, how long users spend on the Platform, and where errors occur. This data is used in aggregate to improve the Platform and is not used to personally identify you.

5.3 Managing Cookies

You can control and/or delete cookies through your browser settings. Note that disabling essential cookies may impair your ability to use the Platform. For more information on managing cookies, visit allaboutcookies.org.

6. Data Retention

We retain your personal data only for as long as is necessary to fulfil the purposes described in this policy, unless a longer retention period is required or permitted by law.

Active Accounts: Your account data (name, email, profile picture, coupon history, coin balance) is retained for as long as your account remains active.
Financial Records: Transaction and withdrawal records are retained for a minimum of eight (8) years from the date of the transaction, in compliance with applicable Indian tax, accounting, and anti-money laundering regulations.
Technical Logs: Server logs and analytics data are retained for up to twelve (12) months and are subsequently anonymised or deleted.
Account Deletion: Upon receiving a valid request for account deletion, we will delete or anonymise your personal data within thirty (30) days, except for data we are legally obligated to retain (such as financial records and transaction logs). Coupon codes previously uploaded by you may remain on the Platform in an anonymised form (disassociated from your identity).

7. Your Rights Under Indian Law

Under the Information Technology Act, 2000, the SPDI Rules, 2011, and the Digital Personal Data Protection Act, 2023 (DPDP Act), you have the following rights as a Data Principal:

Right to Access: You have the right to obtain confirmation as to whether we process your personal data, and to request a summary of your personal data along with the processing activities undertaken.
Right to Correction: You have the right to request the correction of any inaccurate or incomplete personal data we hold about you. You may update your display name directly from the Platform. For other corrections, please contact us.
Right to Erasure: You have the right to request the deletion of your personal data. Upon such request, we will erase your data subject to any legal retention obligations as outlined in Section 6.
Right to Withdraw Consent: Where processing is based on your consent, you may withdraw your consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out prior to the withdrawal. You may withdraw consent by deleting your account or by contacting us at the email address listed below.
Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format (e.g., JSON or CSV), and to have that data transmitted to another data fiduciary where technically feasible.
Right to Grievance Redressal: You have the right to lodge a complaint with our Grievance Officer (see Section 10) or with the Data Protection Board of India established under the DPDP Act.
Right to Nominate: In the event of your death or incapacity, you have the right to nominate any other individual who shall exercise your rights under the DPDP Act on your behalf.

To exercise any of the above rights, please email us at cyberjnana@gmail.com with the subject line "Data Rights Request". We will respond to your request within seventy-two (72) hours of receipt.

8. Children's Privacy

CouponDrop & Grab is not intended for use by individuals under the age of eighteen (18) years. We do not knowingly collect, process, or store personal data from children under 18.

In accordance with the DPDP Act, 2023, processing of personal data of children (defined as individuals below 18 years of age) requires verifiable consent from a parent or lawful guardian. We do not provide mechanisms for verifiable parental consent, and therefore the Platform is strictly not available to users under 18.

If we become aware that we have inadvertently collected personal data from a child under 18, we will take immediate steps to delete such data from our records. If you believe that a minor has provided us with personal data, please contact us immediately at cyberjnana@gmail.com.

We do NOT sell, rent, trade, or otherwise commercially distribute your personal data to any third party.

We may share your personal data only in the following limited circumstances:

Payment Processors: Your UPI ID and withdrawal-related data are shared with Cashfree Payments solely for the purpose of processing coin-to-INR payouts to your UPI account. Only the minimum data required to complete the transaction is shared.
Legal Obligations: We may disclose your data if required to do so by law, court order, subpoena, or other legal process, or if we believe in good faith that such disclosure is necessary to (a) comply with a legal obligation, (b) protect and defend our rights or property, (c) prevent fraud or abuse, or (d) protect the personal safety of users or the public.
Business Transfers: In the event of a merger, acquisition, reorganisation, or sale of all or a portion of our assets, your personal data may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on the Platform before your data is transferred and becomes subject to a different privacy policy.
With Your Consent: We may share your data with third parties where you have explicitly consented to such sharing.

10. Grievance Officer

In accordance with the Information Technology Act, 2000 and the DPDP Act, 2023, the details of the Grievance Officer for the purpose of this Privacy Policy are as follows:

Designation:Grievance Officer, CouponDrop & Grab

Email: cyberjnana@gmail.com

Response Timeline: We shall acknowledge your grievance within seventy-two (72) hours of receipt and endeavour to resolve it within thirty (30) days of acknowledgement, in accordance with applicable Indian law.

If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India established under the DPDP Act, 2023.

11. Changes to This Policy

We reserve the right to update or modify this Privacy Policy at any time. When we make changes:

The "Last Updated" date at the top of this page will be revised.
For material changes (changes that significantly affect how your data is collected, used, or shared), we will notify you via email to the address associated with your account and/or by posting a prominent notice on the Platform at least seven (7) days prior to the changes taking effect.
Your continued use of the Platform after the effective date of the revised policy constitutes your acceptance of the updated terms.

We encourage you to review this page periodically to stay informed about how we protect your data.

12. Governing Law & Jurisdiction

This Privacy Policy shall be governed by and construed in accordance with the laws of India, including but not limited to the Information Technology Act, 2000, the SPDI Rules, 2011, and the Digital Personal Data Protection Act, 2023.

Any disputes arising out of or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts located in India. You irrevocably consent to the jurisdiction and venue of such courts for the purposes of any legal action or proceedings arising out of this policy.

If you have any questions, concerns, or requests regarding this Privacy Policy, please contact us at cyberjnana@gmail.com.