Privacy Policy

Introduction

MyPassbook (“we”, “our”, “us”) is committed to protecting your personal data in accordance with the Digital Personal Data Protection Act 2023 (“DPDP Act”) and applicable Information Technology Rules. This policy explains what data we collect, why we collect it, how we store and protect it, and what rights you have.

What we collect

Why we collect it

• ✓To deliver the rate-comparison service and personalised filters.
• ✓To send rate-change alerts you explicitly opt into.
• ✓To detect and prevent fraud, abuse, and automated scraping.
• ✓To improve site performance and identify errors.

Where your data is stored

All personal data is stored in encrypted Supabase PostgreSQL databases hosted in the Mumbai region (AWS ap-south-1). Row-level security policies ensure that each user's data is accessible only to that user and authorised service processes. Backups are also encrypted.

Third-party services we use

We share minimal necessary data with the following vendors to operate the service. We do not share your data with banks, advertisers, or data aggregators.

• Supabase

  Database and authentication

• Resend

  Transactional email delivery

• Cloudflare

  Security, DDoS protection, and CDN

Your rights under the DPDP Act 2023

The Digital Personal Data Protection Act 2023 gives you the following rights with respect to your personal data held by us:

• Right to access:You may request a summary of the personal data we hold about you.
• Right to correction:You may request correction of inaccurate or incomplete data.
• Right to erasure:You may request deletion of your account and all associated personal data.
• Right to data portability:You may request a machine-readable export of your personal data.

You can delete your data yourself at mypassbook.in/erase. We email a link to the address on file, and pressing the button on it deletes your name, mobile number, email address and anything you sent us through our complaint form.

To exercise any of the other rights, use our contact page.

Data retention

• Rate-alert subscriptions:Until you unsubscribe.
• Hashed page-view logs:90 days, then automatically deleted.
• Support threads:2 years after the last activity in the thread.
• Encrypted PII (registered users):Deleted within 30 days of a verified account-deletion request.

Data Protection Officer

For any question about your personal data, or to exercise your rights under the Digital Personal Data Protection Act 2023, write to privacy@mypassbook.in. We aim to respond within 30 days.