Privacy policy

BestCredit ("we") is an Indian credit-card information and comparison website at bestcredit.in. We collect as little personal data as we can. This policy explains what we do collect, why, and the rights you have under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). For the account data described below, we are the Data Fiduciary.

You can read all of BestCredit without an account. Every card page, guide, comparison, calculator and chapter of Credit Cards 101 is open to read, signed in or not, and we do not put any of it behind a form. Signing in does one thing: it saves your course progress to an account so it follows you between devices. To turn that on we ask you to fill in a short course-setup form once — three tap-only questions, plus an optional mobile number you are free to leave blank. If you would rather not, the entire course stays readable; you simply keep your place in your own browser instead of on our server.

Bestieis an optional assistant on the site — it was called Ask BestCredit until 24 September 2026. To use it you verify an Indian mobile number on WhatsApp or an email address once a month; the section "Bestie" below says exactly what that collects and keeps.

What we collect

• Your BestCredit account (optional, Google sign-in only). If — and only if — you choose to sign in, we store: your Google account identifier, your email address, your display name, your profile-picture URL, the times you created the account and last signed in, and which chapters and modules of Credit Cards 101 you have marked complete. The purpose is to keep you signed in and remember your progress; the legal basis is your consent, given by choosing to sign in, and you can withdraw it at any time by deleting your account. We do not use this data for advertising, we do not profile you, and we do not sell or share it.
• Your course profile. To start Credit Cards 101 on your account we ask three things, once, on a single screen: roughly what you put on a card each month (as a band, never an exact figure), which up-to-three categories most of it goes to, and what you want out of the course. We use them for two things and nothing else — suggesting where to start in the course, and prefilling the rewards calculator with your numbers instead of ours. The legal basis is your consent, given on that screen under this notice, and you can change or clear every answer at any time from your account. That form never asks what you earn. Bestie does — as one of five broad bands, only if you choose to answer, and never as a figure. See “Bestie” below. We never verify these answers against anything, we do not use them for advertising, we do not build a behavioural profile of you, and we do not share them with card issuers or affiliate networks.
• Your mobile number — optional. The same form offers a field for an Indian mobile number. It is optional in the ordinary sense of the word: leaving it blank completes the form, saves your course progress and changes nothing about the site. We ask for it for one stated purpose — reminders about annual-fee waivers and card renewals — and for nothing else. No reminder is sent today. Nothing verifies this number and nothing sends to it; if you give it, you are giving it for a feature we have not built yet, and we would rather say so than imply a text is coming. The WhatsApp connection described under Bestie is used only to send verification codes you request, never for reminders, and never to this number unless you also verify it there. It is never displayed on any public page, never given to a card issuer or affiliate network, never used for advertising, and never attached to an Apply click. You can remove it on its own — without clearing anything else — from your account, using "Remove my number"; we NULL it immediately and record the dated withdrawal.
• A verified number or email for Bestie — only if you use the assistant. To send you a one-time code we use the mobile number (WhatsApp) or email address you type into the assistant. We do not store the number or the address: we keep a keyed one-way hash of it (a code we can recognise but not reverse) so that your daily allowance and your conversations follow you when you verify again, a masked hint such as "+91 99*** **038" so you can see which one you used, whether it was WhatsApp or email, and the dates you verified and last used it. The purpose is to confirm you are a person, to apply a fair daily limit because every answer costs us money, and to keep your conversation history; the legal basis is your consent, given by ticking the unticked box beside the field. This is a separate purpose, a separate consent and a separate record from the optional reminders number in your course profile: the two are never joined, and verifying for the assistant never adds a number to your profile.
• What you tell Bestie about yourself — a screen you can skip.Before your first question the assistant offers a short form: a first name to call you by, your city, a broad annual-income band (five bands — never an exact figure), whether you are employed or self-employed, and, only if you want to say, a credit-score band with an “I don't know” answer. You can skip the whole screen, and the score band is the only answer you can leave blank on it; Bestie answers either way, just less specifically. We use these answers for one thing: to make each answer fit your situation and to greet you by name. The legal basis is your consent, given by ticking the unticked box on that screen, under this notice. We never verify any of it, we never check a credit bureau — we hold no bureau data and cannot — we do not use it for advertising, and we never share it with card issuers or affiliate networks. You can see, change or clear every answer from inside the assistant at any time; clearing them leaves your conversations alone. From the moment you clear them we stop sending them to the model — but if Bestie used your first name in an answer, that answer keeps it until you delete the conversation or it ages out at 90 days.
• An email address, if you fill that form in. The same screen asks for an email address and stores it as you typed it. We use it for three things and nothing else: so we can recognise you if you later sign in with Google using the same address; so we can send you a copy of your data if you ask for one by email; and so the assistant can email you an answer when you ask it to. It has its own tick, separate from the one covering the answers above, because what we might send you is a different question from the rest of the form. The form will not save without an address — but the whole screen is skippable, and Bestie answers just the same if you skip it. We send nothing to it unless you ask, we never use it for marketing, it is not a second way to sign in, and it is never sent to the model that writes the answers.
• Statements you attach to Bestie.You can attach a PDF or a screenshot of a bank or credit-card statement so the assistant can go through the charges with you. The file is sent to Amazon Bedrock together with your question, exactly as your typed message is, so that Anthropic's Claude model can read it and answer — and it is not used to train any model. We hold the file on Cloudflare R2, our file store, only for that day's conversation: we delete it at the end of that Indian day, and within 24 hours of that at the latest, and straight away when you delete the conversation, delete your chat data or delete your account. We record alongside it only its type, its size, roughly how many pages it has, the day it was uploaded, and a checksum of the file — a short code worked out from its contents, which cannot be turned back into the file, and which lets us confirm the file arrived intact and avoid storing a second copy if you pick the same file again that day. All of it is deleted when the file is. We never receive its filename. We never read your statements ourselves, we never index them, and we never copy your account number or your transactions into any record of ours — nothing survives the file except the assistant's answer and the summary table it builds, which stay with your conversation for 90 days and which you can delete at any time. Attach only statements for an account in your own name. If you would rather not upload one, black out what you do not want us to have, or just describe the charge in words — Bestie can work from that.
• Your conversations with Bestie.What you type to the assistant and what it answers are stored on our server for 90 days so you can return to them, then deleted. Each answer is generated by Anthropic's Claude model, run for us by Amazon Web Services (Amazon Bedrock — see Third parties); your messages, the conversation so far and the card facts the assistant looks up are sent to it for that purpose only and are not used to train models. We also record, per day, how many credits each answer used, and what it cost us to run, in paise, and we keep which page of our site you opened each chat from, so the assistant knows what "this card" means; it is deleted with the conversation and included in your download. Do not type card numbers, CVVs, PINs, OTPs, PAN, Aadhaar, account numbers or passwords into the assistant — it does not need them and will ask you to remove them.
• Your 18+ confirmation and the terms you accepted. Before you sign in you tick one box — unticked to start, and you have to tick it yourself — confirming you are 18 or over and accepting our terms of use and this policy. We store two dated records of that, with the version of this page in force at the time, and nothing more: no date of birth and no age.
• What you type in the tools.The recommendation wizard, the EMI calculator and the interactive figures run entirely in your browser — those inputs are never sent to or stored on our servers, and moving a slider sends us nothing. Two things are saved to your account when you are signed in, and only those two: which chapters and modules you have marked complete, and the course profile above. Where we use that profile to set the calculator's starting numbers, you can change them on the spot, and your changes are still not sent back to us. The assistant is the one exception, and it says so above: what you type into Bestie is stored, for 90 days, so you can return to it.
• Aggregate usage analytics. We use privacy-preserving, cookieless analytics (aggregate page views, country, referrer, device class). This does not identify you and is not used for advertising profiles.
• Outbound click logs.When you click an Apply button, we record that a click happened for a given card and page surface (e.g. "comparison table" or "assistant"), with the referring page. These logs carry no identifier and are never linked to your account or your verified identity, whether or not you are signed in.
• Emails you send us. If you contact us, we keep the correspondence to respond and improve the site.

Every field in your course profile

This is the whole of it — field by field, what each is for, the lawful basis, whether it is required, and how long we keep it.

We ask for separate consent for each purpose.Signing in, saving your course progress, keeping a course profile, giving us a mobile number for reminders, verifying for Bestie, telling Bestie about yourself, giving Bestie an email address, attaching a statement to Bestie, and receiving our email digest are nine different things with nine different consents. We never bundle them into a single "I agree", we never pre-tick a box, and you can withdraw any one of them without losing the others — clearing your profile answers leaves your account and your progress intact, removing your mobile number leaves everything else untouched, clearing what you told Bestie leaves your conversations alone, deleting your chat data leaves your account alone, and unsubscribing from the digest changes nothing about your account.

What we never collect

BestCredit is a comparison and education site — not a bank, a lender, a loan agent or a credit bureau. We will never ask you foryour PAN, your Aadhaar number, your date of birth, your bank account number or IFSC, your card number, expiry or CVV, your salary slips, your employer's name, your existing loans or EMIs, or your home address. We never pull, hold or check credit-bureau information about anyone. When Bestie asks for a credit-score band, that is you telling us a range: we do not verify it, and we could not.

Two things changed on 24 September 2026, and we would rather spell them out than bury them. Bestie now asks for a broad income band and, if you want to give one, a credit-score band — bands, never figures, never verified, never shared, and every one of them skippable. And it lets you attach a statement, which will usually contain your account number and your transactions: we send it to the model to answer your question, we copy nothing out of it, and we delete it at the end of the day. Everything on the list above is still something we will never ask you for.

If any page, email, call or message asks you for these in our name, it is not us — please report it to contact@bestcredit.in.

We hold at most four contact details, each for its own stated purpose: the email address Google gives us when you sign in; an optional mobile number you may type into the course-setup form, for reminders; if you use Bestie, a keyed hash of the number or email you verified with — never the number or address itself; and, if you chose to give Bestie one, an email address you typed into its details form, stored as you typed it and used only for the purposes described above. The only messages we send are the one-time codes you ask for, by WhatsApp (through Meta's WhatsApp Business platform) or by email (through Amazon Web Services), and a copy of a Bestie answer when you press the button that asks us to email you one. We send no reminders, no SMS and no marketing to any number, we do not cold-call, and we never message you first. A call or text claiming to be BestCredit that is not a code you just requested is not us; any call asking for an OTP, a card number or a CVV certainly is not.

Signing in with Google

We use Google only to verify who you are. When you sign in, Google tells us your Google account identifier, email address, name and profile-picture URL — nothing else. We request exactly three basic permissions (openid, email, profile) and no permission to read your Gmail, Drive, contacts, calendar or anything else. We never see or receive your Google password. We never post anything to your Google account. We ask for no long-lived access: the token from Google is used once, at sign-in, to confirm your identity, and is discarded immediately — we do not store it.

Google's own handling of your data is covered by the Google Privacy Policy. You can remove BestCredit's access at any time at myaccount.google.com/permissions.

Bestie (AI assistant)

Bestie answers questions about credit cards using our own verified card data, our published methodology and our guides. It is an AI system, not a person, and it is not a financial adviser.Its answers are general information that may be incomplete or wrong; it never sees your credit report or your accounts. It sees the income band, job type and score band you chose in the details form, your first name and your city — and nothing else about your money unless you attach a statement yourself. Nothing it says is an eligibility decision, a pre-approval or a promise from any issuer. Confirm the live terms on the issuer's website before you apply.

What happens when you use it. Before your first answer we ask you to verify a WhatsApp number or an email address with a one-time code, and we use Cloudflare Turnstile to check that the request comes from a person; Turnstile may set a short-lived cookie of its own on challenges.cloudflare.com and processes your IP address and browser signals for that purpose only. Each answer costs us money, so every verified person gets 15 free questions a day, shown in the assistant as credits and reset at midnight Indian time; a statement analysis uses three, because it costs us more. Underneath that count we also keep an internal spending safeguard — per person, per network address and for the site as a whole — purely to stop runaway cost or abuse. It is a safeguard, not a price to you, you will not normally meet it, and we do not publish the figure because we move it as our costs move. We record, per day, how many credits you have used and what your answers cost us to run. We also keep counts per network address (as a keyed hash that changes every day) of codes requested and questions asked, to prevent abuse.

Emailing yourself an answer. If you ask Bestie to email you an answer, we send that answer to your address and record that we sent it. We never email you anything you did not ask for, we never attach the statement you uploaded, and we only ever send to an address you have confirmed with a code — the confirmation exists so that one mistyped letter cannot send your answer to a stranger.

What we keep and for how long.The keyed hash, the masked hint and the dates: until you delete your chat data. Your daily usage totals: until you delete your chat data, except today's, which stays under the keyed hash until midnight IST so that deleting and re-verifying the same number or address does not reset the allowance. A dated record that a verification happened — which channel, when, and the daily-changing address hash, with no number, email, name or identifier in it — for at least one year, as rule 8(3) of the DPDP Rules 2025 requires of processing records; this record survives deletion and cannot identify you. Your conversations: 90 days, or until you delete them or your chat data. What you told Bestie about yourself, and the email address you gave it: until you clear them or delete your chat data. A statement you attach: the end of that Indian day, and within 24 hours of that at the latest. The one-time code itself: five minutes, stored only as a hash, then removed. The bc_chat cookie: 30 days.

Your controls.Inside the assistant you can start a new chat, delete any conversation, see and change what you told Bestie about yourself or clear it entirely, download everything we hold for your verified identity, and press "Delete my chat data", which erases your conversations, any file you attached today, the details you gave Bestie, your allowance records and the verified identity itself immediately from our records and within 24 hours from our file store (today's usage total excepted, as above). If you press "Link to my Google account", the two are linked so that your account download includes the chat data and deleting your Google account deletes it too.

Cookies

We set no advertising cookies and no cross-site tracking cookies. We set four first-party cookies, all strictly necessary for signing in or for verifying with the assistant, all HttpOnly and Secure (they cannot be read by JavaScript), and none is set unless you choose to sign in or to verify for the assistant:

Because all four are first-party and strictly necessary, no cookie-consent banner is required. The consent that matters is the box you tick on the sign-in screen before the Google button will work, or beside the number or address field in the assistant before a code is sent, where this is stated before you click. Signing out deletes the session on our server immediately. Cloudflare Turnstile, used only on the verification step, may set its own cookie on challenges.cloudflare.com; it is strictly necessary for that check (see the Cloudflare Turnstile Privacy Addendum).

How long we keep it

• Sign-in sessions: at most 30 days, then they expire and are purged automatically. Signing out ends them at once.
• Account data, course progress and your course profile: until you delete your account, or — for the profile answers on their own — until you clear them from your account, which erases them immediately: the answers, your mobile number if you gave one, and the dated record of when you gave them. The number can also be removed on its own, leaving everything else in place, with "Remove my number" on the same page. We keep a dated record of each consent, including your 18+ confirmation and your acceptance of the terms; clearing your answers keeps those (so we do not lose the record that you told us you were an adult) and erases everything else in the profile, and unsubscribes you from the digest if you were on it. Deleting the account erases all of it. We do not currently delete dormant accounts automatically; if we introduce that, we will say so here and warn you by email first.
• Bestie conversations: 90 days, or until you delete them.
• Files you attach to Bestie: the end of the Indian day you uploaded them, and within 24 hours of that at the latest.
• What you told Bestie about yourself: until you clear it, delete your chat data, or delete a linked account.
• The email you typed into Bestie's details form: the same.
• Bestie identity (hash, hint, dates) and daily allowance records: until you delete your chat data — except today's usage total, kept under the keyed hash until midnight IST so that deleting and re-verifying does not reset the allowance.
• Bestie verification records: at least one year and at most 400 days (rule 8(3), DPDP Rules 2025), with no identifier in them.
• One-time codes: five minutes as a hash, then deleted.
• Email correspondence: as long as needed to handle the matter and to keep a record of it.

Deleting your account

Go to your accountand choose "Delete my account". You will be asked to confirm by typing DELETE. This is immediate and permanent: your account record (Google identifier, email, name, profile-picture URL, timestamps), your course profile (spend band, spend areas, goal, and your mobile number if you gave one), the dated record of when you gave those answers and your consents including the 18+ confirmation, all your course progress and all your sign-in sessions are erased from our database. It is a real deletion, not a hidden flag on a row we keep. You are signed out of every device at the same time.

If you linked Bestie to your account, your chat conversations, the details you gave the assistant, the email address you typed into it, any file you attached today and your allowance records and verified identity are erased in the same deletion (today's usage total excepted — it is kept under the keyed hash until midnight IST so that deleting and re-verifying does not reset the allowance). Chat data that was never linked is deleted from inside the assistant instead ("Delete my chat data") — immediate, no account needed. The one-year identifier-free verification log is kept as the DPDP Rules require.

Two things it does not do, because they are separate consents. It does not unsubscribe you from our newsletter — use the unsubscribe link in any newsletter email for that. And it does not change anything at Google; if you also want to remove BestCredit there, use myaccount.google.com/permissions. You may create a new account later by signing in again; it starts empty.

Third parties

• Google (identity provider). Google verifies your identity when you choose to sign in, as described above. We use no Google advertising or analytics products.
• Cloudflare (hosting and database). The site runs on Cloudflare Workers. Your account data, your course progress and your Bestie data are stored in Cloudflare D1, its managed database. A statement file you attach is stored in Cloudflare R2, its object store, in a private bucket that is not reachable from the web, and is deleted as described above. Cloudflare is a processor for both, and also processes requests (IP addresses, headers) as our infrastructure provider to deliver and secure the site.
• Brevo (newsletter). If you subscribe to our email digest — from the footer form, or by ticking the unticked box on the course-setup screen — your email address is stored with Brevo, our email provider. That is a separate opt-in from your account, and only your email address goes to Brevo: never your course profile. Untick the box, clear your profile, or use the unsubscribe link in any email, and we delete your address from Brevo — withdrawing is as easy as giving.
• Meta Platforms (WhatsApp Business Platform).If you choose WhatsApp verification, the number you type and the code are sent to Meta's Cloud API to deliver a single message from our business number. Meta processes it under its own terms and privacy policy; we receive back a message id and a delivery status, nothing else.
• Amazon Web Services (Amazon SES, Mumbai region). If you choose email verification, the address you type and the code are sent to Amazon SES to deliver one email from verify@bestcredit.in. If you ask Bestie to email you an answer, that answer and your confirmed address go the same way. AWS processes both as our email provider, in India.
• Amazon Web Services (Amazon Bedrock) running Anthropic's Claude model. Your messages to Bestie, the assistant's previous answers in that conversation, the card data it looks up, and any statement file you attached are sent to Amazon Bedrock, which runs Anthropic's Claude model for us, to generate each answer. With them we send the profile answers you chose to give — the first name you gave, your city, your income band, whether you are employed or self-employed, and your credit-score band — because that is what makes the answer yours; along with the page of our site you opened the chat from, whether you verified by WhatsApp or email, and how many of your daily credits remain. We send no phone number, no email address, no IP address, no account identifier and never your full name. AWS is the processor and handles it under its service terms; Anthropic is the model's vendor and does not receive your conversation through Bedrock. Neither uses it to train models.
• Cloudflare Turnstile.See "Bestie" above.
• Card issuers and affiliate networks.When you click Apply, you leave BestCredit and land on the issuer's (or its affiliate network's) site. Their privacy policies govern what happens there — including any application you submit. We never see your application data. The Apply link passes only the card and the page you clicked from — never your name, email, account or verified identity.

We do not sell your personal data, and we do not share it with issuers or affiliate networks. The income band, the employment type and the credit-score band you give Bestie are never sent to a card issuer, an affiliate network or any third party except the model that writes the answers.

Where your data is processed

Google, Cloudflare, Meta and Amazon Web Services (for the Claude model on Amazon Bedrock) may process this data on servers outside India, as permitted under section 16 of the DPDP Act. Amazon SES processes verification emails, and any answer you ask us to email you, in the Mumbai region. We use no other processors.

Your rights (DPDP Act)

Under the DPDP Act you have the right to:

• Access — a copy of the personal data we hold about you. Signed in, you can download it yourself from your account; for Bestie, from inside the assistant ("Download my chat data"); otherwise write to us.
• Correction and completion — your name, email and picture come from Google and refresh every time you sign in, so correcting them there and signing in again updates them here. Every answer in your course profile is editable in place on your account, and everything you told Bestie about yourself is editable inside the assistant. For anything else, write to us.
• Erasure and withdrawal of consent — delete your account yourself at your account, or your chat data from inside the assistant, at any time, without asking us. Withdrawing consent is as easy as giving it.
• Grievance redressal — see the contact below.
• Nomination — you may nominate someone to exercise these rights on your behalf in the event of death or incapacity. Write to us to record a nomination.

Grievance Officer. If you are not satisfied with how we have handled your data, write to our Grievance Officer at contact@bestcredit.in, with the subject "Privacy request" or "Grievance"; we respond within 7 working days, and in every case within 30 days. If you are still not satisfied, you may complain to the Data Protection Board of India.

Children

BestCredit accounts and the assistant are for adults aged 18 or over — the minimum age to hold a credit card in your own name in India. Before you sign in, and again before we send a verification code, we ask you to confirm you are 18 or older, with an unticked box you have to tick yourself that the button will not work without, and we record that confirmation and the date. We deliberately do not collect dates of birth or ages — we need one fact, and a confirmation gives us exactly that and nothing more.

We do not knowingly process the personal data of anyone under 18, and — for every reader, of any age — we do not track behaviour across the web, build behavioural profiles or target advertising. Under section 9 of the DPDP Act, processing a child's personal data requires verifiable consent from a parent or guardian; we have no mechanism for that and therefore do not process children's data at all. If you believe someone under 18 has created an account or verified for the assistant, write to contact@bestcredit.in and we will delete it, without asking you to prove anything.

Changes

We will update this page when our practices change, with the "last updated" date above. Material changes will be highlighted on the site.

• 13 August 2026 — added optional Google sign-in, and described the account data it stores, the two sign-in cookies, retention, and the self-service deletion path.
• 14 August 2026— added the course sign-up profile: the three questions we ask before saving course progress to an account, what each is for, the required 18+ and terms tick on the sign-in screen and why we hold no date of birth, the separate newsletter consent, the new "what we never collect" list, and the fact that clearing your profile answers is available on its own without deleting your account. Added the field-by-field table above. The form also offers an optional mobile number, for fee-waiver and renewal reminders, with its own separate unticked consent: it is not required, it holds nothing back if you skip it, no reminder is sent, and it can be removed on its own at any time. An earlier draft of this form, the same day, made that number mandatory — that was wrong, and it was fixed before the form went live; no number was ever collected under it. Chapter prose stays free to read without any of it.
• 10 September 2026— added Ask BestCredit: one-time verification by WhatsApp or email (the first messages this site sends, and the only ones), storage as a one-way hash rather than a number or address, the 90-day conversation retention and the one-year identifier-free verification log, a fixed daily allowance, Cloudflare Turnstile, and Meta and Amazon Web Services (WhatsApp delivery, verification email, and Anthropic's Claude model on Amazon Bedrock) as processors. Corrected the earlier statement that no messaging service was connected to the site.
• 24 September 2026 — named the assistant Bestie and put it on the home page. Added the details it offers before your first question — a first name, your city, an income band, employed or self-employed, an optional credit-score band, and an email address with its own separate tick, which the form does need if you fill it in. You can skip the whole screen and Bestie still answers; none of the answers is verified, and none of them is shared. Added statement attachments: what is sent to the model, that we copy nothing out of the file, and that we delete it at the end of the Indian day. Added the button that emails you a copy of an answer, and the code that confirms your address before the first one goes out. Replaced the rupee-denominated daily allowance with a count of 15 free questions a day; the rupee ceilings remain as an internal safeguard and are no longer quoted here, because we move them as costs move. Added Cloudflare R2 as the store for attached files. Corrected the earlier promise that this site never asks what you earn, which the assistant's income band made false. Named our Grievance Officer and the route to the Data Protection Board of India.

See also: how we make money · terms of use · contact.