Privacy policy

BestCredit ("we") is an Indian credit-card information and comparison website at bestcredit.in. We collect as little personal data as we can. This policy explains what we do collect, why, and the rights you have under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). For the account data described below, we are the Data Fiduciary.

You can read all of BestCredit without an account. Every card page, guide, comparison, calculator and chapter of Credit Cards 101 is open to read, signed in or not, and we do not put any of it behind a form. Signing in does one thing: it saves your course progress to an account so it follows you between devices. To turn that on we ask you to fill in a short course-setup form once — three tap-only questions, plus an optional mobile number you are free to leave blank. If you would rather not, the entire course stays readable; you simply keep your place in your own browser instead of on our server.

What we collect

• Your BestCredit account (optional, Google sign-in only). If — and only if — you choose to sign in, we store: your Google account identifier, your email address, your display name, your profile-picture URL, the times you created the account and last signed in, and which chapters and modules of Credit Cards 101 you have marked complete. The purpose is to keep you signed in and remember your progress; the legal basis is your consent, given by choosing to sign in, and you can withdraw it at any time by deleting your account. We do not use this data for advertising, we do not profile you, and we do not sell or share it.
• Your course profile. To start Credit Cards 101 on your account we ask three things, once, on a single screen: roughly what you put on a card each month (as a band, never an exact figure), which up-to-three categories most of it goes to, and what you want out of the course. We use them for two things and nothing else — suggesting where to start in the course, and prefilling the rewards calculator with your numbers instead of ours. The legal basis is your consent, given on that screen under this notice, and you can change or clear every answer at any time from your account. We never ask what you earn, we never verify these answers against anything, we do not use them for advertising, we do not build a behavioural profile of you, and we do not share them with card issuers or affiliate networks.
• Your mobile number — optional. The same form offers a field for an Indian mobile number. It is optional in the ordinary sense of the word: leaving it blank completes the form, saves your course progress and changes nothing about the site. We ask for it for one stated purpose — reminders about annual-fee waivers and card renewals — and for nothing else. We do not send SMS today. No messaging service is connected to this site, nothing verifies the number, and nothing sends to it; if you give it, you are giving it for a feature we have not built yet, and we would rather say so than imply a text is coming. It is never displayed on any public page, never given to a card issuer or affiliate network, never used for advertising, and never attached to an Apply click. You can remove it on its own — without clearing anything else — from your account, using "Remove my number"; we NULL it immediately and record the dated withdrawal.
• Your 18+ confirmation and the terms you accepted. Before you sign in you tick one box — unticked to start, and you have to tick it yourself — confirming you are 18 or over and accepting our terms of use and this policy. We store two dated records of that, with the version of this page in force at the time, and nothing more: no date of birth and no age.
• What you type in the tools.The recommendation wizard, the EMI calculator and the interactive figures run entirely in your browser — those inputs are never sent to or stored on our servers, and moving a slider sends us nothing. Two things are saved to your account when you are signed in, and only those two: which chapters and modules you have marked complete, and the course profile above. Where we use that profile to set the calculator's starting numbers, you can change them on the spot, and your changes are still not sent back to us.
• Aggregate usage analytics. We use privacy-preserving, cookieless analytics (aggregate page views, country, referrer, device class). This does not identify you and is not used for advertising profiles.
• Outbound click logs.When you click an Apply button, we record that a click happened for a given card and page surface (e.g. "comparison table"), with the referring page. These logs carry no identifier and are never linked to your account, whether or not you are signed in.
• Emails you send us. If you contact us, we keep the correspondence to respond and improve the site.

Every field in your course profile

This is the whole of it — field by field, what each is for, the lawful basis, whether it is required, and how long we keep it.

We ask for separate consent for each purpose.Signing in, saving your course progress, keeping a course profile, giving us a mobile number for reminders, and receiving our email digest are five different things with five different consents. We never bundle them into a single "I agree", we never pre-tick a box, and you can withdraw any one of them without losing the others — clearing your profile answers leaves your account and your progress intact, removing your mobile number leaves everything else untouched, and unsubscribing from the digest changes nothing about your account.

What we never collect

BestCredit is a comparison and education site — not a bank, a lender, a loan agent or a credit bureau. We will never ask you for your PAN, your Aadhaar number, your date of birth or age, your bank account or IFSC, your card number, expiry or CVV, your credit score or credit report, your salary, salary slips or income, your employer, your existing loans or EMIs, or your home address. We have no use for any of it and no lawful basis to hold it. We do not pull, hold or process credit-bureau information about anyone, and we do not track your behaviour across the web or build behavioural profiles.

If any page, email, call or message asks you for these in our name, it is not us — please report it to contact@bestcredit.in.

We hold exactly two contact details, and only these two: the email address Google gives us when you sign in, and — only if you typed it in yourself on the course-setup form — an optional mobile number. There is nowhere else on this site that asks for a phone number. We do not cold-call, and we send no SMS at all today: no messaging service is connected to the site. If we ever connect one, we will say so on this page before the first message goes out. A call or text claiming to be BestCredit is not us — an unsolicited one especially, and any call asking for an OTP, a card number or a CVV certainly.

Signing in with Google

We use Google only to verify who you are. When you sign in, Google tells us your Google account identifier, email address, name and profile-picture URL — nothing else. We request exactly three basic permissions (openid, email, profile) and no permission to read your Gmail, Drive, contacts, calendar or anything else. We never see or receive your Google password. We never post anything to your Google account. We ask for no long-lived access: the token from Google is used once, at sign-in, to confirm your identity, and is discarded immediately — we do not store it.

Google's own handling of your data is covered by the Google Privacy Policy. You can remove BestCredit's access at any time at myaccount.google.com/permissions.

Cookies

We set no advertising cookies and no cross-site tracking cookies. We set exactly two first-party cookies, both strictly necessary for signing in, both HttpOnly and Secure (they cannot be read by JavaScript), and neither is set unless you choose to sign in:

Because both are first-party and strictly necessary, no cookie-consent banner is required. The consent that matters is the box you tick on the sign-in screen before the Google button will work, where this is stated before you click. Signing out deletes the session on our server immediately.

How long we keep it

• Sign-in sessions: at most 30 days, then they expire and are purged automatically. Signing out ends them at once.
• Account data, course progress and your course profile: until you delete your account, or — for the profile answers on their own — until you clear them from your account, which erases them immediately: the answers, your mobile number if you gave one, and the dated record of when you gave them. The number can also be removed on its own, leaving everything else in place, with "Remove my number" on the same page. We keep a dated record of each consent, including your 18+ confirmation and your acceptance of the terms; clearing your answers keeps those (so we do not lose the record that you told us you were an adult) and erases everything else in the profile, and unsubscribes you from the digest if you were on it. Deleting the account erases all of it. We do not currently delete dormant accounts automatically; if we introduce that, we will say so here and warn you by email first.
• Email correspondence: as long as needed to handle the matter and to keep a record of it.

Deleting your account

Go to your accountand choose "Delete my account". You will be asked to confirm by typing DELETE. This is immediate and permanent: your account record (Google identifier, email, name, profile-picture URL, timestamps), your course profile (spend band, spend areas, goal, and your mobile number if you gave one), the dated record of when you gave those answers and your consents including the 18+ confirmation, all your course progress and all your sign-in sessions are erased from our database. It is a real deletion, not a hidden flag on a row we keep. You are signed out of every device at the same time.

Two things it does not do, because they are separate consents. It does not unsubscribe you from our newsletter — use the unsubscribe link in any newsletter email for that. And it does not change anything at Google; if you also want to remove BestCredit there, use myaccount.google.com/permissions. You may create a new account later by signing in again; it starts empty.

Third parties

• Google (identity provider). Google verifies your identity when you choose to sign in, as described above. We use no Google advertising or analytics products.
• Cloudflare (hosting and database). The site runs on Cloudflare Workers, and account data and course progress are stored in Cloudflare D1, its managed database. Cloudflare also processes requests (IP addresses, headers) as our infrastructure provider to deliver and secure the site.
• Brevo (newsletter). If you subscribe to our email digest — from the footer form, or by ticking the unticked box on the course-setup screen — your email address is stored with Brevo, our email provider. That is a separate opt-in from your account, and only your email address goes to Brevo: never your course profile. Untick the box, clear your profile, or use the unsubscribe link in any email, and we delete your address from Brevo — withdrawing is as easy as giving.
• Card issuers and affiliate networks.When you click Apply, you leave BestCredit and land on the issuer's (or its affiliate network's) site. Their privacy policies govern what happens there — including any application you submit. We never see your application data. The Apply link passes only the card and the page you clicked from — never your name, email or account.

We do not sell your personal data, and we do not share it with issuers or affiliate networks.

Where your data is processed

Google and Cloudflare may process this data on servers outside India, as permitted under section 16 of the DPDP Act. We use no other processors for account data.

Your rights (DPDP Act)

Under the DPDP Act you have the right to:

• Access — a copy of the personal data we hold about you. Signed in, you can download it yourself from your account; otherwise write to us.
• Correction and completion — your name, email and picture come from Google and refresh every time you sign in, so correcting them there and signing in again updates them here. Every answer in your course profile is editable in place on your account. For anything else, write to us.
• Erasure and withdrawal of consent — delete your account yourself at your account, at any time, without asking us. Withdrawing consent is as easy as giving it.
• Grievance redressal — see the contact below.
• Nomination — you may nominate someone to exercise these rights on your behalf in the event of death or incapacity. Write to us to record a nomination.

Grievance Officer. Write to contact@bestcredit.inwith the subject "Privacy request" or "Grievance", marked for the attention of the Grievance Officer, BestCredit. We respond within 7 working days. If you are unsatisfied with our response, you may complain to the Data Protection Board of India.

Children

BestCredit accounts are for adults aged 18 or over — the minimum age to hold a credit card in your own name in India. Before you sign in we ask you to confirm you are 18 or older, with an unticked box you have to tick yourself that the Google button will not work without, and we record that confirmation and the date. We deliberately do not collect dates of birth or ages — we need one fact, and a confirmation gives us exactly that and nothing more.

We do not knowingly process the personal data of anyone under 18, and — for every reader, of any age — we do not track behaviour across the web, build behavioural profiles or target advertising. Under section 9 of the DPDP Act, processing a child's personal data requires verifiable consent from a parent or guardian; we have no mechanism for that and therefore do not process children's data at all. If you believe someone under 18 has created an account, write to contact@bestcredit.in and we will delete it, without asking you to prove anything.

Changes

We will update this page when our practices change, with the "last updated" date above. Material changes will be highlighted on the site.

• 13 August 2026 — added optional Google sign-in, and described the account data it stores, the two sign-in cookies, retention, and the self-service deletion path.
• 14 August 2026— added the course sign-up profile: the three questions we ask before saving course progress to an account, what each is for, the required 18+ and terms tick on the sign-in screen and why we hold no date of birth, the separate newsletter consent, the new "what we never collect" list, and the fact that clearing your profile answers is available on its own without deleting your account. Added the field-by-field table above. The form also offers an optional mobile number, for fee-waiver and renewal reminders, with its own separate unticked consent: it is not required, it holds nothing back if you skip it, no SMS is sent today because no messaging service is connected, and it can be removed on its own at any time. An earlier draft of this form, the same day, made that number mandatory — that was wrong, and it was fixed before the form went live; no number was ever collected under it. Chapter prose stays free to read without any of it.

See also: how we make money · terms of use · contact.