Privacy Policy
What we collect, why we need it, and what you can ask us to do with it.
This document is complete but has not yet been reviewed by a lawyer.
It describes accurately what CashBharo does with your data today, and we intend to follow it. It has not yet been through legal review, and the company registration it will name is still in progress. If anything here matters to you, please ask us at support@cashbharo.com before relying on it.
Effective from 18 September 2026
1. What we collect
The list below is what the service actually stores today:
| Data | Why we need it |
|---|---|
| Email address | To identify your account and send cashback and withdrawal updates |
| Password (stored only as a salted hash) | To sign you in. We never store the password itself |
| Name and mobile number | To identify you for payouts and support |
| UPI ID or bank account and IFSC | To pay your cashback. Used only for that purpose |
| PAN, where you provide it | Tax and identity requirements on larger payouts |
| Clicks: which store, when, your IP address and browser | To match a retailer's sale report back to your account. Without this, cashback cannot be credited |
| Purchases reported by retailers: order value, commission, status | To calculate and track your cashback |
| Claims you raise: order number, date, amount, your message | To investigate missing cashback with the retailer |
| Withdrawal records: amount, destination account, payment reference | To prove we paid you, and to meet accounting obligations |
| Your referral code, and who joined using it | To credit referral rewards. People you invite see only a partly masked version of your email, never the full address |
| Two-step verification secret and backup codes, if you turn it on | To verify your sign-in codes. Backup codes are stored only as hashes |
2. Who we share it with
We do not sell your personal data. We share the minimum necessary with:
- Cuelinks, our affiliate network - a random click identifier and nothing else. They report back which click resulted in a sale. They never receive your name, email address or payout details from us.
- The retailer you shop with - they see a visitor arriving from us, and the same anonymous click identifier. Whatever you then give the retailer directly, such as your delivery address or card, is between you and them under their own privacy policy.
- Payment providers - your payout details, when we send you money.
- Resend, our email provider - your email address, to deliver account and cashback notifications.
- MongoDB Atlas and Oracle Cloud - who store and host the data on our behalf.
- Cloudflare - which serves the site and sees the IP address of visitors as traffic passes through.
We do not sell your personal data, and we do not share it for advertising.
3. Your rights
Under India’s Digital Personal Data Protection Act, 2023 you can ask us to give you a copy of your data, correct it, or delete your account. Contact support@cashbharo.com (grievance officer: Kajal Gupta).
Note that we may need to keep certain financial records - such as cashback paid to you - even after account deletion, in order to meet tax and accounting obligations.
4. Cookies and tracking
We use only cookies that the service cannot work without: one to keep you signed in, and tracking identifiers so a retailer’s sale can be matched to your account. Blocking these will stop your cashback from tracking, which is the one thing you came here for.
We do not use advertising cookies and we do not run advertising trackers. Our visitor statistics come from Cloudflare Web Analytics, which counts page views without cookies and without building a profile of you - which is why this site has no cookie consent pop-up.
5. Security
Passwords are stored only as salted scrypt hashes, so nobody at CashBharo can read your password. Sessions use signed, httpOnly cookies that cannot be forged or read by scripts. Traffic is encrypted in transit. We never see or store your card details at any point - you enter those on the retailer’s own site.
Changing your payout details always requires your password again, even when you are already signed in, and we email you whenever those details change. Withdrawals to newly changed details are held briefly, so that an alert about a change you did not make reaches you while it still matters. You can add two-step verification at any time from your account.
No system is perfectly secure. If you believe your account has been accessed by someone else, change your password immediately and email us at support@cashbharo.com.
6. How long we keep it
| Data | Kept for |
|---|---|
| Your account details | Until you ask us to delete the account |
| Click records | 24 months, so a late-reported sale or a claim can still be matched |
| Cashback and withdrawal records | 8 years after the financial year they relate to, as Indian tax and company law requires. These are kept even after account deletion |
| Support and claim correspondence | 3 years after the claim is closed |
| Sign-in and security records | 12 months |
When you delete your account we remove your payout details and contact information. We cannot delete the financial record that cashback was paid to you, because we are required to keep it.
7. Where your data is processed
CashBharo is operated from India and intended for people in India. Some of the providers listed in section 2 - notably our email provider and our content delivery network - process data on servers outside India. We use them because they are the standard tools for this job, and we share only the minimum each one needs: an email address to deliver an email, an IP address to serve a page.
The Digital Personal Data Protection Act, 2023 permits transfers outside India except to countries the Central Government restricts. We do not transfer personal data to any country on that list.
8. Consent, and taking it back
You give consent by creating an account and by choosing to click through to a retailer. We ask for each piece of information at the point it is needed rather than up front: you can browse without an account, you only give payout details when you want to be paid, and PAN only if a withdrawal is large enough to require it.
You can withdraw consent at any time by deleting your account. Doing so means we can no longer track or pay cashback on purchases you have already made, since there would be no account to credit. Email support@cashbharo.com to request deletion, a copy of your data, or a correction.
9. If something goes wrong
If a data breach affects your personal data, we will notify you and the Data Protection Board of India as the DPDP Act requires, and tell you what happened, what data was involved and what we are doing about it.
If you are unhappy with how we have handled your data, contact our grievance officer first at support@cashbharo.com (Kajal Gupta). If we do not resolve it, you may complain to the Data Protection Board of India.
10. Children
CashBharo is not for anyone under 18. We do not knowingly create accounts for children, and we do not knowingly collect their data. Withdrawals require a bank account or UPI ID in the account holder’s own name, which is a practical barrier as well as a stated rule. If you believe a child has created an account, tell us and we will remove it.
11. Contact
Privacy questions or requests: support@cashbharo.com. See also our Terms of Use.
Grievance Officer
We acknowledge complaints within 2 days and aim to resolve them within 30 days.