Privacy Policy
What we collect, why we need it, and what you can ask us to do with it.
Effective from 15 October 2026
1. What we collect
The list below is what the service actually stores today:
| Data | Why we need it |
|---|---|
| Email address | To identify your account and send cashback and withdrawal updates |
| Password (stored only as a salted hash) | To sign you in. We never store the password itself |
| If you sign in with Google: the identifier Google gives your Google account, and the name and email address it shares with us | To sign you in with Google instead of a password, and to link that Google account to your CashBharo account |
| Name and mobile number | To identify you for payouts and support |
| UPI ID or bank account and IFSC | To pay your cashback. Used only for that purpose |
| PAN, if you choose to add it on the payout page | Not needed to use CashBharo or to be paid today. If the law comes to require it for a payout, we will ask for it and say why |
| Clicks: which store, when, your IP address, browser and the page you came from, and the words you asked a store to search for when you use a "Search on" button | To match a retailer's sale report back to your account, and to spot misuse. Without this, cashback cannot be credited |
| Purchases reported by retailers: order value, commission, status | To calculate and track your cashback |
| Claims you raise: order number, date, amount, your message | To investigate missing cashback with the retailer |
| Withdrawal records: amount, destination account, payment reference | To prove we paid you, and to meet accounting obligations |
| Your referral code, and who joined using it | To credit referral rewards. People you invite see only a partly masked version of your email, never the full address |
| Two-step verification secret and backup codes, if you turn it on | To verify your sign-in codes. Backup codes are stored only as hashes |
| When you last signed in, or last earned, withdrew or were credited cashback | To tell whether an account is inactive, and to warn you before the inactive-account rule in our Cashback Terms applies |
2. Who we share it with
We do not sell your personal data. We share the minimum necessary with:
- Our affiliate networks, Cuelinks, Admitad and INRDeals- when you click through to a store that pays cashback, a random click identifier, and, when you use a "Search on" button from our search page, the store’s search page to open, which carries the words you searched for. They report back which click resulted in a sale. They never receive your name, email address or payout details from us. For a store that does not pay cashback, we send no identifier at all: the link is the store’s own affiliate link, unchanged.
- Amazon, through the Amazon Associates programme - links to Amazon.in carry our Associates tag, which tells Amazon the visit came from CashBharo, and nothing about you. Amazon tells us which items were bought through our links, but not who bought them.
- The retailer you shop with- they see a visitor arriving from us, and for a cashback store the same random click identifier. When you use a "Search on" button, the retailer’s own search receives the words you searched for, as if you had typed them there. Whatever you then give the retailer directly, such as your delivery address or card, is between you and them under their own privacy policy.
- The bank or payment service we pay you through - your UPI ID or bank details, when we send you money.
- Google- only if you choose “Continue with Google”. Google tells us your name, email address and an identifier for your Google account, and learns that you signed in to CashBharo. We send Google nothing else about you. Google’s own privacy policy covers your Google account.
- Resend, our email provider - your email address, to deliver account and cashback notifications.
- Anthropic, which makes the Claude AI model - when a search on CashBharo finds no shop, we may send the words searched for to Claude, to work out which of our own search words they mean. Only the words are sent: nothing about who searched, such as an account, email address, IP address or cookie, and never a search that looks like an email address, a link or a phone number. The answer is saved with the words, so the same search is not sent again.
- MongoDB Atlas and Oracle Cloud - who store and host the data on our behalf.
- Cloudflare- which runs the domain name service for cashbharo.com, and may carry the site’s traffic, seeing visitors’ IP addresses as it passes through.
We do not sell your personal data, and we do not share it for advertising.
3. Your rights
Under India’s Digital Personal Data Protection Act, 2023 you can ask us to give you a copy of your data, correct it, or delete your account. You can also nominate someone to exercise these rights for you if you die or become unable to. To use any of them, email support@cashbharo.com (grievance officer: Kajal Gupta)from your account’s email address, so we know the request is yours.
We keep certain financial records - such as cashback credited and paid to you - even after account deletion, because tax and accounting law requires it. Section 6 says what is kept.
4. Cookies and tracking
The only cookie CashBharo keeps for shoppers is the one that keeps you signed in, for up to 30 days. If you sign in with Google, we also set a second cookie for at most ten minutes while you are at Google, to check that the sign-in coming back is the one you started; it is deleted as soon as you return. We set no advertising cookies and run no advertising trackers.
When you click through to a store, the store, its affiliate network or Amazon sets its own cookies on its own site, to record that the visit came from us. That is how a purchase is credited, so blocking those cookies can stop your cashback from tracking. They are theirs, under their own privacy policies.
Third parties, including Amazon and the stores and networks we link to, may serve content and offers, collect information directly from you, and place or recognise cookies on your browser. CashBharo itself loads no advertising scripts, so this happens once you follow a link to their sites.
We do not run any visitor statistics or analytics scripts. That is why this site has no cookie consent pop-up.
If you install the CashBharo browser extension, it downloads our public list of partner stores from this site, without cookies, and keeps it on your device. Your browser compares the site you are on against that list itself, to light up the extension's icon; the extension is not told which sites you visit. It reads the address of a tab only when you click its icon on that tab, to find the store. It sends us nothing about your browsing. We learn of a visit only if you press "Activate cashback", which opens our click-through page exactly as clicking a store on this site does, and is recorded the same way (section 1). Removing the extension removes the list. Google distributes the extension through the Chrome Web Store, under its own privacy policy.
5. Security
Passwords are stored only as salted scrypt hashes, so nobody at CashBharo can read your password. Sessions use signed, httpOnly cookies that cannot be forged or read by scripts. Traffic is encrypted in transit. We never see or store your card details at any point - you enter those on the retailer’s own site.
Changing your payout details always requires your password again, even when you are already signed in, and we email you whenever those details change. Withdrawals to newly changed details are held briefly, so that an alert about a change you did not make reaches you while it still matters. You can add two-step verification at any time from your account.
No system is perfectly secure. If you believe your account has been accessed by someone else, change your password immediately and email us at support@cashbharo.com.
6. How long we keep it
CashBharo keeps records of clicks, transactions, cashback calculations, payout requests and affiliate network reports for the periods in the table below, which are what we consider reasonably necessary to operate the service, investigate disputes, meet legal obligations and protect against fraud.
| Data | Kept for |
|---|---|
| Your account details | Until you ask us to delete the account |
| Click records | 24 months, so a late-reported sale or a claim can still be matched. A click that led to cashback stays with that cashback's record, without your IP address and browser details |
| Cashback and withdrawal records | At least 8 years after the financial year they relate to, as Indian tax and company law requires. These are kept even after account deletion |
| Affiliate network reports and cashback calculations | At least 8 years after the financial year they relate to, as for other financial records. These are kept even after account deletion |
| Missing-cashback claims and support emails | 3 years after the claim or conversation is closed. For an approved claim, the amount credited stays with the cashback records |
| Links we email you to verify your address or reset your password | Deleted automatically when they expire, within 24 hours |
| Searches we asked Claude to read, and its answers | Kept, with nothing about who searched, so the same search is answered at once next time |
When we delete your account at your request, we remove your name, email address, mobile number, PAN, payout details and password, and the link to your Google account if you used one, delete clicks that led to nothing and the device details on the rest, and delete claims that credited nothing. We cannot delete the financial record of cashback credited and paid to you, because we are required to keep it.
7. Where your data is processed
CashBharo is operated from India and intended for people in India. Some of the providers listed in section 2 - notably our email provider, Cloudflare, Anthropic and, if you sign in with it, Google - process data on servers outside India. We use them because they are the standard tools for this job, and we share only the minimum each one needs: an email address to deliver an email, an IP address to route a visit, the words of a search, with nothing about who searched, to read it.
The Digital Personal Data Protection Act, 2023 permits transfers outside India except to countries the Central Government restricts. We do not transfer personal data to any country on that list.
8. Consent, and taking it back
You give consent by creating an account and by choosing to click through to a retailer. We ask for each piece of information at the point it is needed rather than up front: you can browse without an account, you only give payout details when you want to be paid, and PAN only if you choose to, or if the law comes to require it for a payout.
You can withdraw consent at any time by deleting your account. Doing so means we can no longer track or pay cashback on purchases you have already made, since there would be no account to credit. Email support@cashbharo.com to request deletion, a copy of your data, a correction, or to nominate someone to act for you.
9. If something goes wrong
If a data breach affects your personal data, we will notify you and the Data Protection Board of India as the DPDP Act requires, and tell you what happened, what data was involved and what we are doing about it.
If you are unhappy with how we have handled your data, contact our grievance officer first at support@cashbharo.com (Kajal Gupta). If we do not resolve it, you may complain to the Data Protection Board of India.
10. Children
CashBharo is not for anyone under 18. We do not knowingly create accounts for children, and we do not knowingly collect their data. Withdrawals require a bank account or UPI ID in the account holder’s own name, which is a practical barrier as well as a stated rule. If you believe a child has created an account, tell us and we will remove it.
11. Contact
Privacy questions or requests: support@cashbharo.com. See also our Terms of Use.
Grievance Officer
We acknowledge complaints within 2 days and aim to resolve them within 30 days.