Privacy Policy

1. Information we collect

Account information. When you sign up, we collect your name, email address, mobile number (optional), and password (stored hashed with bcrypt — never in plain text).

Order information. Vouchers purchased, vouchers issued, redemptions, refunds, wallet transactions, coupons used.

Payment information. We never see or store your card number, CVV, or UPI PIN. Payments are handled by Razorpay and ICICI eazypay, both PCI-DSS Level 1 compliant.

Device & usage information. IP address, browser type, referring URL, pages visited, and approximate location (city-level) for fraud prevention and analytics.

Cookies. We use only essential session cookies and a single first-party analytics cookie. No third-party advertising trackers.

2. How we use your information

• To issue vouchers and process payments.
• To send order confirmations, vouchers, and receipts via email.
• To prevent fraud, money laundering, and unauthorised account access.
• To improve our product and customer experience.
• To comply with applicable tax and regulatory obligations.
• To send marketing communications only if you've opted in.

3. What we don't do

• We never sell your personal data to third parties.
• We never share your data with advertisers or data brokers.
• We never spam you — marketing emails are opt-in and one-click unsubscribe.

4. Payment data

All payment processing is handled by Razorpay Software Private Limited and ICICI Bank Limited. Bilzoo receives only a transaction reference and the last 4 digits of your card (for display). Full payment data is encrypted in transit and at rest by our payment partners and is subject to their privacy policies.

5. Cookies

We use the following cookies:

• bilzoo_session — essential, identifies your login session. Expires when you close your browser.
• XSRF-TOKEN — essential, prevents cross-site request forgery. Expires in 2 hours.
• bz_analytics — optional first-party analytics, helps us understand which features are used. You can opt out by clearing it.

We do not use third-party advertising cookies, Facebook pixels, or Google Analytics with advertising enabled.

6. Data sharing

We share your data only with:

• Voucher providers (Pine Labs, manual fulfilment team) — to issue your voucher code. They receive only your email and the voucher amount.
• Payment processors (Razorpay, ICICI) — to process payment. They receive your payment details directly.
• Email service (Postmark / SES) — to deliver transactional emails. They receive your email address and email content.
• Law enforcement — only when required by a valid court order or to prevent imminent harm.

7. Data retention

We retain your account data for as long as your account is active, plus 7 years for tax and regulatory compliance. Wallet transaction history is retained indefinitely in anonymised form for fraud analytics. You may request deletion of your account and personal data at any time by writing to privacy@bilzoo.in.

8. Your rights

You have the right to:

• Access — request a copy of all personal data we hold about you.
• Rectification — correct inaccurate data.
• Erasure — request deletion of your account and data (subject to retention obligations).
• Restriction — limit how we process your data.
• Portability — receive your data in a machine-readable format.
• Objection — object to processing for direct marketing.

To exercise any of these rights, write to privacy@bilzoo.in. We respond within 30 days.

9. Children's privacy

Bilzoo is not intended for users under 18. We do not knowingly collect data from minors. If you believe a minor has created an account, write to privacy@bilzoo.in and we will delete the account.

10. International transfers

Your data is primarily stored in India (AWS Mumbai region). Some service providers (e.g. our email provider) may process data outside India. In all cases, we ensure adequate data-protection safeguards are in place.

11. Security

We take security seriously:

• All data is encrypted in transit (TLS 1.2+) and at rest (AES-256).
• Passwords are hashed with bcrypt (cost factor 12).
• Two-factor authentication is available for staff and admin accounts.
• We conduct annual third-party security audits and penetration tests.
• Access to production data is restricted to a small number of engineers with audit logging enabled.

12. Changes to this policy

We may update this policy from time to time. Material changes will be notified by email and/or in-app banner at least 14 days before they take effect.

13. Grievance officer

In accordance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021:

Grievance Officer
Bilzoo Technologies Pvt. Ltd.
3rd Floor, Indiranagar, Bengaluru 560038
Email: grievance@bilzoo.in
Phone: +91 80-4567-8900

14. Contact

For any privacy-related questions, write to privacy@bilzoo.in. We respond within 30 days, usually faster.