Data Protection Policy — BestDigitalCard

Our Commitment

BestDigitalCard is committed to protecting your personal data in compliance with applicable Indian data protection laws, including the Digital Personal Data Protection Act, 2023 (DPDP Act) and Information Technology Act, 2000.

Security Measures

We implement the following technical and organizational measures:

Measure	Details
Password Encryption	All passwords are hashed using bcrypt (one-way, irreversible)
Session Security	HTTP-only cookies, SameSite=Lax, secure flag on HTTPS, 2-hour expiry
CSRF Protection	Token-based cross-site request forgery prevention on all forms
Input Sanitization	All user input is sanitized to prevent SQL injection and XSS attacks
File Upload Security	Extension whitelist, MIME validation, magic byte verification, double-extension blocking
Rate Limiting	IP-based rate limiting on all public endpoints to prevent abuse
Payment Security	No card/bank data stored — handled entirely by PCI-DSS compliant Razorpay
IP Anonymization	Visitor IPs are stored as one-way SHA-256 hashes, not raw IPs
Data Cleanup	Analytics logs automatically purged after 90 days

Data Storage & Location

All data is stored on servers located in India
We do not transfer your personal data outside of India
Database backups are encrypted and stored securely

Third-Party Services

Service	Purpose	Data Shared
Razorpay	Payment processing	Name, email, payment amount
SMTP (Email)	Transactional emails	Recipient email, name
Google Places API	Review card Place ID	Business place ID only

We do not share data with advertising networks, social media platforms, or data analytics companies.

Data Deletion

When you delete a card, all associated data is permanently removed:

Card content, contact info, gallery images, services, menu items
View logs, button click analytics
Lead submissions, reviews, appointments
Uploaded files are deleted from the server filesystem

Account deletion removes all cards and personal data. This action is irreversible.

Data Breach Protocol

In the event of a data breach, we will:

Investigate and contain the breach within 24 hours
Notify affected users via email within 72 hours
Report to relevant authorities as required by law
Take corrective measures to prevent recurrence