Privacy Policy

GCDEAL · CUSTOMER POLICIES

How GCDeal handles your account, card and verification information.

Updated 10 October 2026

Responsible business

GCDeal is operated by Abhishek Shivkumar Saroj. Contact address: Sion, Mumbai, Maharashtra 400022, India. Privacy requests: support@gcdeal.in; WhatsApp +91 9076717207.

Data we collect

Name, email, phone, password hash and optional profile photo; submitted card brand, value, code, PIN and supporting information; beneficiary, bank or UPI details; purchases, offers, acceptance, status and payment references; support correspondence; masked Aadhaar or PAN images when KYC is submitted. Technical records may include IP addresses, session cookies and server security logs.

How we use it

We use information to secure accounts, activate email, review cards, prevent misuse, verify beneficiaries, fulfil purchases, record payouts, handle complaints and send essential transaction/security emails. We do not sell personal information or use KYC documents as marketing material. Optional marketing requires a separate choice.

Sensitive data protection

The site uses encrypted storage for gift card secrets, payout details and KYC documents. KYC images are accessed through administrator-controlled review routes rather than public media links. Passwords are stored as hashes. Authorised access is limited to the relevant task; absolute security cannot be guaranteed.

KYC image retention

KYC images are removed from the active verification record when a review decision is saved. A daily scheduled cleanup removes unresolved uploads after 30 days and requests resubmission; its execution depends on WordPress scheduled-task processing. Minimal review status and reason remain. Active-site deletion does not immediately erase earlier provider backups.

Other retention

Account details remain while the account is active. Transaction, offer, payout and complaint records remain while needed for fulfilment, disputes, fraud review or applicable accounting/legal obligations. These records currently have no fixed automatic deletion schedule. Ask support for manual deletion review; any necessary retention and reason will be explained. Security tokens expire according to their configured validity.

Service providers

WordPress and WooCommerce support the site software. Hosting/backup and email-delivery providers may process site data and messages. When used, the enabled payment provider processes checkout payments; banks/UPI services process payouts. WhatsApp processes messages you choose to send. Provider identities/configurations can be requested from support; this policy does not claim an unverified gateway or service. Sharing is limited to the task, lawful requests and dispute handling.

Cookies and your choices

Essential cookies support login, cart, checkout and security. Blocking them may prevent those features. Request access, correction, deletion or withdrawal of optional consent through support. We verify ownership proportionately and explain records that must remain. Never send your password, full card code or unmasked Aadhaar in general correspondence.

Backups and incidents

Provider backups and logs may retain earlier copies until their retention cycles expire. Backup erasure is not promised to be immediate; restored data may require deletion to be reapplied. We assess relevant security incidents and communicate as required by applicable law.