Privacy Policy

Account details: name, email or phone number, a hashed (never plaintext) password, and an optional profile picture. Businesses also provide a company name, a logo, a business location, and a verification photo used to approve their account.

Profile details (optional, collected progressively): age range, gender, and city, which you can choose to add on your profile. We never ask for these at signup.

Device and location signals: a device fingerprint and your IP address, captured when you sign up, submit a contest entry, or withdraw money. If a contest, survey, or offer is restricted to a physical location (geofenced), we also capture your device's precise location at the moment you submit or claim, only for that listing.

Contest and offer activity: your answers, scores, winnings, saved items, and claimed coupons for every listing you take part in.

Payout and verification details: the UPI ID you provide to withdraw your wallet balance, and - where required by tax or anti-money-laundering law before releasing a payout - additional identity/tax details such as a PAN card.

If a photo you submit as a contest answer includes another identifiable person, that image is personal data about them too - you're responsible for having their permission before you submit it (see our Terms of Service).

• To run contests, surveys, and offers: score your answers, determine winners, verify offer claims, and credit prizes or coupons to your account.
• To verify businesses before they can post a contest, survey, or offer, using the submitted images and location.
• To detect fraud and abuse: device fingerprints and IP addresses help us flag (not automatically block) duplicate accounts, colluding submissions to the same listing, and reused withdrawal details across accounts.
• To process withdrawals to your UPI ID, and to meet our tax-withholding and record-keeping obligations under Indian law.
• To understand how BrandMap is used and improve it: which pages and buttons get used, how long a visit lasts, and the search terms and locations you commit to while browsing - tracked in aggregate for product analytics, and, if you're signed in, attached to your account so we can distinguish players, businesses, and guests.
• To communicate with you (OTP codes, password reset links, account notices).

Under India's Digital Personal Data Protection Act, 2023 (DPDP Act), we process your personal data based on your consent (given by creating an account and using BrandMap), and, where applicable, to comply with our legal obligations (like tax withholding and record-keeping). You can withdraw consent by closing your account, though this doesn't affect processing already carried out, or records we must legally retain.

BrandMap is not intended for anyone under 18. We don't knowingly collect personal data from minors, and accounts are restricted to users who confirm they're 18 or older at signup. If we learn an account belongs to someone under 18, we'll close it.

A business you play a contest for, respond to a survey for, or claim an offer from can see your name and your answers/score/claim for that listing. Our admin team can see moderation, verification, and fraud-review data as part of running the platform. We do not sell your data.

We use third-party services to operate BrandMap: a payment processor for UPI payouts and collections, an SMS provider for phone OTP codes, an email provider for account notices and password resets, an object storage service for the images and files you upload, an AI content-moderation service to screen contest and offer content, and cloud hosting/ infrastructure providers. Each only receives the data it needs to do its job. Some of these providers may process or store data on servers located outside India; where that happens, we rely on the DPDP Act's provisions for transferring personal data outside India (which currently permits transfers except to countries the government restricts).

We keep our own product-analytics record of how BrandMap is used - page views, button clicks, session length, and the search terms and locations you commit to while browsing - to understand engagement and find problems. This is first-party analytics we run ourselves, not third-party advertising cookies, and it's never sold or shared for advertising. We use your browser's local storage (not tracking cookies) to keep you signed in and remember lightweight app preferences.

We keep your account and transaction history so long as your account is active, and for longer where Indian law requires it - for example, tax law generally requires financial records to be kept for several years, and anti-money-laundering rules require payout/ verification records to be kept for a set period after an account closes. If you request account deletion, we mark your account as deleted and stop showing your data going forward; full removal of historical records is only performed once any such legal retention period has passed, or in specific compliance-mandated cases, since removing records early can break financial audit trails or violate retention law. In particular, a soft-deleted account's financial and transaction records are retained even though the account itself is anonymised.

• Passwords are hashed, never stored in plain text.
• Sensitive admin-configured credentials (like email provider settings) are encrypted before storage.
• Rate limiting is applied to sign-up, login, contest submission, and withdrawal endpoints.
• Withdrawals below the minimum threshold, or that reuse a UPI ID/device already tied to another account, are held for manual review before any money moves.
• If a personal data breach occurs that's likely to affect you, we'll notify the Data Protection Board of India and you, as required under the DPDP Act, and tell you what happened and what we're doing about it.

You can update your profile at any time. Under the DPDP Act, you have the right to access a summary of the personal data we hold about you, request correction of inaccurate data, and request erasure - subject to the legal retention needs described above. Location is only requested when you're about to enter or claim a listing that requires it - you can decline, but you won't be able to enter or claim that specific listing. To exercise any of these rights, contact us using the details below; we aim to acknowledge a request within 24 hours and resolve it within 15 days, the same timelines described on our Grievance Redressal page. If you're unsatisfied with our response, you can escalate to the Data Protection Board of India.

Questions about this policy, or requests about your data, can be sent to privacy@brandmap.local. For a formal grievance, see our Grievance Redressal page.