Delete and Retain Personal Information

2.1 Account and Profile Data:

Purpose: To maintain your user account, provide continuous service, facilitate account recovery, and meet legal record-keeping norms.

Data Types: Includes your mobile phone number, email address, emergency contacts, and User/Device IDs.

Retention Period: This data is retained for the duration your account is active and for a subsequent period of three (3) years following account termination.

2.2 Financial Transaction Data:

Purpose: To comply with financial regulations in India, provide you with accurate historical transaction records, and support traceability for any potential dispute resolution.

Data Types: Records of credit card expenses, repayments, and credit limit information.

Retention Period: This data is retained for five (5) years from the date each transaction occurs.

2.3 Operational & Diagnostic Data:

Purpose: To enhance application performance, diagnose technical issues, analyze usage patterns to improve user experience, and ensure security.

Data Types: Includes crash logs and installed application lists (for security/compatibility checks).

Retention Period: This data, being non-personal or pseudonymized, is retained for a maximum of two (2) years from the date of collection.

2.4 Security of Retained Data:

Throughout its retention lifecycle, all personal data is safeguarded using robust security measures, including AES-256 encryption and strict access controls, to prevent unauthorized access or disclosure.

3.1 Requesting Deletion (User-Initiated):

You can exercise your right to erasure by submitting a formal deletion request to our Grievance Officer at business@billmatecredit.com. Please include your registered mobile number or User ID for verification.

Upon receiving a valid request, we will process it within 15 working days. We will securely erase your personal data from our active systems, unless we are bound by a legal or regulatory obligation to retain it for a longer period (e.g., ongoing financial transaction records). A confirmation of deletion will be sent to you via email.

3.2 Automated Deletion for Inactive Accounts:

To ensure data minimization, accounts that have been continuously inactive for eighteen (18) months (meaning no logins or service interactions) will be flagged for deletion.

We will send a notification to your registered email address 30 days prior to the scheduled deletion. If we receive no response from you within this period, your account and associated personal data will be automatically and permanently deleted or anonymized, subject to our legal retention obligations.

3.3 Data Deletion by Third Parties:

When we engage with third-party service providers (e.g., payment processors), we ensure through legally binding Data Processing Agreements (DPAs) that they honor your data deletion rights.

When your data is deleted from our systems, we will simultaneously instruct our partners to delete their copies of your data in accordance with our agreements.