Privacy Policy

Last updated: July 15, 2026

Welcome to MetroCardz. We value your trust, and we are committed to protecting the personal data of our merchants and their loyalty program customers.

1. Information We Collect

To run the custom loyalty programs, we collect and process information on behalf of merchants:

  • Merchant Profile: Business name, address, category, WhatsApp number, and representative name.
  • Customer Profiles: Customer names, mobile numbers, dates of birth (for birthday reminders), and anniversary dates (optional).
  • Loyalty Data: Stamp counts, points balances, transaction histories, and redemption logs.

2. How We Use Your Data

We process data solely to provide and improve the MetroCardz services, including:

  • Validating and recording customer loyalty point accruals and redemptions.
  • Automating birthday, anniversary, and membership renewal notifications via SMS/WhatsApp as configured by the merchant.
  • Providing analytics, charts, and report exports inside the merchant dashboard.

3. DPDP Act 2023 Compliance & Data Collection Bond

In alignment with India's Digital Personal Data Protection (DPDP) Act 2023 and our statutory legal bond:

  • Legal Roles: MetroCardz operates as a Data Processor under a strict fiduciary service agreement. The merchant operates as the Data Fiduciary and warrants that customer consent has been collected lawfully.
  • Zero Third-Party Commercialization Bond: Neither merchant business records nor customer phone numbers/names will ever be sold, rented, monetized, or shared with third-party advertisers or competing businesses.
  • Customer Rights: End-customers have the right to access their loyalty pass data, update their details, or request erasure of their loyalty records by contacting their respective store merchant.
  • Retention & Purge: We store customer loyalty information strictly for active program tracking. Data is permanently purged upon lawful deletion request or merchant account termination.

4. Security Measures

All customer personal data is transmitted securely via TLS encryption and stored in secure cloud environments within local data centers in India. No customer phone numbers or PII are sold or shared with third-party advertising companies.

5. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy, please contact our data grievance officer at privacy@metrocardz.in.