Privacy Policy.

1. Introduction

Exclusive Reviews ("Company", "we", "us") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, share, and protect your information when you use our platform at exclusivereviews.in ("Platform").

This policy is compliant with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000 (IT Act), and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

2. Data We Collect

2.1 Information You Provide

• Account Data: Name, email address, phone number, password (hashed), profile photo.
• Profile Data: Demographics (age, gender, location), interests, preferences.
• Review Content: Written reviews, ratings, photos, videos, purchase proofs.
• Communication Data: Support tickets, feedback, correspondence with us.
• Payment Data: Billing information for company accounts (processed by third-party payment providers).
• Identity Verification: Documents submitted for account verification or dispute resolution.

2.2 Information Collected Automatically

• Device Data: Device type, operating system, browser type, screen resolution.
• Usage Data: Pages visited, features used, time spent, search queries, click patterns.
• Network Data: IP address, approximate location (city-level), ISP information.
• Session Data: Login timestamps, session duration, authentication events.
• Cookie Data: As described in our Cookie Policy.

2.3 Information from Third Parties

• SSO providers (if you log in via Google, Facebook, etc.) — name, email, profile picture.
• Referral data from users who referred you to the Platform.
• Publicly available information for fraud prevention and verification.

3. Purpose of Data Processing

We process your personal data for the following purposes:

4. Data Sharing & Disclosure

We may share your personal data with:

• Service Providers: Cloud hosting (AWS), email delivery, payment processing, error monitoring (Sentry) — bound by data processing agreements.
• Company Accounts: Aggregated and anonymized analytics data. Individual review content is public. Personal demographic data is shared only in aggregate.
• Legal Authorities: When required by Indian law, court order, or government directive.
• Business Transfers: In the event of a merger, acquisition, or asset sale, with prior notice to affected users.
• With Your Consent: Any other sharing requires your explicit prior consent.

We do not sell your personal data to third parties for their marketing purposes.

5. Data Storage & Security

5.1 Storage

Your data is stored on servers located in India. Where data transfer outside India is necessary (e.g., third-party service providers), we ensure appropriate safeguards are in place as required under the DPDP Act.

5.2 Security Measures

• Passwords hashed using bcrypt with cost factor 12.
• All data transmitted over TLS/HTTPS encryption.
• Two-factor authentication (TOTP) available for all accounts.
• Role-based access control (RBAC) for internal systems.
• Regular security audits and vulnerability assessments.
• Encrypted backup codes for 2FA recovery.
• Session management with automatic expiry and device tracking.
• Rate limiting and abuse prevention on all endpoints.

6. Data Retention

We retain your data for the following periods:

• Account Data: Duration of account existence + 3 years post-deletion.
• Review Content: Indefinitely (public reviews) unless you request removal.
• Transaction Data: 8 years (as required by Indian tax law).
• Audit Logs: 3 years.
• Session/Login Data: 1 year.
• Marketing Preferences: Until you withdraw consent.

See our Data Retention Policy for complete details.

7. Your Rights (Under DPDP Act 2023)

As a Data Principal, you have the right to:

• Access: Request a summary of your personal data and processing activities.
• Correction: Request correction of inaccurate or incomplete personal data.
• Erasure: Request deletion of your personal data (subject to legal retention requirements).
• Withdraw Consent: Withdraw previously given consent at any time (this does not affect lawfulness of prior processing).
• Grievance Redressal: File a complaint with our Grievance Officer or the Data Protection Board of India.
• Nomination: Nominate another individual to exercise your rights in case of death or incapacity.

To exercise these rights, contact our Grievance Officer (details below) or use the relevant options in your account settings.

8. Children's Data

The Platform is not intended for individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a person under 18, we will take steps to delete such data promptly. If you believe a child has provided us personal data, please contact our Grievance Officer.

9. Automated Decision-Making

We use AI-powered systems for review quality assessment and fraud detection. These systems may:

• Assess review authenticity and quality scores.
• Detect patterns indicative of fraudulent activity.
• Flag content for human moderator review.
• Calculate trust scores based on user behaviour history.

Significant decisions (account suspension, reward forfeiture) are always reviewed by a human moderator before enforcement. You may request human review of any automated decision that affects you.

10. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be notified via email or a prominent notice on the Platform at least 30 days before taking effect. Continued use of the Platform after changes constitutes acceptance.

11. Grievance Officer

In accordance with the Information Technology Act, 2000 and DPDP Act, 2023, the designated Grievance Officer for this Platform is:

If you are not satisfied with our resolution, you may file a complaint with the Data Protection Board of India as established under the DPDP Act, 2023.

12. Contact Us