Privacy policy

1. Who we are and what this policy covers

YouBankingBuddy.com (“YouBankingBuddy”, “we”, “us”) is a banking and financial-product comparison and lead-generation platform owned and operated by Catalyst Web Trendz Pvt. Ltd., D 29, 2nd Floor, Greater Kailash Enclave 2, Greater Kailash, New Delhi – 110048, India. For the purposes of the Digital Personal Data Protection Act, 2023 (“DPDP Act”), Catalyst Web Trendz Pvt. Ltd. is the Data Fiduciary in respect of the personal data described in this policy, and you are the Data Principal.

We are not a bank, an NBFC, a broker, a SEBI-registered investment adviser or an IRDAI-licensed insurance intermediary. We do not lend, accept deposits, underwrite risk, hold client funds or manage investments. We publish comparisons and, where you ask us to, we pass your enquiry to a partner institution so that it can contact you directly. That distinction shapes this entire policy: much of what happens to your data after an enquiry happens at the partner, under the partner's own privacy policy.

This policy applies to the website www.youbankingbuddy.com, our enquiry and callback forms, our newsletter The Money Memo, and any telephone, email or WhatsApp conversation you have with our team. It does not apply to a bank, NBFC, insurer or asset management company you deal with after we introduce you, nor to any third-party site you reach through a link on our pages.

It is issued in accordance with the DPDP Act, the Information Technology Act, 2000 (including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 to the extent still operative), the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the Consumer Protection Act, 2019 read with the Consumer Protection (E-Commerce) Rules, 2020.

2. The personal data we collect

We collect only what a comparison and referral actually needs. We do not ask for your account passwords, net-banking credentials, card CVV, OTPs or UPI PIN, and no member of our team will ever ask you for them by phone, email or WhatsApp. If someone claiming to represent YouBankingBuddy asks for such details, it is a fraud attempt — please report it to us immediately.

2.1 Data you give us directly

• Identity and contact details — your name, mobile number, email address and city or PIN code.
• Financial and employment data — your monthly or annual income, employment type (salaried, self-employed or business), employer or business name where you choose to give it, and existing monthly obligations such as running EMIs.
• Product interest data — the product family you are comparing, the loan amount or cover sought, the tenure you have in mind, the property or vehicle value where relevant, and your preferred lender if you name one.
• Identifiers you volunteer — PAN, date of birth or age band, only where a partner requires it to run an indicative eligibility check and only after you have expressly consented on the form.
• Correspondence — the content of enquiry messages, callback requests, complaints and any documents you choose to send us.

2.2 Data collected automatically

• Device and technical data — IP address, browser type and version, operating system, device category, screen size and referring URL.
• Usage and analytics data — pages viewed, comparisons opened, filters applied, time on page and outbound clicks to partner sites, in aggregated form.
• Cookie data — see section 8 for the full table.

2.3 Data we deliberately do not collect

We do not collect biometric data, government identity documents (other than a PAN where you expressly provide it), health records, caste, religion, political opinions or sexual orientation. We do not scrape your device contacts, SMS inbox, call logs, photo gallery or location beyond a coarse city inference from your IP address. Our calculators run entirely inside your browser; the amounts, rates and tenures you type into them are not transmitted to our servers or stored anywhere.

2.4 Financial data is sensitive

Income, employment status, existing obligations, credit standing and the fact that you are seeking a loan are, in our view, among the most sensitive categories of personal data an Indian consumer can share. Even though the DPDP Act does not create a separate statutory class of “sensitive personal data”, we apply heightened treatment to all financial data: narrower internal access, shorter retention, encryption in transit and at rest, and no use for any purpose beyond the one you consented to.

3. Why we process your data, and on what lawful basis

Under section 4 of the DPDP Act we may process your personal data only for a lawful purpose, and only with your consent or for a “certain legitimate use” recognised by the Act. Our purposes are:

• To answer your enquiry — to shortlist products that fit the details you gave and, where you asked, to introduce you to a partner institution. Basis: your consent.
• To contact you about that enquiry — by phone, email or WhatsApp, to confirm requirements and explain options. Basis: your consent, and the legitimate use of responding to a request you voluntarily initiated.
• To send you The Money Memo and product updates — only if you separately ticked the marketing box. Basis: your consent, withdrawable at any time.
• To operate, secure and improve the platform — fraud prevention, rate limiting, debugging, and aggregated analytics that tell us which comparisons people find useful. Basis: your consent to non-essential cookies, and legitimate use for security.
• To meet legal and regulatory obligations — record keeping, responding to a lawful order of a court or authorised government agency, and defending legal claims. Basis: legitimate use under the DPDP Act and applicable Indian law.

We do not use your data for automated decision-making that produces a legal or similarly significant effect on you. We do not build advertising profiles, we do not run behavioural retargeting pixels, and we do not sell, rent, barter or licence personal data to anybody. Ever.

4. Consent, and how you withdraw it

Every consent we take is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, as section 6 of the DPDP Act requires. In practice that means:

• No pre-ticked boxes. You tick the consent box yourself, or there is no submission.
• The consent notice sits next to the button you press, in English, and names the categories of recipient it covers.
• Separate consent is taken for (a) processing your enquiry and sharing it with partners, and (b) marketing communications. Refusing (b) does not affect (a).
• Consent covers only the product family you enquired about. A home-loan enquiry is not consent to be called about a credit card.
• You may ask for the consent notice in Hindi or any language in the Eighth Schedule to the Constitution by writing to the Grievance Officer.

Withdrawing consent. Write to info@catalystwebtrendz.com from the email address you registered, or call +91-9953590779, with the subject line “Withdraw consent”. Newsletter consent can also be withdrawn from the unsubscribe link at the foot of every issue. We action withdrawals within 7 working days and stop the relevant processing, and we will erase the underlying data unless we are required by law to retain it (see section 10).

Withdrawal is not retrospective. It does not undo processing already lawfully carried out, and it does not reach data already shared with a partner institution before withdrawal — that partner is by then an independent Data Fiduciary and you must exercise your rights against it directly. We will, on request, tell you which partners received your enquiry so that you know whom to write to.

5. Sharing your enquiry with partner banks, NBFCs and insurers

This is the single most important disclosure in this policy, so it is stated plainly.

When you submit an enquiry, we share the details of that enquiry with one or more partner banks, non-banking financial companies, insurers or asset management companies so that they may contact you directly about the product you enquired about. That is the purpose of the form, and it is what your consent covers. You will typically be contacted by the partner within one to three working days, by telephone, SMS, email or WhatsApp.

What we share is limited to what the partner needs to assess and respond to your enquiry: your name, mobile number, email address, city, the product and amount sought, your stated income band and employment type, and your stated existing obligations. We do not share your browsing history, your calculator inputs or the content of unrelated correspondence.

Categories as on 21 Jul 2026. The list of individual partner institutions changes from time to time; the categories do not.

5.1 Once shared, the partner is its own Data Fiduciary

The moment a partner institution receives your enquiry, it processes that data as an independent Data Fiduciary in its own right, for its own purposes, under its own privacy policy and its own regulatory obligations to the RBI, IRDAI or SEBI. It is not our processor and we do not control what it does. Requests to correct, erase or stop that data must be made to the partner directly; we will help you find the right contact, but we cannot action it for you.

5.2 We never sell data

We do not sell, rent, trade, syndicate or licence personal data to anyone, in any circumstance, for any price. We do not operate a data marketplace, we do not append your record to third-party datasets, and we do not permit partners to reuse the data we share for any product other than the one you enquired about. Our commercial model is a referral fee paid by the partner when an application it received progresses — not a payment for a contact list. See our Disclaimer for the full remuneration disclosure.

6. Calls, SMS, WhatsApp and your DND preference

By submitting an enquiry and ticking the consent box, you agree that we and the partner institutions to whom your enquiry is referred may contact you on the number and email you supplied, in connection with that enquiry. You expressly agree that these communications are not unsolicited commercial communication, and that this consent operates notwithstanding any registration you may hold under the Do Not Disturb (DND) or Do Not Call registry maintained by TRAI, for the limited purpose and limited period of servicing your enquiry.

This consent is not open-ended:

• It applies to the product family you enquired about, not to every product we list.
• It runs for 90 days from the date of enquiry, after which we treat the enquiry as closed unless you re-engage.
• It is withdrawable at any time under section 4. Tell us, and our calls and messages stop.
• Marketing messages — The Money Memo, rate alerts, product launches — require the separate marketing tick and carry an unsubscribe link in every issue.

If a partner continues to contact you after you have asked it to stop, raise it with that partner's grievance officer and, in parallel, tell us. We take persistent contact complaints seriously and it is a ground on which we terminate a partner relationship.

7. Credit scores, bureaus, and soft versus hard enquiries

A great deal of anxiety around comparison sites concerns credit scores, so here is the position precisely.

YouBankingBuddy does not pull your credit report. Browsing this site, running our calculators or reading our comparisons has no effect whatsoever on your credit score. Our eligibility checker applies a standard FOIR assumption to figures you type in yourself; it does not contact any credit information company.

7.1 Soft enquiry

A soft enquiry is a credit-report retrieval made for information — for example, when you ask to see your own score, or when a lender pre-screens a segment. It is visible to you, it is not visible to other lenders as an application, and it does not reduce your score. If we ever retrieve an indicative score for you, it will be a soft enquiry, it will be from a credit information company registered under the Credit Information Companies (Regulation) Act, 2005, and it will happen only after you have given separate, explicit, on-screen consent naming the bureau. You may decline and still use every other part of the site.

7.2 Hard enquiry

A hard enquiry is a credit-report retrieval made by a lender assessing an actual application. It is recorded on your report, other lenders can see it, and several hard enquiries in a short window can modestly depress your score. A hard enquiry only happens when you formally apply to a lender — that is, after our introduction, on the lender's own form, under the lender's own consent. It is the lender's enquiry, not ours, and the lender is required to tell you before making it.

We never authorise a partner to run a hard enquiry on our behalf, and no consent you give us on this site constitutes consent to a hard enquiry by anybody.

8. Cookies and similar technologies

We use a small number of cookies. Strictly necessary cookies are set as soon as you load the page because the site cannot function without them. Everything else waits for you to press Accept on the consent banner; press Decline and only the necessary set is used. You can change your mind at any time by clearing site data in your browser, which restores the banner.

Cookie inventory as on 21 Jul 2026 and subject to change; we re-publish this table whenever it changes.

We do not run advertising cookies, cross-site tracking pixels, fingerprinting scripts or third-party retargeting tags of any kind. If we ever needed to, we would ask you first and update this table before switching them on.

9. Analytics and how we measure the site

We measure the site so that the research desk knows which comparisons, calculators and articles are worth maintaining. Analytics data is pseudonymous and reported in aggregate — page views, session duration, device mix, the share of readers who open a rate table, the share who then use a calculator. IP addresses used for analytics are truncated before storage. We do not attempt to re-identify an analytics record, and we do not join analytics data to enquiry data.

10. How long we keep your data

Under section 8(7) of the DPDP Act we erase personal data once the purpose is served and retention is no longer necessary for a legal purpose. In practice we work to fixed periods.

Where a longer period is required by a court order, a regulator or an ongoing investigation, we retain only the specific records concerned, and only for as long as the obligation lasts.

11. How we protect your data

We apply reasonable security safeguards proportionate to the sensitivity of financial data, as required by section 8(5) of the DPDP Act and section 43A of the IT Act, 2000:

• TLS 1.2 or higher for every page and every form submission; the site is served over HTTPS only.
• Encryption at rest for enquiry records, with keys managed separately from the data store.
• Role-based access control on a need-to-know basis, multi-factor authentication for every administrative account, and access logging.
• Written data-processing agreements with every vendor that touches personal data, including confidentiality, security and deletion obligations.
• Segregation of the marketing database from the enquiry database.
• Periodic vulnerability assessment, patching, backup testing and staff training on phishing and social engineering.

No system is perfectly secure, and we do not claim otherwise. You also have a part to play: use a strong, unique password wherever you hold an account with a partner, never share an OTP, and remember that we will never ask you for banking credentials.

12. Children and persons under 18

The platform is intended for persons aged 18 years or above who are resident in India and legally competent to contract under the Indian Contract Act, 1872. We do not knowingly collect the personal data of a child, we do not direct any service, comparison or communication at children, and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children, in line with section 9 of the DPDP Act.

If you believe a person under 18 has submitted personal data to us, write to the Grievance Officer and we will verify and erase the record promptly, and in any event within 7 working days.

13. Your rights as a Data Principal

Chapter III of the DPDP Act gives you the following rights, and we honour all of them:

• Right to access — a summary of the personal data we hold about you, the processing activities undertaken, and the identities of the Data Fiduciaries and processors with whom it has been shared.
• Right to correction and completion — to have inaccurate or misleading data corrected, incomplete data completed and outdated data updated.
• Right to erasure — to have your data deleted where the purpose is served and no law requires us to keep it.
• Right to withdraw consent — as easily as it was given (see section 4).
• Right of grievance redressal — to complain to our Grievance Officer before approaching the Data Protection Board of India.
• Right to nominate — to nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.

How to exercise them. Email info@catalystwebtrendz.com with the subject line “DPDP request”, stating which right you are exercising and the mobile number or email address you used on the site. We may ask one verification question to confirm it is really you; we will not demand identity documents we do not already hold. We respond within 15 days. There is no fee.

You also have duties under section 15 of the DPDP Act: give authentic information, do not impersonate another person, do not suppress material information when applying for a financial product, and do not file a false or frivolous grievance. Furnishing false income or employment information to obtain credit can constitute an offence and will, in any event, be found out by the lender.

If you are dissatisfied with our response, you may complain to the Data Protection Board of India constituted under the DPDP Act, after first exhausting the grievance route in section 18.

14. Transfers outside India

Personal data collected through this site is stored on servers located in India. Some of our IT service providers — for example email delivery and error monitoring — may process limited data outside India. Where that happens we transfer only to countries not restricted by the Central Government under section 16 of the DPDP Act, we bind the recipient by written contract to standards no lower than those in this policy, and we transfer the minimum data necessary. Enquiry data shared with partner banks, NBFCs and insurers is processed by those institutions in India under their own regulatory obligations.

15. Personal data breach notification

If a personal data breach occurs, we will notify each affected Data Principal and the Data Protection Board of India in the form and manner prescribed under the DPDP Act and its rules, without undue delay. We will also report to CERT-In within the timelines set under the IT Act, 2000 and CERT-In directions where the incident falls within a reportable category. Our notice will describe, so far as known, the nature and extent of the breach, the likely consequences, the measures we have taken to mitigate it, and the steps you should take to protect yourself. We maintain an internal incident register of every reportable event.

16. Third-party links and partner websites

Our comparison pages link out to bank, NBFC, insurer and AMC websites, and to public sources such as regulator publications. Following such a link takes you to a site we do not control. Their privacy policies, cookies and security practices are theirs, not ours, and we accept no responsibility for them. Read the destination site's privacy policy before you submit anything to it — particularly before you upload identity documents or bank statements.

17. Changes to this policy

We revise this policy when the law changes, when we add a category of recipient, or when we change what we do with data. The “last updated” date at the top always reflects the version in force. Material changes — a new purpose, a new recipient category, a longer retention period — are announced on the site and in The Money Memo at least 14 days before they take effect, and where the law requires it we will ask for fresh consent rather than assume it. Continuing to use the platform after a change takes effect means you accept the revised policy.

18. Grievance Officer and escalation

In accordance with rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and section 13 of the DPDP Act, we have appointed a Grievance Officer to receive and resolve complaints about this policy, about the handling of your personal data, and about any content on this site.

• Grievance Officer — YouBankingBuddy, c/o Catalyst Web Trendz Pvt. Ltd. [Name of the officer to be inserted by the company before publication.]
• Address — D 29, 2nd Floor, Greater Kailash Enclave 2, Greater Kailash, New Delhi – 110048
• Email — info@catalystwebtrendz.com
• Phone and WhatsApp — +91-9953590779 / wa.me/919953590779
• Hours — Monday–Friday, 10:00 AM – 7:00 PM IST

We acknowledge every grievance within 24 hours of receipt and dispose of it within 15 days, as those rules require. Requests to remove unlawful content are actioned within the shorter timelines prescribed for the category concerned. If you are not satisfied with the outcome, you may escalate to the Data Protection Board of India, or approach the consumer forum having jurisdiction under the Consumer Protection Act, 2019. The courts at New Delhi have exclusive jurisdiction over any dispute arising from this policy.