Last updated: 2026-06-25

Privacy Policy

Rudraayaan AI Technologies Private Limited ("Card9", "we", "us") operates the Card9 platform — the website at card9.in and the Card9 mobile applications for Android and iOS. This Privacy Policy describes the personal data we collect across the website and the apps, how we use it, who we share it with, and your rights under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and applicable Indian law. It applies equally to all platforms.

1. Data we collect

2. Mobile app permissions

The Card9 app requests the minimum permissions needed to function:

We do not collect device location. The app does not request GPS or background-location permission and does not access your precise or coarse device location. Any delivery city or address used in the app is information you type or select yourself, not a reading from your device's location sensors. The app contains no advertising SDKs and does not track you across other apps or websites.

3. How we use it

We do not sell your personal data, and we do not use it for third-party advertising.

4. Sharing & sub-processors

We share data only with the sub-processors we need to operate the platform: Supabase (database, authentication, and image storage), Dove Soft (DLT-compliant OTP and transactional SMS), Resend (transactional email), Hostinger (server infrastructure), and Google (OAuth login, where you opt in). When a buyer messages a seller on WhatsApp, the buyer's WhatsApp number is shared with that specific seller by the buyer's own action. We do not share data with any party for advertising.

5. Data security

All data is encrypted in transit using HTTPS/TLS. Passwords are stored as one-way hashes and never in plain text. Access to production data is restricted to authorized personnel. While no system is perfectly secure, we apply reasonable security practices as required by the DPDP Act 2023 and the IT Rules, 2011.

6. Your rights under DPDP Act 2023

You have the right to: access your personal data, correct or update inaccurate data, request erasure of your data, withdraw consent, and lodge a grievance. Email any such request to support@card9.in. We will respond within the statutory timeline.

7. Deleting your account and data

You can delete your account and associated personal data at any time:

Some records (e.g. completed-order and tax records) may be retained for the limited period required by Indian tax and consumer-protection law, after which they are deleted. See Retention below.

8. Grievance Officer

In accordance with the DPDP Act 2023 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, our designated Grievance Officer is:

9. Children

Card9 is a commerce platform intended for users aged 18 and over and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact support@card9.in and we will delete it.

10. Retention

Account and transaction records are retained for as long as the account is active, plus the periods required by Indian tax and consumer-protection law. Erasure requests are honored subject to these legal retention requirements.

11. Changes to this policy

Material changes will be notified by email or by an in-product banner. The "Last updated" date at the top of this page reflects the most recent revision.

© 2026 Rudraayaan AI Technologies Private Limited. All rights reserved. CIN: U62011TS2026PTC216546 · GSTIN application in process

Registered office: H No. 14/964/64/A/1, Krishna Nagar Colony, Ameenpur, Ramachandrapuram, Medak, Telangana 502032, India

Contact: support@card9.in · +91 9281212772