Corra Club – Privacy Policy

3.1 Purpose & Core Functionality

Corra Club is a coalition loyalty program where users earn rewards (“Corra Coins”) by uploading purchase receipts from partner brands. To verify the authenticity of these receipts and prevent fraudulent submissions, the App reads financial SMS from your device to cross-match uploaded receipt data (amount, date, merchant) against your actual bank transaction records.

This SMS-based transaction verification is a core functionality of the App. Without it, the App would need to rely solely on manual receipt review, which is slower, less accurate, and more susceptible to fraud.

3.2 What We Read

• Only SMS from 6-digit alphanumeric sender IDs (financial institutions such as banks, UPI providers, and payment platforms)
• Transaction details: amount debited/credited, date, merchant/payee name, UPI reference number, and account identifier
• This includes historical financial SMS already present on your device at the time of granting permission

3.3 What We Do NOT Read

• Personal messages from contacts (10-digit numbers)
• OTPs, one-time passwords, or verification codes
• Promotional, marketing, or spam SMS
• Messages from social media, messaging apps, or email

3.4 How Financial SMS Data Is Used

• Receipt Verification: Cross-matching uploaded receipt details (brand, amount, date) against bank transaction SMS to confirm that a genuine purchase occurred
• Fraud Detection: Identifying potentially fraudulent or tampered receipts by detecting mismatches between the receipt and the corresponding bank debit
• Faster Approval: Enabling automated verification and faster Corra Coin crediting when receipt data matches bank SMS data

3.5 How Financial SMS Data Is NOT Used

Financial SMS data is never used for:

• Advertising, ad targeting, or ad personalization
• Credit scoring, credit assessment, or lending decisions
• User profiling or behavioral targeting
• Selling or renting to any third party
• Any purpose unrelated to receipt and transaction verification within the Corra Club platform

3.6 User Consent & Control

• SMS read permission is requested only after displaying a prominent in-app disclosure screen explaining exactly what data will be collected and why
• You must provide explicit, affirmative consent (tap “I Agree”) before any SMS data is accessed
• Declining SMS permission does not prevent you from using the App; receipt uploads will continue to work with manual verification (which may take longer)
• You can revoke SMS permission at any time via your device’s Settings > Apps > Corra Club > Permissions
• Upon revoking permission, the App will immediately stop reading SMS data. Previously collected financial SMS data will be deleted from our servers within 30 days of revocation, unless retention is required by law

The App integrates a third-party SDK provided by Digitap.ai (“Digitap”, operated by FinBox Technologies Private Limited) to process financial SMS data on our behalf. This SDK:

• Reads only financial SMS from 6-digit alphanumeric senders on your device
• Extracts structured transaction data (amount, date, merchant, reference number) from those SMS
• Transmits the extracted financial transaction data to Digitap’s secure servers and to Corra Club’s servers for receipt verification

Digitap’s Data Handling

• Digitap acts as a Data Processor under a written data processing agreement with Corra Technologies Private Limited
• Digitap processes SMS data strictly for the purpose of transaction verification as instructed by us
• Digitap employs separation of environments, segregation of duties, strict role-based access control on a documented, authorized, need-to-use basis
• Data stored by Digitap is protected with application-level encryption, with key management services limiting access
• Digitap does not sell, rent, or share your SMS data with any other third party
• Digitap does not use your SMS data for credit scoring, lending, advertising, or any purpose other than providing the transaction verification service to Corra Club

Corra Club may allow users to connect their Gmail account to automatically detect purchase receipts from partner brands.

If a user chooses to connect Gmail:

• The platform reads only emails necessary to identify purchase receipts relevant to Corra Club reward submissions
• The platform does not read unrelated personal emails
• Only receipt-related metadata such as brand name, bill amount, and purchase date may be extracted
• Email content is processed only for the purpose of identifying eligible receipts

Corra Club does NOT:

• Sell Gmail user data
• Use Gmail data for advertising
• Use Gmail data to train AI models
• Transfer Gmail data to third parties except for providing core platform functionality

Users may disconnect Gmail access at any time through their Google Account settings.

Corra Club’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Some partner brands run their own online stores where Corra Coins are earned and spent automatically, without uploading a receipt. Where you shop at such a store, the store’s platform shares limited order information with us so that we can credit, hold and reverse coins.

When you buy a digital gift card, we source it from an authorised distributor and deliver the code to you inside the App.

• Account data: Retained while your account remains active. Deleted within 90 days of account deletion request, subject to legal retention requirements.
• Transaction records and receipts: Retained for a minimum of 3 years from the transaction date for audit and fraud-prevention purposes, or longer if required by law.
• Financial SMS data: Extracted transaction data is retained only as long as needed for receipt verification (typically 90 days from the associated transaction). Raw SMS content is not stored on our servers; only structured data fields (amount, date, merchant, reference) are retained.
• Partner online store orders: Coin ledger entries are retained for a minimum of 3 years as financial records. The contact details that link an order to you are removed on an erasure request forwarded by the store platform, leaving an entry that no longer identifies you.
• Gift card codes: Retained encrypted while your account is active, so that you can retrieve a card you have bought, and deleted with your account. Order records are retained for a minimum of 3 years as financial records.
• Analytics data: Retained in anonymized or aggregated form for product improvement.

You may request deletion of your personal data by:

• Emailing rohit.singh@clubcorra.com with the subject “Data Deletion Request”
• Using the in-app account deletion option (Profile > Delete Account)

Upon receiving a verified deletion request, we will delete your personal data within 90 days, except where retention is required by law, for ongoing fraud investigations, or for legitimate financial audit purposes.

To specifically request deletion of financial SMS data collected from your device, you may revoke the SMS read permission in your device settings and email us to confirm deletion from our servers.

We reserve the right to update this Privacy Policy at any time. Changes will be posted on this page with a revised “Last Updated” date. For material changes (such as changes to how SMS data is collected or shared), we will provide notice via:

• An in-app notification
• An update to the “Last Updated” date at the top of this page
• A WhatsApp notification, where applicable

Continued use of the Platform after changes are posted constitutes acceptance of the updated Privacy Policy.