Privacy Policy

This Privacy Policy explains how BCDRPulse ("we", "us", or "our") collects, uses, shares, and protects your personal data when you use our Service. We aim to handle personal data in accordance with the Digital Personal Data Protection Act, 2023 (India) and other applicable laws.

We want to be unambiguous about this, because it is core to how BCDRPulse operates:

• We do not run advertising, and we never show ads.
• We do not use analytics or behavioural tracking tools.
• We do not set advertising or tracking cookies — only the essential cookies needed to keep you signed in.
• We do not sell, rent, or trade your personal data.
• We do not enable third-party telemetry in our application.

• Account information: your name and email address, collected through our authentication provider when you create an account.
• Billing information: handled by Dodo Payments, our merchant of record, which collects your billing name, email, billing address and any tax ID you enter, and issues your invoice. We do not store your card numbers or payment credentials — only a customer reference, a subscription reference and its status.
• Asset information: the domains or hosts you add, their verification tokens, and verification status.
• Service data: the results we generate for your assets, including uptime checks, response times, load-test metrics, and security-scan findings.
• Technical and log data: limited operational data necessary to run and secure the Service.

• To provide, operate, and maintain the Service.
• To run the checks, tests, and scans you request against your verified assets.
• To send you alerts and important notices by email or webhook.
• To process your subscription and payments.
• To secure the Service and prevent abuse.
• To comply with our legal obligations.

We use trusted third parties to operate the Service. They process data on our behalf and only as needed to provide their part of the Service:

• Clerk — authentication and account management.
• Dodo Payments — merchant of record for paid plans: checkout, subscription billing, invoicing and tax collection.
• Razorpay — payment processing for subscriptions started before November 2026 (no new payments).
• Cloudflare — hosting, edge infrastructure, database, and fallback AI report generation.
• Resend — sending transactional and alert emails.
• Amazon Web Services — on-demand compute that runs cloud-scale load, stress, TLS, and resilience tests.
• Anthropic — AI generation of the written analysis in test and scan reports.

A detailed, current list of these providers — including the specific data each processes and where — is maintained on our Subprocessors page. Some of these providers may process data on servers located outside India.

We do not sell your personal data. We share personal data only with the service providers listed above, when required by law or legal process, or where necessary to protect our rights, our users, or the public.

We retain your personal data for as long as your account is active and as needed to provide the Service or to comply with our legal obligations. You may request deletion of your data as described below.

We use reasonable technical and organizational measures to protect personal data, including encryption of data in transit, secure secret management, and access controls. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Subject to applicable law, including the Digital Personal Data Protection Act, 2023, you have the right to access the personal data we hold about you, to request correction of inaccurate data, and to request its erasure. You also have the right to grievance redressal. To exercise any of these rights, or to raise a grievance, contact us at support@bcdrpulse.com, and we will respond in accordance with applicable law.

We use only the cookies necessary to operate the Service, such as session cookies used for authentication. We do not use advertising or third-party tracking cookies.

We retain your personal data only for as long as it is needed to provide the Service or to comply with our legal obligations. When you delete your account, we permanently erase all operational data associated with it, including your verified assets, monitors, check history, scan results, load-test results, alert channels, and alert events.

Billing and transaction records are anonymized rather than deleted. We are required by Indian tax and financial law (including the GST Act and the Companies Act, 2013) to retain transaction records for a minimum period, which may be up to eight years from the end of the relevant financial year. During this period, the records are stripped of personally identifying information and cannot be linked back to you.

If you do not delete your account but become inactive, we may erase your personal data after a period of prolonged inactivity in accordance with applicable law. We will notify you before doing so.

Because some of our service providers operate outside India, your personal data may be transferred to and processed in other countries. We rely on these providers' safeguards to protect your data during such transfers.

The Service is not intended for individuals under the age of 18, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above. We encourage you to review this page periodically.