Draft — not yet approved
Who is responsible for your data
Data fiduciary / operator: [To be confirmed: legal entity]. Regulated lender: [To be confirmed: lender].
What we collect and why
- Mobile number — to verify you and secure your account.
- Name, date of birth, email, address — identity, KYC and communication about your loan.
- Employment and income — so the lender can assess whether the loan is affordable.
- PAN and documents you upload — KYC and income verification. PAN is encrypted when stored.
- Technical data — pseudonymised IP and device information for security and fraud prevention.
What we never access
We do not access your contacts, call logs, SMS inbox, photos, files or media, and we do not use your location or microphone. Camera access, if ever needed for KYC, is requested only at that step, for that purpose.
Consents you give
- Privacy notice (required): Confirms you have been told what data we collect, why, who it is shared with, and how long it is kept.
- Processing my application data (required): Needed to review your application and, if approved, to manage your loan. Without it we cannot process the application.
- Credit information check (required): The lender checks your credit history to assess your ability to repay. This enquiry may be recorded on your credit report.
- Identity verification (KYC) (required): Required by KYC rules before a loan can be made. Only the documents listed in the application are used.
- Electronic documents and communication (required): Lets the lender send you your KFS, agreement and repayment notices to your verified mobile number and email.
- Sharing with named service providers (required): The lender, KYC provider and credit bureau each need specific information to do their part. They are named in the Privacy Notice.
- Product updates (optional) (optional): Optional. Saying no has no effect on your application. You can change this at any time in settings.
Who receives your data
Only the regulated lender and the service providers named here, for the purposes stated: [To be confirmed: named KYC provider, credit bureau(s), SMS provider, cloud host, payment provider].
Where data is stored
[To be confirmed: storage location (must be servers located in India)]
How long we keep it
Rejected applications: [To be confirmed: period]. Loan records: [To be confirmed: period required by law]. One-time passcodes: 30 days.
Your rights
You can request access to, correction of, or erasure of your data (subject to legal retention requirements), withdraw consent, and raise a privacy grievance from your account settings.