Privacy policy

This policy explains what personal data Karmacash (company registration in progress) collects, why, how long we keep it and how you can withdraw your consent, under the Digital Personal Data Protection Act, 2023.

What we collect, and why

• Mobile number: to sign you in and contact you about your application and loan.
• KYC details (name, date of birth, address, PAN, last four Aadhaar digits, selfie): to verify your identity for the lender.
• Bank statements for 12 months, fetched once through the RBI Account Aggregator: to assess your income and repayment capacity.
• Credit report: to check your credit history.
• Bank account details for disbursal and auto-debit: to pay you and collect EMIs.

What we never collect

Your contacts, photos, files, call logs or SMS. Camera and location are used once, for KYC, with your permission.

Consent

We ask for each consent separately and record when you gave it and the exact words you saw. You can withdraw consent from your account or your Account Aggregator app as easily as you gave it. A Hindi version of this notice is available on request.

How long we keep it

Raw bank statements are deleted after the loan decision, or after the period the lender's policy requires. Data needed for your loan is kept for the life of the loan and as long as the law requires afterwards.

Where it is stored

All personal data is stored on servers in India and encrypted in storage and in transit.

Who we share it with

Our NBFC lending partner, credit bureaus, and the service providers that run KYC, e-sign and payments for us. We never sell your data.

Contact

Grievance officer: [email protected]