Privacy Policy

Indiloan is a privacy-first loan marketplace operated by [Registered legal entity name] ("Indiloan", "we", "us", "our"). We connect loan seekers with banks and Non-Banking Financial Companies (NBFCs). We are a lead-generation and matchmaking platform — we are not a lender, and we do not ourselves grant, disburse, or service loans.

For the personal data you share with us, we act as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 (the "DPDP Act"). You are the Data Principal. This policy applies to our website, applications, and related services (together, the "Platform").

We collect only what we need to match you with lenders. Specifically:

• Account details: your name (as per PAN), email address, and mobile number (verified by OTP).
• Loan preferences: loan type, amount, tenure, whether secured or unsecured, and course/admission details for education loans.
• Profile and eligibility details: residential pin code, co-applicant relationship, academic record, entrance exam results, and employment/income details where you choose to provide them.
• KYC data (only if you choose to proceed with a lender): identity verification via DigiLocker, PAN verification, photograph, and your credit score where you consent to a CIBIL pull.
• Documents you upload, such as admission letters, income proofs, and financial statements.
• Technical data: basic device, log, and usage information needed to run the service securely and prevent fraud.

We do not ask for more sensitive data than necessary, and we do not store raw Aadhaar numbers — identity verification is done through licensed channels such as DigiLocker.

We use your data for these purposes, and no others:

• To show you indicative offers from lenders while you remain anonymous.
• To verify your identity if and when you choose to proceed.
• To share your chosen details with the one lender you select (see "The one-time, one-lender handoff").
• To operate, secure, and improve the Platform and prevent fraud and misuse.
• To communicate with you about your applications, offers, and service updates.
• To meet legal, regulatory, and grievance-handling obligations.

We do not sell your data. We do not monetise your contact details. Lenders pay us subscription fees to participate — our business model never depends on selling leads.

We process your personal data on the basis of your consent, which you give when you register and when you take specific steps such as KYC or a credit check. We may also process limited data for certain legitimate uses permitted by law, and to comply with legal obligations. You can withdraw consent at any time (see "Your rights").

Until you actively choose a lender, lenders only ever see an anonymized version of your profile. They do not see your name, email, mobile number, or uploaded documents. They see only the non-identifying signals needed to make an indicative offer (such as loan amount, tenure, pin code, and broad income bands).

Your identity and documents are shared only after you pick a single winning lender — and only with that one lender. Not a panel. Not "12 partners". This is the core promise of Indiloan.

Every document we hand over is watermarked with the recipient lender’s name and a timestamp. If a document is ever leaked, the watermark identifies whose copy it was. This makes the recipient accountable for the data we entrust to them.

We use cookies and similar technologies that are necessary to run the Platform — for example, to keep you signed in, to keep your session secure, and to remember your preferences. We do not use advertising or cross-site tracking cookies to profile you for ads.

You can control or delete cookies through your browser settings. Blocking essential cookies may stop parts of the Platform (such as sign-in) from working.

We share data only in these limited situations:

• With the single lender you choose, after you choose them.
• With verification partners (such as a DigiLocker/KUA partner for Aadhaar, a PAN verification service, and CIBIL) strictly to perform the checks you have consented to.
• With service providers (Data Processors) who help us run the Platform — such as cloud hosting, email, and SMS providers — under contracts that bind them to process data only on our instructions and to keep it secure.
• Where required by law, regulation, court order, or a valid request from a government authority.
• In connection with a merger, acquisition, or reorganisation, subject to this policy continuing to protect your data.

We store your data on secure cloud infrastructure. Some of our service providers may process data on servers located outside India. Where that happens, we do so in accordance with the DPDP Act and only with providers who offer appropriate safeguards. [Specific storage regions and transfer mechanisms to be confirmed with legal review.]

Under the DPDP Act you have the right to:

• Access a summary of the personal data we hold about you and how we process it.
• Correct, complete, update, or erase your personal data.
• Withdraw consent at any time (this does not affect processing already done before withdrawal).
• Nominate another individual to exercise your rights in case of death or incapacity.
• Grievance redressal — raise a complaint and have it addressed (see our Grievance Redressal page).

To exercise any of these rights, contact us at the address in "Contact us". We may need to verify your identity first. We will respond within the timelines required by law.

We keep your personal data only as long as needed for the purposes above, or as required by law (for example, to comply with financial, tax, or anti-fraud record-keeping rules). When data is no longer needed, we delete it or anonymise it so it can no longer identify you. [Specific retention periods to be confirmed with legal review.]

We use reasonable security safeguards including encryption in transit, access controls, row-level security on our database, audit logging, and document watermarking. We restrict access to your data to people and systems that need it. No system is perfectly secure, but security is designed into Indiloan from the ground up rather than bolted on. If a personal data breach occurs, we will notify you and the Data Protection Board of India as required by law.

The Platform may link to lender websites or other third-party services. We are not responsible for their content or privacy practices. When you leave Indiloan, we encourage you to read the privacy policy of any site you visit.

Indiloan is intended for individuals aged 18 and above. We do not knowingly collect data from children. Where a borrower is a minor (for example, an education-loan applicant), the application is expected to be made by or with a parent/guardian co-applicant, with verifiable consent, in line with the DPDP Act.

We may update this policy from time to time. The "last updated" date above reflects the current version. If we make a material change, we will take reasonable steps to notify you — for example, by a notice on the Platform or by email.

For any privacy question or to exercise your rights, contact our privacy team at privacy@indiloan.in, or our Grievance Officer (see the Grievance Redressal page).