Who issues this policy: the lender

This policy is issued by the lender:

There is no other lender behind our apps. Techfino Capital Private Limited lends in its own name, on its own balance sheet, under its own RBI registration. We are not a marketplace, a lead aggregator for an undisclosed lender, or an agent of an unlicensed entity. Where we ever act with a co-lending or partner institution, that institution is named to you in the sanction letter and loan agreement before you accept the loan.

Apps and services this policy covers

This policy applies to:

• TechFino CredCo — iOS and Android (app support).
• TechFino Cred-Co — iOS (app support).
• The website techfino.in and our customer and partner portals.
• All loan services provided by the lender — enquiry, application, sanction, disbursal, servicing, collection and closure — through any channel.

What the apps do, and what they do not do

The apps provide credit-information services: your credit score, your credit bureau report and insights into your credit health. The apps do not accept loan applications, do not perform KYC or e-signing, do not disburse money and do not collect repayments. Loans are made by the lender through its own regulated channels.

Because the publisher of these apps is a licensed lender, this single policy covers both the apps and the lender’s loan services, so that you can see in one place exactly how the lender handles your data.

Scope, acceptance and changes

By accessing or using the apps or the lender’s services, you confirm that you have read and understood this policy. If you do not agree with it, please do not use the apps or the services.

We may update this policy. The current version is always published at https://www.techfino.in/credco-privacy.html and carries the date on which it was last updated. Where a change materially affects how we handle your personal data, we will notify you in the app, by email or by SMS before the change takes effect. Your continued use of the apps after that date constitutes acceptance of the updated policy.

This policy should be read with our Terms and Conditions, our Fair Practices Code and, for borrowers, the sanction letter and loan agreement signed with the lender.

Information we collect

The lender collects only the personal data it needs to identify you, to provide the credit-information service you have asked for, to assess and service a loan, and to meet its obligations under Indian law. Mandatory and optional fields are marked at the point of collection. You may always choose not to provide information by choosing not to use a particular feature.

a. Information you give us

• Identity: full name, date of birth, gender, and government identifiers required for KYC under the RBI Master Direction on KYC and the Prevention of Money Laundering Act, 2002.
• Contact: mobile number, email address and postal address.
• Account credentials: login name, password (stored only as a salted hash) and the one-time passwords used to verify you.
• Financial and employment information and, for business borrowers, business details — where relevant to a loan application or servicing.
• Correspondence: the content of support requests, complaints and calls you make to us.

b. Information from credit bureaus

With your explicit consent, the lender retrieves your credit score and credit report from a credit information company licensed under the Credit Information Companies (Regulation) Act, 2005. See section 5.

c. Information collected automatically

• Device model, operating system version and app version.
• A device or installation identifier used to keep your session secure.
• IP address, and log data such as timestamps, screens viewed and errors encountered.
• Security and fraud signals — for example, repeated failed logins.

d. Information from other sources

Where you have applied for a loan, we may receive information from KYC and identity verification providers, from banks for repayment mandates, and from public registries, strictly for the purposes set out in section 6.

We do not knowingly collect any personal data that is not needed for the purposes stated in this policy.

Credit information and your consent

The central function of the apps is to show you your own credit information. To do that, the lender must obtain it from a credit bureau on your behalf.

• We ask for your explicit, informed consent before any credit bureau enquiry is made. Consent is recorded with a timestamp.
• We verify that the request is genuinely yours by sending a one-time password to your registered mobile number.
• The enquiry we make to view your own report is a consumer-initiated enquiry, which does not by itself reduce your credit score.
• Your credit report is shown to you and is used, where you have applied for credit, to assess your eligibility and the rate of interest applicable to you.
• You may withdraw your consent at any time by writing to customercare@techfino.in. Withdrawal stops future enquiries; it does not affect processing already carried out lawfully, or data we must retain by law.

Credit information is handled in accordance with the Credit Information Companies (Regulation) Act, 2005 and the rules and regulations made under it. If you believe your bureau record is inaccurate, you may raise it with us and we will take it up with the bureau, and you may also approach the bureau directly.

How the lender uses your information

The lender uses your personal data only for these purposes:

• To create and secure your account and verify that you are who you say you are.
• To retrieve and display your credit score, credit report and credit-health insights.
• To assess an application for credit, determine eligibility and price the loan, where you have applied to the lender for a loan.
• To provide, service and administer a loan — disbursal, statements, instalment reminders, collection, foreclosure and closure — where you are a borrower.
• To communicate with you about your account, transactions, requests and complaints.
• To detect, investigate and prevent fraud, money laundering, impersonation and misuse of our systems.
• To comply with our obligations to the Reserve Bank of India, credit information companies, tax authorities, courts and other lawful authorities.
• To improve the safety, reliability and usability of our apps and services, using aggregated or de-identified data wherever possible.

We do not use your personal data for automated decision-making that produces a legal effect on you without human review, and we do not use it for purposes unrelated to those listed above.

Legal basis for processing

We process your personal data on the following bases:

• Your consent — for credit bureau enquiries and for any optional feature or communication.
• Performance of a contract — to give effect to the loan agreement or terms of service you have entered into with the lender.
• Legal obligation — KYC and record-keeping under the Prevention of Money Laundering Act, 2002 and RBI directions; reporting to credit information companies; tax and audit requirements.
• Legitimate uses permitted under the Digital Personal Data Protection Act, 2023 — for example, preventing fraud or responding to a lawful authority.

How we share information

We share personal data only in these circumstances, and only to the extent necessary:

• Within the lender — with employees of Techfino Capital Private Limited who need it to serve you, under confidentiality obligations and access controls.
• Credit information companies — to retrieve your report with your consent, and, where you are a borrower, to report your loan and repayment conduct as the Credit Information Companies (Regulation) Act, 2005 requires every lender to do.
• Service providers — see section 9.
• Banks and payment institutions — to disburse a loan or to set up and process repayment mandates.
• Regulators and authorities — the Reserve Bank of India, tax authorities, courts, law enforcement and other bodies, where required by law or by a valid legal process.
• Professional advisers and auditors — under confidentiality.
• Assignees — if a loan portfolio is assigned, securitised or transferred, or in a corporate reorganisation, subject to the same protections and to applicable RBI directions.

Service providers and processors

The lender engages third parties to perform specific functions on its behalf — for example cloud hosting, one-time password and SMS delivery, email delivery, identity and KYC verification, payment processing, analytics and customer-support tooling.

• They act only on our documented instructions and only for the purpose we appoint them for.
• They are bound by written contracts containing confidentiality, security and data protection obligations.
• They may not use your personal data for their own purposes, and may not further share it except as we direct.
• We review their security posture before onboarding and periodically thereafter.

Where your data is stored

All personal data and credit information collected by the lender in connection with the apps and its loan services is stored on servers located in India, in line with Reserve Bank of India requirements for the storage of financial and payment data.

Where a service provider processes data outside India for a limited technical purpose, we do so only to a jurisdiction not restricted by the Government of India, only under contractual safeguards, and only where permitted by the Digital Personal Data Protection Act, 2023 and applicable RBI directions.

How long we keep your data

We keep personal data only as long as we need it, or as long as the law requires, whichever is longer:

• Account and profile data — while your account is active, and for a reasonable period afterwards to handle queries and disputes.
• Credit bureau reports — retained only for the period necessary to provide the service and to evidence the consent under which they were obtained.
• KYC records and loan records — for at least eight years after the closure of the account or the completion of the transaction, as required by the Prevention of Money Laundering Act, 2002, the rules made under it, and RBI directions applicable to NBFCs.
• Accounting and tax records — for the period prescribed under the Companies Act, 2013 and the Income Tax Act, 1961.

When a retention period ends, data is securely deleted or irreversibly anonymised.

How we protect your data

The security of your information is a priority for the lender. We maintain physical, electronic and procedural safeguards that meet applicable law, including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

• Data in transit is protected with TLS encryption; data at rest is encrypted.
• Systems holding personal data are in access-controlled facilities with restricted, logged and reviewed access on a need-to-know basis.
• Passwords are stored only as salted hashes; access to the app is protected by one-time password verification.
• Our staff are trained in the correct handling of personal and sensitive personal data.
• We monitor for security incidents and, in the event of a personal data breach, we will notify the affected users and the relevant authorities as required by law.

Please keep your password and one-time passwords confidential, log out before handing your device to anyone else, and secure the device itself. No method of transmission or storage is completely secure; while we use commercially acceptable means to protect your information, we cannot guarantee absolute security.

Your rights

As a Data Principal under the Digital Personal Data Protection Act, 2023, you have the right to:

• Access a summary of the personal data the lender holds about you and how it is processed.
• Correct, complete or update inaccurate or incomplete data. You can edit most details in the app, or write to us.
• Erase your personal data where it is no longer needed and no legal obligation requires us to keep it — see section 14.
• Withdraw consent at any time, as easily as it was given.
• Nominate another individual to exercise your rights in the event of your death or incapacity.
• Grievance redressal — see section 19.

To exercise any of these rights, write to customercare@techfino.in or grievance@techfino.in from your registered email address, or call +91-8069474744. We will verify your identity and respond within 30 days.

Deleting your account and your data

You can ask the lender to delete your account and the personal data associated with it at any time. There is no charge, and you do not need to give a reason.

1. Email customercare@techfino.in from the email address or send a request from the mobile number registered on your account, with the subject line “Account and data deletion request”; or call +91-8069474744.
2. We will verify your identity, acknowledge the request, and confirm what will be deleted and what we are legally required to retain.
3. We complete deletion within 30 days of verifying the request.

What we must retain. If you have or have had a loan with the lender, KYC and loan records must be retained for at least eight years after closure of the account under the Prevention of Money Laundering Act, 2002 and RBI directions, and repayment conduct already reported to credit information companies cannot be withdrawn, because reporting is a statutory obligation of every lender. Retained records are locked down and used only to meet those legal obligations.

Deleting the app from your device does not by itself delete your account — please send us a deletion request as above.

Device permissions and what we never access

The apps request a device permission only where a feature you have chosen needs it, and only with your consent given through the operating system prompt. Permissions are used for the stated purpose and nothing else. You may decline any permission, or withdraw it later in your device settings (on iOS: Settings › Privacy & Security, or Settings › the app); declining a permission only disables the feature that needs it.

We do not collect biometric data. We do not use your data to build advertising profiles, and we do not share it with advertising networks or data brokers.

Children

The apps and the lender’s services are intended for individuals aged 18 years and above. We do not knowingly collect personal data from a child. If we learn that we have collected data from a person under 18 without verifiable parental consent, we will delete it. If you believe this has happened, write to grievance@techfino.in.

Cookies and analytics

Our website uses cookies and similar technologies that are necessary to keep the site working and secure, and, where you allow it, to understand how the site is used so that we can improve it. You can control cookies through your browser settings.

In the apps we use privacy-respecting product analytics limited to app performance, crashes and feature usage. We do not use third-party advertising SDKs, and we do not track you across other companies’ apps or websites.

Prohibited content under the IT Rules, 2021

No content prohibited by law may be published or transmitted on any site, portal or computer resource of the lender. Users must not host, display, upload, modify, publish, transmit, store, update or share information that: belongs to another person and to which the user has no right; is obscene, pornographic, paedophilic, invasive of another’s privacy, insulting or harassing on the basis of gender, racially or ethnically objectionable, relates to or encourages money laundering or gambling, or promotes enmity between groups; is harmful to a child; infringes any patent, trademark, copyright or other proprietary right; deceives or misleads the addressee about the origin of a message or knowingly communicates misinformation; impersonates another person; threatens the unity, integrity, defence, security or sovereignty of India or public order; contains a software virus or code designed to interrupt, destroy or limit the functionality of any computer resource; or violates any law in force.

The lender may terminate a user’s access, remove non-compliant information, or both. If such information is hosted, stored or published, it will be removed or disabled as early as possible. Any grievance in this regard may be raised in the manner set out in section 19.

Grievance officer and escalation

The lender has appointed a Grievance Officer under the Information Technology Act, 2000 and the rules made under it, who is also our Principal Nodal Officer for the purposes of the Reserve Bank – Integrated Ombudsman Scheme, 2021.

Escalation

1. Customer care — customercare@techfino.in or +91-8069474744. Monday to Friday, 9:00 AM – 6:00 PM IST and Saturday, 10:00 AM – 3:00 PM IST, except public holidays. Response within 14 working days.
2. Grievance Officer / Principal Nodal Officer — as above, quoting your complaint reference number.
3. Reserve Bank of India Ombudsman — if your complaint is not resolved within 30 days, lodge it on the RBI Complaint Management System at cms.rbi.org.in, call 14448 (toll free), or write to the Centralised Receipt and Processing Centre, Reserve Bank of India, 4th Floor, Sector 17, Chandigarh – 160017. See our Ombudsman page.

Our detailed privacy-related grievance redressal mechanism and our grievance redressal policy are published in full.

Contact the lender

For any question about this policy or about how the lender handles your data:

Techfino Capital Private Limited
1st Floor, Smartworks, DSR Technocube,
Thubarahalli, Varthur Road,
Bengaluru Urban, Karnataka – 560037, India
Email: customercare@techfino.in
Privacy & grievances: grievance@techfino.in
Phone: +91-8069474744
Monday to Friday, 9:00 AM – 6:00 PM IST and Saturday, 10:00 AM – 3:00 PM IST, except public holidays

RBI Certificate of Registration No. N-02.00314 · CIN U65999KA2018PTC114532 · GSTIN 29AAGCT8403P1ZN

Signed policy and other language versions

The board-approved privacy policy of the lender is published as a PDF, together with translations. All versions open directly, without login.

Issued by Techfino Capital Private Limited, the lender, holder of Reserve Bank of India Certificate of Registration No. N-02.00314. This policy is effective from 1 October 2024 and was last updated on 17 August 2026.