Privacy Policy
This Privacy Policy describes how FinCrif India Private Limited collects, uses, shares, stores, and protects personal data submitted through our official website, mobile applications, digital platforms, and services.
1. Introduction and Scope
FinCrif India Private Limited (hereinafter referred to as “FinCrif”, “Company”, “we”, “us” or “our”) is committed to maintaining the confidentiality, integrity and security of personal information entrusted to us by users, customers and prospective borrowers.
This Privacy Policy governs the collection, receipt, access, processing, storage, utilisation, disclosure, retention and protection of Personal Data submitted through our official website, mobile application, digital platforms, online forms and other communication channels operated or controlled by FinCrif.
This Policy is intended to provide transparency regarding our data-processing practices and shall be read in conjunction with our Terms and Conditions, applicable service agreements and other relevant disclosures.
Our data protection practices are designed to comply with applicable Indian laws and regulatory requirements, including, to the extent applicable and in force:
- The Digital Personal Data Protection Act, 2023 (DPDP Act).
- The Digital Personal Data Protection Rules, 2025.
- The Information Technology Act, 2000.
- The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, to the extent applicable.
- Applicable Reserve Bank of India (RBI) directions, including the RBI Digital Lending Directions, 2025, wherever applicable to our role and contractual arrangements with regulated entities.
By accessing or using our website, application or services, you acknowledge that you have been provided an opportunity to review this Privacy Policy. Where consent is required by applicable law, the relevant processing activities shall be undertaken only after obtaining the requisite consent through an appropriate affirmative action.
2. Definitions
For the purposes of this Policy:
3. Categories of Personal Data Collected
Depending upon the services requested by the user and the stage of the loan application process, FinCrif may collect and process the following categories of information:
3.1 Basic Identification and Contact Information
- Full name.
- Registered mobile number.
- Email address, where voluntarily provided.
- Residential or communication address, where required.
- Other identification details voluntarily submitted by the user.
3.2 Loan Application and Financial Information
Where a user voluntarily proceeds with a loan eligibility assessment or application, we may collect information such as:
- Employment and occupational details.
- Monthly income and salary-related information.
- Existing loan and financial obligation details.
- Requested loan amount and repayment preferences.
- Credit-related information and eligibility parameters.
- Income documents and other supporting financial documents voluntarily uploaded by the user.
3.3 Identity and Verification Information
Where necessary for the requested service, we may process identification and verification information submitted by the user, including PAN details, date of birth and other KYC-related particulars. Such information shall be collected only where required for the relevant service, verification process or lawful purpose.
3.4 Information Submitted Through Customer Support
We may collect information contained in communications, complaints, service requests, feedback and correspondence submitted by users through our website, email, telephone or other authorised communication channels.
4. Device, Technical and Authentication Information
For platform functionality, authentication, operational monitoring, cybersecurity and fraud prevention, our website and application may automatically process limited technical information, including:
- Device manufacturer and model.
- Operating system and version.
- Application version.
- IP address.
- Session identifiers and technical logs.
- Authentication and access timestamps.
- Error logs and application performance information.
Such information shall be processed to the extent reasonably necessary for security, troubleshooting, service delivery and operational integrity.
4.1 OTP-Based Authentication
FinCrif may utilise the Google SMS Retriever API to facilitate automated OTP verification.
This functionality is designed to retrieve only the specific OTP verification SMS intended for our application, subject to the technical requirements of the Google SMS Retriever mechanism.
Our application does not require general SMS-reading permissions to perform this authentication functionality.
The OTP is used for authentication and verification purposes and shall not be treated as authorisation to access unrelated personal communications.
5. Information and Device Resources NOT Accessed
FinCrif follows the principles of data minimisation and purpose limitation.
Except where a specific functionality is subsequently introduced and separately disclosed with appropriate lawful consent, our application does not access, collect or retrieve:
We do not engage in indiscriminate extraction of personal information from a user's mobile device.
6. Device Permissions and Document Upload Mechanism
Our application is designed to operate without requesting unnecessary or intrusive device permissions.
7. Purpose and Lawful Basis of Data Processing
FinCrif processes Personal Data only for specified, legitimate and lawful purposes, including:
- •User registration and account creation.
- •Mobile number verification and authentication.
- •Preliminary loan eligibility assessment.
- •Identification of potentially suitable loan products.
- •Matching users with relevant banks and NBFCs.
- •Facilitating loan application referrals and processing.
- •Enabling communication between users and authorised lending partners.
- •Responding to customer enquiries, complaints and service requests.
- •Preventing fraudulent transactions, impersonation and unauthorised platform access.
- •Maintaining operational records, audit trails and security logs.
- •Complying with applicable statutory, judicial and regulatory requirements.
- •Improving platform functionality, service quality and customer experience.
Personal data shall not be processed for purposes materially different from those disclosed to the user unless a valid legal basis exists and any additional consent or notice required by applicable law has been provided.
8. Role of FinCrif in the Digital Lending Ecosystem
FinCrif operates as a digital financial services and loan discovery platform facilitating the identification and referral of prospective borrowers to relevant banks and NBFCs.
Depending on the specific product, contractual arrangement and applicable regulatory framework, FinCrif may perform functions relating to lead generation, loan-product discovery, application facilitation or services as a Lending Service Provider (LSP).
Important Clarification on Our Lending Role:
FinCrif does not represent itself as a bank or NBFC merely by facilitating access to lending products. Unless expressly authorised under a separate applicable arrangement, FinCrif does not independently sanction loans, determine final lending decisions, disburse loan amounts or guarantee loan approval.
The final decision regarding credit approval, applicable interest rates, loan tenure, repayment obligations, KYC acceptance and disbursement rests with the concerned lending institution in accordance with its policies and applicable regulations.
9. Sharing and Disclosure of Personal Data
FinCrif may disclose or share relevant personal data with the following categories of recipients, subject to applicable law and the purpose for which the information was collected:
Relevant information may be transmitted to participating banks, NBFCs and other lending institutions for:
- Loan eligibility assessment.
- Creditworthiness evaluation.
- Application processing.
- Customer verification.
- Loan-product matching.
- Application referral and follow-up.
10. Consent and User Authorisation
FinCrif adopts a consent-based approach wherever consent constitutes the applicable legal basis for processing personal data.
11. Data Security and Information Protection Measures
FinCrif recognises the importance of protecting Personal Data against unauthorised access, accidental disclosure, alteration, misuse, destruction and other security risks.
Subject to the nature of the data and applicable requirements, we implement reasonable technical and organisational security safeguards, which may include:
- HTTPS and SSL/TLS encryption for data transmission.
- Firewall and network security controls.
- Access restrictions and role-based authorisation.
- Authentication and session-management mechanisms.
- Secure database access and credential-management practices.
- System monitoring and security logging.
- Backup and recovery procedures.
- Vulnerability management and security maintenance.
- Internal access-control procedures.
- Appropriate confidentiality obligations for authorised personnel and service providers.
Access to customer information is restricted to authorised personnel who require such access for legitimate business, operational, technical or compliance purposes.
While FinCrif endeavours to maintain appropriate security standards, no electronic transmission, storage infrastructure or internet-based system can be guaranteed to be completely immune from every conceivable security threat.
12. Data Retention, Archival and Deletion
FinCrif retains Personal Data only for the period reasonably necessary to fulfil the purposes for which it was collected or for such longer period as may be required or permitted under applicable laws, regulatory directions, contractual obligations and legitimate record-keeping requirements.
The retention period may depend upon:
- The nature and category of information.
- The status of the user's account or application.
- The completion of the requested financial service.
- Applicable statutory and regulatory retention obligations.
- Pending disputes, complaints, investigations or legal proceedings.
- Fraud prevention and audit requirements.
Upon expiry of the applicable retention period, Personal Data shall be securely erased, anonymised or otherwise disposed of in accordance with applicable legal requirements and internal data-retention procedures.
13. Data Principal Rights
Subject to the applicability of the DPDP Act and other applicable laws, users may exercise the following rights in relation to their personal data:
Requests may be submitted through the official contact details specified in this Policy. FinCrif may undertake reasonable verification of the requester's identity before processing such requests.
14. Third-Party Websites and External Platforms
Our website or application may contain links, referral URLs, redirection mechanisms or integrations associated with third-party banks, NBFCs, financial institutions and other service providers.
Upon accessing an external website or application, the user may become subject to the privacy policy, terms of service and data-handling practices of that third party.
FinCrif does not independently control the privacy practices, security infrastructure or data-processing operations of external platforms.
Users are advised to review the applicable privacy policies and disclosures of the concerned third-party service providers before submitting additional personal or financial information.
15. Children's Personal Data
FinCrif's financial-services platform is intended for individuals legally eligible to access the relevant financial services.
We do not knowingly solicit or intentionally process children's Personal Data in contravention of applicable Indian data protection laws.
Where processing of children's Personal Data is legally permitted or required, the applicable statutory requirements concerning verifiable parental or lawful guardian consent and other safeguards shall be followed.
16. Data Breach Management and Incident Response
FinCrif maintains appropriate organisational and technical procedures for identifying, assessing, containing and responding to suspected or confirmed Personal Data breaches.
In the event of a Personal Data breach, FinCrif shall undertake appropriate remedial measures and provide notifications to affected individuals and competent authorities, wherever and to the extent required under applicable law.
Such measures may include:
- Identification and containment of the incident.
- Assessment of the nature and extent of affected information.
- Investigation of the potential impact.
- Implementation of corrective and preventive measures.
- Preservation of relevant records and audit trails.
- Regulatory and user notifications in accordance with applicable requirements.
17. Cookies and Website Tracking Technologies
Our website may utilise cookies, session identifiers and similar technologies for website functionality, user-session management, security, performance monitoring and service improvement.
Where required, users shall be provided with appropriate information and consent choices concerning the use of such technologies.
Users may manage or disable cookies through their browser settings. However, disabling certain cookies may affect the availability or functionality of particular website features.
18. Changes and Modifications to this Privacy Policy
FinCrif reserves the right to amend, update, modify or replace this Privacy Policy from time to time to reflect changes in applicable legislation, regulatory directions, technological developments, business operations or data-processing practices.
Any material modification shall be published on our official website and/or application, together with an updated effective date.
Where required by applicable law, additional notice or consent shall be obtained before implementing material changes affecting the processing of Personal Data.
Continued use of the platform after publication of an updated Policy shall not, by itself, be treated as consent where affirmative consent is legally required.
19. Grievance Redressal and Privacy Complaints
In accordance with applicable data protection requirements, FinCrif has designated the following authorised contact for receiving and addressing privacy-related communications and grievances:
Nikhil Yadav
Authorised Grievance Contact • FinCrif India Private Limited
20. Governing Law and Jurisdiction
This Privacy Policy shall be governed by and interpreted in accordance with the laws of India.
Any disputes arising out of or relating to this policy shall be subject to the jurisdiction of the competent courts and tribunals in accordance with applicable Indian law.
Nothing contained herein shall exclude or restrict any statutory right or remedy available to a user under applicable data protection, consumer protection or financial regulatory legislation.
21. Contact Information
For any privacy-related enquiry, request, clarification or complaint, please contact:
FINCRIF INDIA PRIVATE LIMITED
Looking for general assistance or want to visit our offices?
Contact Support Page